hereya-cli 0.87.0 → 0.88.0

package/dist/backend/index.js

@@ -1,5 +1,4 @@
 import { getAwsConfig } from '../infrastructure/aws-config.js';
-import { getEphemeralToken } from '../lib/ephemeral-token.js';
 import { CloudBackend } from './cloud/cloud-backend.js';
 import { loginWithToken, refreshToken } from './cloud/login.js';
 import { getCloudCredentials, loadBackendConfig, saveCloudCredentials } from './config.js';
@@ -67,29 +66,6 @@ export async function getBackend(typeOrOptions) {
     if (backend) {
         return backend;
     }
-    // Ephemeral, in-memory-only token (typically set via the --token flag or by
-    // an embedding integration). We use the supplied token directly as the
-    // bearer for cloud API calls and explicitly do NOT exchange it via
-    // `loginWithToken` — that would mint a long-lived refresh token and we
-    // want this code path to never persist anything to disk or the keychain.
-    const ephemeral = getEphemeralToken();
-    if (ephemeral) {
-        const url = ephemeral.cloudUrl
-            ?? process.env.HEREYA_CLOUD_URL
-            ?? (await loadBackendConfig()).cloud?.url
-            ?? 'https://cloud.hereya.dev';
-        backend = new CloudBackend({
-            accessToken: ephemeral.token,
-            // We have no client/refresh identity for an ephemeral token. Use empty
-            // strings — the CloudBackend never uses these for the request bearer
-            // (it only uses accessToken), and we never call refreshToken() in this
-            // mode.
-            clientId: '',
-            refreshToken: '',
-            url,
-        });
-        return backend;
-    }
     // Handle token-based auth
     if (typeOrOptions && typeof typeOrOptions === 'object' && typeOrOptions.token) {
         const url = typeOrOptions.url || 'https://cloud.hereya.dev';

package/dist/commands/app/deploy/index.d.ts

@@ -9,12 +9,10 @@ export default class AppDeploy extends Command {
         chdir: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         local: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         parameter: import("@oclif/core/interfaces").OptionFlag<string[], import("@oclif/core/interfaces").CustomOptions>;
-        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         version: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
-    private runInner;
     private runLocal;
     private runRemote;
 }

package/dist/commands/app/deploy/index.js

@@ -8,8 +8,6 @@ import { getBackend } from '../../../backend/index.js';
 import { LocalExecutor } from '../../../executor/local.js';
 import { resolveAndSubstituteAppParams, resolveAppParameters } from '../../../lib/app-parameters.js';
 import { getEnvManager } from '../../../lib/env/index.js';
-import { withEphemeralToken } from '../../../lib/ephemeral-token.js';
-import { getDefaultLogger } from '../../../lib/log.js';
 import { arrayOfStringToObject } from '../../../lib/object-utils.js';
 import { stripOrgPrefix } from '../../../lib/org-utils.js';
 import { getProfileFromWorkspace } from '../../../lib/profile-utils.js';
@@ -90,10 +88,6 @@ export default class AppDeploy extends Command {
             description: 'parameter for the app deployment, in the form of key=value (repeatable)',
             multiple: true,
         }),
-        token: Flags.string({
-            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
-            required: false,
-        }),
         version: Flags.string({
             description: 'specific app version to deploy (defaults to latest)',
         }),
@@ -104,17 +98,6 @@ export default class AppDeploy extends Command {
         }),
     };
     async run() {
-        const { flags } = await this.parse(AppDeploy);
-        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
-        if (flags.token) {
-            if (process.env.HEREYA_TOKEN) {
-                getDefaultLogger().debug('[app deploy] --token flag overrides HEREYA_TOKEN environment variable.');
-            }
-            return withEphemeralToken(flags.token, () => this.runInner());
-        }
-        return this.runInner();
-    }
-    async runInner() {
         const { args, flags } = await this.parse(AppDeploy);
         const forceLocal = flags.local || process.env.HEREYA_LOCAL_EXECUTION === 'true';
         if (forceLocal) {

package/dist/commands/app/deployments/index.d.ts

@@ -5,9 +5,5 @@ export default class AppDeployments extends Command {
     };
     static description: string;
     static examples: string[];
-    static flags: {
-        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-    };
     run(): Promise<void>;
-    private runInner;
 }

