hereya-cli 0.86.3 → 0.88.0

package/oclif.manifest.json

@@ -241,14 +241,6 @@
           "allowNo": false,
           "type": "boolean"
         },
-        "token": {
-          "description": "Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.",
-          "name": "token",
-          "required": false,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
         "workspace": {
           "char": "w",
           "description": "name of the workspace to deploy the packages for",
@@ -581,14 +573,6 @@
           "multiple": false,
           "type": "option"
         },
-        "token": {
-          "description": "Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.",
-          "name": "token",
-          "required": false,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
         "workspace": {
           "char": "w",
           "description": "workspace to set as default",
@@ -774,14 +758,6 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
-        },
-        "token": {
-          "description": "Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.",
-          "name": "token",
-          "required": false,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
         }
       },
       "hasDynamicHelp": false,
@@ -877,14 +853,6 @@
           "multiple": false,
           "type": "option"
         },
-        "token": {
-          "description": "Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.",
-          "name": "token",
-          "required": false,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
         "workspace": {
           "char": "w",
           "description": "name of the workspace to run the command in",
@@ -952,14 +920,6 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
-        },
-        "token": {
-          "description": "Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.",
-          "name": "token",
-          "required": false,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
         }
       },
       "hasDynamicHelp": false,
@@ -1045,14 +1005,6 @@
           "allowNo": false,
           "type": "boolean"
         },
-        "token": {
-          "description": "Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.",
-          "name": "token",
-          "required": false,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
         "workspace": {
           "char": "w",
           "description": "name of the workspace to undeploy the packages for",
@@ -1175,14 +1127,6 @@
           "multiple": true,
           "type": "option"
         },
-        "token": {
-          "description": "Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.",
-          "name": "token",
-          "required": false,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
         "workspace": {
           "char": "w",
           "description": "name of the workspace to install the packages for",
@@ -1280,14 +1224,6 @@
           "multiple": true,
           "type": "option"
         },
-        "token": {
-          "description": "Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.",
-          "name": "token",
-          "required": false,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
         "version": {
           "description": "specific app version to deploy (defaults to latest)",
           "name": "version",
@@ -1335,16 +1271,7 @@
       "examples": [
         "<%= config.bin %> <%= command.id %> my-org/my-app"
       ],
-      "flags": {
-        "token": {
-          "description": "Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.",
-          "name": "token",
-          "required": false,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        }
-      },
+      "flags": {},
       "hasDynamicHelp": false,
       "hiddenAliases": [],
       "id": "app:deployments",
@@ -1399,14 +1326,6 @@
           "multiple": true,
           "type": "option"
         },
-        "token": {
-          "description": "Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.",
-          "name": "token",
-          "required": false,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
         "workspace": {
           "char": "w",
           "description": "workspace where the app is currently deployed",
@@ -1454,14 +1373,6 @@
         "<%= config.bin %> <%= command.id %> my-org/my-app -w my-workspace DATABASE_URL"
       ],
       "flags": {
-        "token": {
-          "description": "Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.",
-          "name": "token",
-          "required": false,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
         "workspace": {
           "char": "w",
           "description": "workspace to read env outputs from",
@@ -1496,16 +1407,7 @@
       "examples": [
         "<%= config.bin %> <%= command.id %>"
       ],
-      "flags": {
-        "token": {
-          "description": "Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.",
-          "name": "token",
-          "required": false,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        }
-      },
+      "flags": {},
       "hasDynamicHelp": false,
       "hiddenAliases": [],
       "id": "app:list",
@@ -1587,14 +1489,6 @@
         "<%= config.bin %> <%= command.id %> my-org/my-app -w my-workspace"
       ],
       "flags": {
-        "token": {
-          "description": "Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.",
-          "name": "token",
-          "required": false,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
         "workspace": {
           "char": "w",
           "description": "workspace to read deployment status from",
@@ -3217,14 +3111,6 @@
           "allowNo": false,
           "type": "boolean"
         },
-        "token": {
-          "description": "Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.",
-          "name": "token",
-          "required": false,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
         "workspace": {
           "char": "w",
           "description": "name of the workspace",
@@ -3258,14 +3144,6 @@
       "args": {},
       "description": "Generate a workspace-scoped executor token for the remote executor",
       "flags": {
-        "token": {
-          "description": "Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.",
-          "name": "token",
-          "required": false,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
         "workspace": {
           "char": "w",
           "description": "name of the workspace",
@@ -3305,14 +3183,6 @@
           "allowNo": false,
           "type": "boolean"
         },
-        "token": {
-          "description": "Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.",
-          "name": "token",
-          "required": false,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
         "workspace": {
           "char": "w",
           "description": "name of the workspace",
@@ -3342,5 +3212,5 @@
       ]
     }
   },
-  "version": "0.86.3"
+  "version": "0.88.0"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hereya-cli",
   "description": "Infrastructure as Package",
-  "version": "0.86.3",
+  "version": "0.88.0",
   "author": "Hereya Developers",
   "bin": {
     "hereya": "./bin/run.js"

package/dist/lib/active-cloud.d.ts

@@ -1,31 +0,0 @@
-/**
- * The active cloud auth credentials for this CLI invocation.
- *
- * Either sourced from an ephemeral `--token` (in which case `clientId` and
- * `refreshToken` are `null` because there is no persisted client identity
- * and the token cannot be refreshed) or from the persisted `backend.yaml`
- * + keychain credentials.
- */
-export interface ActiveCloudAuth {
-    accessToken: string;
-    clientId: null | string;
-    cloudUrl: string;
-    refreshToken: null | string;
-}
-/**
- * Returns the active cloud auth, preferring an in-scope ephemeral `--token`
- * over the persisted `backend.yaml` + keychain credentials. Returns `null`
- * when neither is available.
- *
- * **This is the single source of truth for "are we authenticated to
- * hereya-cloud right now?"** — every code path that previously read from
- * `loadBackendConfig()` + `getCloudCredentials()` directly (and therefore
- * silently ignored an ephemeral `--token`) should call this instead.
- */
-export declare function getActiveCloudAuth(): Promise<ActiveCloudAuth | null>;
-/**
- * Whether the cloud backend is "active" — either via `hereya login` or via
- * an in-scope ephemeral `--token`. Used to decide whether to consult the
- * cloud package registry, the remote executor, etc.
- */
-export declare function isCloudBackendActive(): Promise<boolean>;

package/dist/lib/active-cloud.js

@@ -1,55 +0,0 @@
-import { getCloudCredentials, loadBackendConfig } from '../backend/config.js';
-import { BackendType } from '../backend/index.js';
-import { getEphemeralToken } from './ephemeral-token.js';
-const DEFAULT_CLOUD_URL = 'https://cloud.hereya.dev';
-/**
- * Returns the active cloud auth, preferring an in-scope ephemeral `--token`
- * over the persisted `backend.yaml` + keychain credentials. Returns `null`
- * when neither is available.
- *
- * **This is the single source of truth for "are we authenticated to
- * hereya-cloud right now?"** — every code path that previously read from
- * `loadBackendConfig()` + `getCloudCredentials()` directly (and therefore
- * silently ignored an ephemeral `--token`) should call this instead.
- */
-export async function getActiveCloudAuth() {
-    const ephemeral = getEphemeralToken();
-    if (ephemeral) {
-        const cloudUrl = ephemeral.cloudUrl
-            ?? process.env.HEREYA_CLOUD_URL
-            ?? (await loadBackendConfig()).cloud?.url
-            ?? DEFAULT_CLOUD_URL;
-        return {
-            accessToken: ephemeral.token,
-            clientId: null,
-            cloudUrl,
-            refreshToken: null,
-        };
-    }
-    const config = await loadBackendConfig();
-    if (config.current !== BackendType.Cloud || !config.cloud) {
-        return null;
-    }
-    const credentials = await getCloudCredentials(config.cloud.clientId);
-    if (!credentials) {
-        return null;
-    }
-    return {
-        accessToken: credentials.accessToken,
-        clientId: config.cloud.clientId,
-        cloudUrl: config.cloud.url,
-        refreshToken: credentials.refreshToken,
-    };
-}
-/**
- * Whether the cloud backend is "active" — either via `hereya login` or via
- * an in-scope ephemeral `--token`. Used to decide whether to consult the
- * cloud package registry, the remote executor, etc.
- */
-export async function isCloudBackendActive() {
-    if (getEphemeralToken()) {
-        return true;
-    }
-    const config = await loadBackendConfig();
-    return config.current === BackendType.Cloud;
-}

package/dist/lib/ephemeral-token.d.ts

@@ -1,45 +0,0 @@
-/**
- * In-memory context for an ephemeral, in-memory-only access token.
- *
- * This is used to support per-invocation tokens (e.g. minted by a separate
- * MCP server) without persisting credentials to the user's keychain or
- * `~/.hereya/secrets/`. Code that needs to read the active token (e.g. the
- * cloud backend factory in `src/backend/index.ts`) calls
- * {@link getEphemeralToken} and uses it directly as the bearer for outgoing
- * cloud API calls. No exchange via `loginWithToken` happens — that path is
- * intentionally avoided because it would mint a long-lived refresh token.
- */
-export interface EphemeralTokenContext {
-    cloudUrl?: string;
-    token: string;
-}
-/**
- * Returns the active ephemeral token context, or `undefined` if no
- * `withEphemeralToken` scope is currently in flight.
- *
- * Falls back to the `HEREYA_EPHEMERAL_TOKEN` env var when no async-local-
- * storage context is set — that's how subprocesses (the credential helper
- * grandchild, etc.) inherit the ephemeral context across process
- * boundaries. The env var is set automatically by `withEphemeralToken`.
- */
-export declare function getEphemeralToken(): EphemeralTokenContext | undefined;
-/**
- * Run `fn` inside an ephemeral-token scope. While `fn` is executing,
- * `getEphemeralToken()` returns the supplied token (and optional cloudUrl),
- * and `process.env.HEREYA_EPHEMERAL_TOKEN` is set so subprocesses inherit
- * the same ephemeral context.
- *
- * Critical guarantees:
- * - The token is held in-memory only. It is NEVER passed to the secret
- *   manager or written to disk.
- * - After `fn` returns or throws, `getEphemeralToken()` returns `undefined`
- *   again and `HEREYA_EPHEMERAL_TOKEN` is restored to its prior value.
- * - The cached backend in `src/backend/index.ts` is cleared before and after
- *   the scope so that a stale, persisted-credential-backed CloudBackend is
- *   never used while the scope is active, and the scope's in-memory backend
- *   does not leak to subsequent code that expected the user's regular
- *   credentials.
- */
-export declare function withEphemeralToken<T>(token: string, fn: () => Promise<T>, options?: {
-    cloudUrl?: string;
-}): Promise<T>;