package/dist/commands/app/deployments/index.js

@@ -1,32 +1,13 @@
-import { Args, Command, Flags } from '@oclif/core';
+import { Args, Command } from '@oclif/core';
 import { CloudBackend } from '../../../backend/cloud/cloud-backend.js';
 import { getBackend } from '../../../backend/index.js';
-import { withEphemeralToken } from '../../../lib/ephemeral-token.js';
-import { getDefaultLogger } from '../../../lib/log.js';
 export default class AppDeployments extends Command {
     static args = {
         name: Args.string({ description: 'app name in org/name format', required: true }),
     };
     static description = 'List workspaces a hereya-app has been deployed to.';
     static examples = ['<%= config.bin %> <%= command.id %> my-org/my-app'];
-    static flags = {
-        token: Flags.string({
-            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
-            required: false,
-        }),
-    };
     async run() {
-        const { flags } = await this.parse(AppDeployments);
-        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
-        if (flags.token) {
-            if (process.env.HEREYA_TOKEN) {
-                getDefaultLogger().debug('[app deployments] --token flag overrides HEREYA_TOKEN environment variable.');
-            }
-            return withEphemeralToken(flags.token, () => this.runInner());
-        }
-        return this.runInner();
-    }
-    async runInner() {
         const { args } = await this.parse(AppDeployments);
         const backend = await getBackend();
         if (!(backend instanceof CloudBackend)) {

package/dist/commands/app/destroy/index.d.ts

@@ -9,11 +9,9 @@ export default class AppDestroy extends Command {
         chdir: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         local: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         parameter: import("@oclif/core/interfaces").OptionFlag<string[], import("@oclif/core/interfaces").CustomOptions>;
-        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
-    private runInner;
     private runLocal;
     private runRemote;
 }

package/dist/commands/app/destroy/index.js

@@ -8,8 +8,6 @@ import { getBackend } from '../../../backend/index.js';
 import { LocalExecutor } from '../../../executor/local.js';
 import { resolveAndSubstituteAppParams } from '../../../lib/app-parameters.js';
 import { getEnvManager } from '../../../lib/env/index.js';
-import { withEphemeralToken } from '../../../lib/ephemeral-token.js';
-import { getDefaultLogger } from '../../../lib/log.js';
 import { arrayOfStringToObject } from '../../../lib/object-utils.js';
 import { stripOrgPrefix } from '../../../lib/org-utils.js';
 import { getProfileFromWorkspace } from '../../../lib/profile-utils.js';
@@ -78,10 +76,6 @@ export default class AppDestroy extends Command {
             description: 'parameter for the app deployment, in the form of key=value (repeatable)',
             multiple: true,
         }),
-        token: Flags.string({
-            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
-            required: false,
-        }),
         workspace: Flags.string({
             char: 'w',
             description: 'workspace where the app is currently deployed',
@@ -89,17 +83,6 @@ export default class AppDestroy extends Command {
         }),
     };
     async run() {
-        const { flags } = await this.parse(AppDestroy);
-        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
-        if (flags.token) {
-            if (process.env.HEREYA_TOKEN) {
-                getDefaultLogger().debug('[app destroy] --token flag overrides HEREYA_TOKEN environment variable.');
-            }
-            return withEphemeralToken(flags.token, () => this.runInner());
-        }
-        return this.runInner();
-    }
-    async runInner() {
         const { args, flags } = await this.parse(AppDestroy);
         const forceLocal = flags.local || process.env.HEREYA_LOCAL_EXECUTION === 'true';
         if (forceLocal) {

package/dist/commands/app/env/index.d.ts

@@ -7,9 +7,7 @@ export default class AppEnv extends Command {
     static description: string;
     static examples: string[];
     static flags: {
-        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
-    private runInner;
 }