package/dist/lib/ephemeral-token.js

@@ -1,89 +0,0 @@
-import { AsyncLocalStorage } from 'node:async_hooks';
-import { clearBackend } from '../backend/index.js';
-const storage = new AsyncLocalStorage();
-/**
- * Env-var names used to propagate the ephemeral token to **subprocesses**
- * (e.g. the `git` invocation that triggers the `hereya credential-helper`
- * grandchild). Async-local-storage doesn't cross process boundaries, so we
- * also stash the token in the environment for the duration of the scope.
- *
- * These are deliberately named differently from `HEREYA_TOKEN` because the
- * existing `HEREYA_TOKEN` semantics call `loginWithToken()` (exchange +
- * keychain persist), which is exactly what ephemeral mode must NOT do.
- */
-const EPHEMERAL_TOKEN_ENV = 'HEREYA_EPHEMERAL_TOKEN';
-const EPHEMERAL_CLOUD_URL_ENV = 'HEREYA_EPHEMERAL_CLOUD_URL';
-/**
- * Returns the active ephemeral token context, or `undefined` if no
- * `withEphemeralToken` scope is currently in flight.
- *
- * Falls back to the `HEREYA_EPHEMERAL_TOKEN` env var when no async-local-
- * storage context is set — that's how subprocesses (the credential helper
- * grandchild, etc.) inherit the ephemeral context across process
- * boundaries. The env var is set automatically by `withEphemeralToken`.
- */
-export function getEphemeralToken() {
-    const fromAsyncStorage = storage.getStore();
-    if (fromAsyncStorage) {
-        return fromAsyncStorage;
-    }
-    const fromEnv = process.env[EPHEMERAL_TOKEN_ENV];
-    if (fromEnv) {
-        return {
-            cloudUrl: process.env[EPHEMERAL_CLOUD_URL_ENV] || undefined,
-            token: fromEnv,
-        };
-    }
-    return undefined;
-}
-/**
- * Run `fn` inside an ephemeral-token scope. While `fn` is executing,
- * `getEphemeralToken()` returns the supplied token (and optional cloudUrl),
- * and `process.env.HEREYA_EPHEMERAL_TOKEN` is set so subprocesses inherit
- * the same ephemeral context.
- *
- * Critical guarantees:
- * - The token is held in-memory only. It is NEVER passed to the secret
- *   manager or written to disk.
- * - After `fn` returns or throws, `getEphemeralToken()` returns `undefined`
- *   again and `HEREYA_EPHEMERAL_TOKEN` is restored to its prior value.
- * - The cached backend in `src/backend/index.ts` is cleared before and after
- *   the scope so that a stale, persisted-credential-backed CloudBackend is
- *   never used while the scope is active, and the scope's in-memory backend
- *   does not leak to subsequent code that expected the user's regular
- *   credentials.
- */
-export async function withEphemeralToken(token, fn, options) {
-    // Drop any cached backend so the next getBackend() call sees the ephemeral context.
-    clearBackend();
-    // Snapshot existing env-var values so we can restore them on exit.
-    const priorTokenEnv = process.env[EPHEMERAL_TOKEN_ENV];
-    const priorCloudUrlEnv = process.env[EPHEMERAL_CLOUD_URL_ENV];
-    process.env[EPHEMERAL_TOKEN_ENV] = token;
-    if (options?.cloudUrl) {
-        process.env[EPHEMERAL_CLOUD_URL_ENV] = options.cloudUrl;
-    }
-    else {
-        delete process.env[EPHEMERAL_CLOUD_URL_ENV];
-    }
-    try {
-        return await storage.run({ cloudUrl: options?.cloudUrl, token }, fn);
-    }
-    finally {
-        // Restore prior env-var state (no leakage between sibling invocations).
-        if (priorTokenEnv === undefined) {
-            delete process.env[EPHEMERAL_TOKEN_ENV];
-        }
-        else {
-            process.env[EPHEMERAL_TOKEN_ENV] = priorTokenEnv;
-        }
-        if (priorCloudUrlEnv === undefined) {
-            delete process.env[EPHEMERAL_CLOUD_URL_ENV];
-        }
-        else {
-            process.env[EPHEMERAL_CLOUD_URL_ENV] = priorCloudUrlEnv;
-        }
-        // Drop the in-memory backend bound to the ephemeral token before yielding control.
-        clearBackend();
-    }
-}