package/dist/commands/app/env/index.js

@@ -1,8 +1,6 @@
 import { Args, Command, Flags } from '@oclif/core';
 import { CloudBackend } from '../../../backend/cloud/cloud-backend.js';
 import { getBackend } from '../../../backend/index.js';
-import { withEphemeralToken } from '../../../lib/ephemeral-token.js';
-import { getDefaultLogger } from '../../../lib/log.js';
 export default class AppEnv extends Command {
     static args = {
         name: Args.string({ description: 'app name in org/name format', required: true }),
@@ -15,10 +13,6 @@ export default class AppEnv extends Command {
         '<%= config.bin %> <%= command.id %> my-org/my-app -w my-workspace DATABASE_URL',
     ];
     static flags = {
-        token: Flags.string({
-            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
-            required: false,
-        }),
         workspace: Flags.string({
             char: 'w',
             description: 'workspace to read env outputs from',
@@ -26,17 +20,6 @@ export default class AppEnv extends Command {
         }),
     };
     async run() {
-        const { flags } = await this.parse(AppEnv);
-        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
-        if (flags.token) {
-            if (process.env.HEREYA_TOKEN) {
-                getDefaultLogger().debug('[app env] --token flag overrides HEREYA_TOKEN environment variable.');
-            }
-            return withEphemeralToken(flags.token, () => this.runInner());
-        }
-        return this.runInner();
-    }
-    async runInner() {
         const { args, flags } = await this.parse(AppEnv);
         const backend = await getBackend();
         if (!(backend instanceof CloudBackend)) {

package/dist/commands/app/list/index.d.ts

@@ -2,9 +2,5 @@ import { Command } from '@oclif/core';
 export default class AppList extends Command {
     static description: string;
     static examples: string[];
-    static flags: {
-        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-    };
     run(): Promise<void>;
-    private runInner;
 }

package/dist/commands/app/list/index.js

@@ -1,29 +1,10 @@
-import { Command, Flags } from '@oclif/core';
+import { Command } from '@oclif/core';
 import { CloudBackend } from '../../../backend/cloud/cloud-backend.js';
 import { getBackend } from '../../../backend/index.js';
-import { withEphemeralToken } from '../../../lib/ephemeral-token.js';
-import { getDefaultLogger } from '../../../lib/log.js';
 export default class AppList extends Command {
     static description = 'List hereya-apps available to your account.';
     static examples = ['<%= config.bin %> <%= command.id %>'];
-    static flags = {
-        token: Flags.string({
-            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
-            required: false,
-        }),
-    };
     async run() {
-        const { flags } = await this.parse(AppList);
-        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
-        if (flags.token) {
-            if (process.env.HEREYA_TOKEN) {
-                getDefaultLogger().debug('[app list] --token flag overrides HEREYA_TOKEN environment variable.');
-            }
-            return withEphemeralToken(flags.token, () => this.runInner());
-        }
-        return this.runInner();
-    }
-    async runInner() {
         const backend = await getBackend();
         if (!(backend instanceof CloudBackend)) {
             this.error('Listing apps requires the cloud backend. Run `hereya login` first.');

package/dist/commands/app/status/index.d.ts

@@ -6,9 +6,7 @@ export default class AppStatus extends Command {
     static description: string;
     static examples: string[];
     static flags: {
-        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
-    private runInner;
 }

package/dist/commands/app/status/index.js

@@ -1,8 +1,6 @@
 import { Args, Command, Flags } from '@oclif/core';
 import { CloudBackend } from '../../../backend/cloud/cloud-backend.js';
 import { getBackend } from '../../../backend/index.js';
-import { withEphemeralToken } from '../../../lib/ephemeral-token.js';
-import { getDefaultLogger } from '../../../lib/log.js';
 export default class AppStatus extends Command {
     static args = {
         name: Args.string({ description: 'app name in org/name format', required: true }),
@@ -10,10 +8,6 @@ export default class AppStatus extends Command {
     static description = 'Show the deployment status of a hereya-app on a workspace.';
     static examples = ['<%= config.bin %> <%= command.id %> my-org/my-app -w my-workspace'];
     static flags = {
-        token: Flags.string({
-            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
-            required: false,
-        }),
         workspace: Flags.string({
             char: 'w',
             description: 'workspace to read deployment status from',
@@ -21,17 +15,6 @@ export default class AppStatus extends Command {
         }),
     };
     async run() {
-        const { flags } = await this.parse(AppStatus);
-        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
-        if (flags.token) {
-            if (process.env.HEREYA_TOKEN) {
-                getDefaultLogger().debug('[app status] --token flag overrides HEREYA_TOKEN environment variable.');
-            }
-            return withEphemeralToken(flags.token, () => this.runInner());
-        }
-        return this.runInner();
-    }
-    async runInner() {
         const { args, flags } = await this.parse(AppStatus);
         const backend = await getBackend();
         if (!(backend instanceof CloudBackend)) {

package/dist/commands/deploy/index.d.ts

@@ -6,10 +6,8 @@ export default class Deploy extends Command {
         chdir: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         debug: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         local: import("@oclif/core/interfaces").BooleanFlag<boolean>;
-        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
     private deployRemotely;
-    private runInner;
 }

package/dist/commands/deploy/index.js

@@ -2,14 +2,13 @@ import { Command, Flags } from '@oclif/core';
 import { getRendererClass, Listr, ListrLogger, ListrLogLevels } from 'listr2';
 import path from 'node:path';
 import { CloudBackend } from '../../backend/cloud/cloud-backend.js';
+import { getCloudCredentials, loadBackendConfig } from '../../backend/config.js';
 import { getBackend } from '../../backend/index.js';
 import { getExecutor } from '../../executor/index.js';
-import { getActiveCloudAuth } from '../../lib/active-cloud.js';
 import { getConfigManager } from '../../lib/config/index.js';
 import { getEnvManager } from '../../lib/env/index.js';
-import { withEphemeralToken } from '../../lib/ephemeral-token.js';
 import { gitUtils } from '../../lib/git-utils.js';
-import { getDefaultLogger, getLogger, getLogPath, isDebug, setDebug } from '../../lib/log.js';
+import { getLogger, getLogPath, isDebug, setDebug } from '../../lib/log.js';
 import { getParameterManager } from '../../lib/parameter/index.js';
 import { getProfileFromWorkspace } from '../../lib/profile-utils.js';
 import { pollExecutorJob } from '../../lib/remote-job-utils.js';
@@ -36,10 +35,6 @@ export default class Deploy extends Command {
             default: false,
             description: 'force local execution (skip remote executor)',
         }),
-        token: Flags.string({
-            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
-            required: false,
-        }),
         workspace: Flags.string({
             char: 'w',
             description: 'name of the workspace to deploy the packages for',
@@ -47,68 +42,6 @@ export default class Deploy extends Command {
         }),
     };
     async run() {
-        const { flags } = await this.parse(Deploy);
-        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
-        if (flags.token) {
-            if (process.env.HEREYA_TOKEN) {
-                getDefaultLogger().debug('[deploy] --token flag overrides HEREYA_TOKEN environment variable.');
-            }
-            return withEphemeralToken(flags.token, () => this.runInner());
-        }
-        return this.runInner();
-    }
-    async deployRemotely(input) {
-        const myLogger = new ListrLogger({ useIcons: false });
-        // 1. Ensure clean working tree
-        const cleanCheck = await gitUtils.ensureCleanAndPushed({ cwd: input.projectRootDir });
-        if (!cleanCheck.clean) {
-            this.error(cleanCheck.reason);
-        }
-        myLogger.log(ListrLogLevels.STARTED, `Deploying to ${input.workspace} via remote executor (branch: ${input.gitBranch})`);
-        // 2. Resolve cloud auth (ephemeral --token first, then persisted creds)
-        // and build a CloudBackend for job submission + polling.
-        const auth = await getActiveCloudAuth();
-        if (!auth) {
-            this.error('Remote deployment requires cloud backend. Run `hereya login` or pass `--token <token>`.');
-        }
-        const resolvedWorkspaceName = resolveWorkspaceName(input.workspace, input.project);
-        const cloudBackend = new CloudBackend({
-            accessToken: auth.accessToken,
-            clientId: auth.clientId ?? '',
-            refreshToken: auth.refreshToken ?? '',
-            url: auth.cloudUrl,
-        });
-        // 3. Submit deploy job
-        const submitResult = await cloudBackend.submitExecutorJob({
-            payload: {
-                gitBranch: input.gitBranch,
-                project: input.project,
-                workspace: input.workspace,
-            },
-            type: 'deploy',
-            workspace: resolvedWorkspaceName,
-        });
-        if (!submitResult.success) {
-            this.error(`Failed to submit remote deploy job: ${submitResult.reason}`);
-        }
-        // 4. Poll for results
-        const logger = {
-            debug: (msg) => myLogger.log(ListrLogLevels.OUTPUT, msg),
-            error: (msg) => myLogger.log(ListrLogLevels.OUTPUT, msg),
-            info: (msg) => myLogger.log(ListrLogLevels.OUTPUT, msg),
-        };
-        const pollResult = await pollExecutorJob({
-            cloudBackend,
-            jobId: submitResult.jobId,
-            logger,
-            workspace: resolvedWorkspaceName,
-        });
-        if (!pollResult.success) {
-            this.error(pollResult.reason);
-        }
-        myLogger.log(ListrLogLevels.COMPLETED, 'Remote deployment completed successfully');
-    }
-    async runInner() {
         const { flags } = await this.parse(Deploy);
         setDebug(flags.debug);
         const projectRootDir = path.resolve(flags.chdir || process.env.HEREYA_PROJECT_ROOT_DIR || process.cwd());
@@ -521,4 +454,58 @@ export default class Deploy extends Command {
 See ${getLogPath()} for more details`);
         }
     }
+    async deployRemotely(input) {
+        const myLogger = new ListrLogger({ useIcons: false });
+        // 1. Ensure clean working tree
+        const cleanCheck = await gitUtils.ensureCleanAndPushed({ cwd: input.projectRootDir });
+        if (!cleanCheck.clean) {
+            this.error(cleanCheck.reason);
+        }
+        myLogger.log(ListrLogLevels.STARTED, `Deploying to ${input.workspace} via remote executor (branch: ${input.gitBranch})`);
+        // 2. Build CloudBackend for job submission + polling
+        const backendConfig = await loadBackendConfig();
+        if (!backendConfig.cloud) {
+            this.error('Remote deployment requires cloud backend. Run `hereya login` first.');
+        }
+        const credentials = await getCloudCredentials(backendConfig.cloud.clientId);
+        if (!credentials) {
+            this.error('Cloud credentials not found. Run `hereya login` first.');
+        }
+        const resolvedWorkspaceName = resolveWorkspaceName(input.workspace, input.project);
+        const cloudBackend = new CloudBackend({
+            accessToken: credentials.accessToken,
+            clientId: backendConfig.cloud.clientId,
+            refreshToken: credentials.refreshToken,
+            url: backendConfig.cloud.url,
+        });
+        // 3. Submit deploy job
+        const submitResult = await cloudBackend.submitExecutorJob({
+            payload: {
+                gitBranch: input.gitBranch,
+                project: input.project,
+                workspace: input.workspace,
+            },
+            type: 'deploy',
+            workspace: resolvedWorkspaceName,
+        });
+        if (!submitResult.success) {
+            this.error(`Failed to submit remote deploy job: ${submitResult.reason}`);
+        }
+        // 4. Poll for results
+        const logger = {
+            debug: (msg) => myLogger.log(ListrLogLevels.OUTPUT, msg),
+            error: (msg) => myLogger.log(ListrLogLevels.OUTPUT, msg),
+            info: (msg) => myLogger.log(ListrLogLevels.OUTPUT, msg),
+        };
+        const pollResult = await pollExecutorJob({
+            cloudBackend,
+            jobId: submitResult.jobId,
+            logger,
+            workspace: resolvedWorkspaceName,
+        });
+        if (!pollResult.success) {
+            this.error(pollResult.reason);
+        }
+        myLogger.log(ListrLogLevels.COMPLETED, 'Remote deployment completed successfully');
+    }
 }

package/dist/commands/init/index.d.ts

@@ -10,9 +10,7 @@ export default class Init extends Command {
         'deploy-workspace': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         parameter: import("@oclif/core/interfaces").OptionFlag<string[], import("@oclif/core/interfaces").CustomOptions>;
         template: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
-    private runInner;
 }

package/dist/commands/init/index.js

@@ -5,10 +5,9 @@ import path from 'node:path';
 import { getBackend } from '../../backend/index.js';
 import { getExecutorForWorkspace } from '../../executor/context.js';
 import { getConfigManager } from '../../lib/config/index.js';
-import { withEphemeralToken } from '../../lib/ephemeral-token.js';
 import { gitUtils } from '../../lib/git-utils.js';
 import { hereyaTokenUtils } from '../../lib/hereya-token.js';
-import { getDefaultLogger, getLogger, getLogPath } from '../../lib/log.js';
+import { getLogger, getLogPath } from '../../lib/log.js';
 import { arrayOfStringToObject } from '../../lib/object-utils.js';
 export default class Init extends Command {
     static args = {
@@ -42,10 +41,6 @@ export default class Init extends Command {
             description: 'template package name (e.g. owner/repo)',
             required: false,
         }),
-        token: Flags.string({
-            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
-            required: false,
-        }),
         workspace: Flags.string({
             char: 'w',
             description: 'workspace to set as default',
@@ -53,18 +48,6 @@ export default class Init extends Command {
         }),
     };
     async run() {
-        const { flags } = await this.parse(Init);
-        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
-        // The flag wins; emit a debug log if both are present.
-        if (flags.token) {
-            if (process.env.HEREYA_TOKEN) {
-                getDefaultLogger().debug('[init] --token flag overrides HEREYA_TOKEN environment variable.');
-            }
-            return withEphemeralToken(flags.token, () => this.runInner());
-        }
-        return this.runInner();
-    }
-    async runInner() {
         const { args, flags } = await this.parse(Init);
         const projectRootDir = flags.chdir || process.env.HEREYA_PROJECT_ROOT_DIR;
         // Template flow

package/dist/commands/login/index.js

@@ -17,11 +17,6 @@ export default class Login extends Command {
         '$ hereya login --token=your-token https://cloud.hereya.dev',
     ];
     static flags = {
-        // NOTE: `login --token` intentionally exchanges the supplied token for a
-        // long-lived refresh token via `loginWithToken` and PERSISTS the result
-        // to the keychain / `~/.hereya/secrets/`. This is the right behavior for
-        // an explicit `login` step. Other commands accept a `--token` flag with
-        // ephemeral, in-memory-only semantics (see `withEphemeralToken`).
         token: Flags.string({
             char: 't',
             description: 'Token to use for login',

package/dist/commands/publish/index.d.ts

@@ -19,7 +19,6 @@ export default class Publish extends Command {
     static examples: string[];
     static flags: {
         chdir: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     calculateGitArchiveSha256(packageDir: string): Promise<string>;
     displayPublishError(reason: string, config: HereyarcConfig): void;
@@ -31,7 +30,6 @@ export default class Publish extends Command {
     loadConfig(packageDir: string): Promise<HereyarcConfig>;
     loadReadme(packageDir: string): string | undefined;
     run(): Promise<void>;
-    runInner(): Promise<void>;
     validateAppParameters(rawParameters: unknown): Record<string, IParameterSpec>;
     validateConfig(config: HereyarcConfig): void;
     private publishApp;

package/dist/commands/publish/index.js

@@ -5,8 +5,6 @@ import { simpleGit } from 'simple-git';
 import * as yaml from 'yaml';
 import { CloudBackend } from '../../backend/cloud/cloud-backend.js';
 import { getBackend } from '../../backend/index.js';
-import { withEphemeralToken } from '../../lib/ephemeral-token.js';
-import { getDefaultLogger } from '../../lib/log.js';
 import { PARAMETER_NAME_PATTERN, ParameterSpec } from '../../lib/package/index.js';
 export default class Publish extends Command {
     static description = 'Publish a package to the Hereya registry';
@@ -22,10 +20,6 @@ export default class Publish extends Command {
       `,
             required: false,
         }),
-        token: Flags.string({
-            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
-            required: false,
-        }),
     };
     async calculateGitArchiveSha256(packageDir) {
         const { exec } = await import('node:child_process');
@@ -168,17 +162,6 @@ export default class Publish extends Command {
         return undefined;
     }
     async run() {
-        const { flags } = await this.parse(Publish);
-        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
-        if (flags.token) {
-            if (process.env.HEREYA_TOKEN) {
-                getDefaultLogger().debug('[publish] --token flag overrides HEREYA_TOKEN environment variable.');
-            }
-            return withEphemeralToken(flags.token, () => this.runInner());
-        }
-        return this.runInner();
-    }
-    async runInner() {
         const { flags } = await this.parse(Publish);
         const packageDir = flags.chdir || process.cwd();
         try {

package/dist/commands/run/index.d.ts

@@ -7,10 +7,8 @@ export default class Run extends Command {
     static examples: string[];
     static flags: {
         chdir: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     static strict: boolean;
     run(): Promise<void>;
-    private runInner;
 }