hereya-cli 0.87.0 → 0.89.0

package/dist/backend/cloud/cloud-backend.d.ts

@@ -1,6 +1,6 @@
 import { Config } from '../../lib/config/common.js';
 import { IParameterSpec } from '../../lib/package/index.js';
-import { AddPackageToWorkspaceInput, AddPackageToWorkspaceOutput, Backend, CreateWorkspaceInput, CreateWorkspaceOutput, DeleteStateInput, DeleteStateOutput, DeleteWorkspaceInput, DeleteWorkspaceOutput, ExportBackendOutput, GetPackageOutput, GetProjectMetadataInput, GetProjectMetadataOutput, GetProvisioningIdInput, GetProvisioningIdOutput, GetStateInput, GetStateOutput, GetWorkspaceEnvInput, GetWorkspaceEnvOutput, GetWorkspaceOutput, ImportBackendInput, ImportBackendOutput, InitProjectInput, InitProjectOutput, ListPackageVersionsOutput, ListProjectsOutput, ListWorkspacesInput, PublishPackageInput, PublishPackageOutput, RemovePackageFromWorkspaceInput, RemovePackageFromWorkspaceOutput, SaveProjectMetadataInput, SaveProjectMetadataOutput, SearchPackagesInput, SearchPackagesOutput, SetEnvVarInput, SetEnvVarOutput, UnsetEnvVarInput, UnsetEnvVarOutput, UpdateWorkspaceInput, UpdateWorkspaceOutput } from '../common.js';
+import { AddPackageToWorkspaceInput, AddPackageToWorkspaceOutput, Backend, CreateWorkspaceInput, CreateWorkspaceOutput, DeleteStateInput, DeleteStateOutput, DeleteWorkspaceInput, DeleteWorkspaceOutput, ExportBackendOutput, GetPackageOutput, GetProjectMetadataInput, GetProjectMetadataOutput, GetProvisioningIdInput, GetProvisioningIdOutput, GetStateInput, GetStateOutput, GetWorkspaceEnvInput, GetWorkspaceEnvOutput, GetWorkspaceOutput, ImportBackendInput, ImportBackendOutput, ImportProjectInput, ImportProjectOutput, InitProjectInput, InitProjectOutput, ListPackageVersionsOutput, ListProjectsOutput, ListWorkspacesInput, PublishPackageInput, PublishPackageOutput, RemovePackageFromWorkspaceInput, RemovePackageFromWorkspaceOutput, SaveProjectMetadataInput, SaveProjectMetadataOutput, SearchPackagesInput, SearchPackagesOutput, SetEnvVarInput, SetEnvVarOutput, UnsetEnvVarInput, UnsetEnvVarOutput, UpdateWorkspaceInput, UpdateWorkspaceOutput } from '../common.js';
 interface CloudBackendConfig {
     accessToken: string;
     clientId: string;
@@ -158,6 +158,7 @@ export declare class CloudBackend implements Backend {
     getWorkspace(name: string): Promise<GetWorkspaceOutput>;
     getWorkspaceEnv(input: GetWorkspaceEnvInput): Promise<GetWorkspaceEnvOutput>;
     importBackend(input: ImportBackendInput): Promise<ImportBackendOutput>;
+    importProject(input: ImportProjectInput): Promise<ImportProjectOutput>;
     init(input: InitProjectInput): Promise<InitProjectOutput>;
     listAppDeployments(name: string): Promise<{
         deployments: AppDeploymentSummary[];

package/dist/backend/cloud/cloud-backend.js

@@ -488,6 +488,42 @@ export class CloudBackend {
             success: true,
         };
     }
+    async importProject(input) {
+        const response = await fetch(`${this.config.url}/api/projects/${encodeURIComponent(input.project)}/import`, {
+            body: JSON.stringify({ repoUrl: input.repoUrl, workspace: input.workspace }),
+            headers: {
+                'Authorization': `Bearer ${this.config.accessToken}`,
+                'Content-Type': 'application/json',
+            },
+            method: 'POST',
+        });
+        const result = await this.safeResponseJson(response);
+        if (!response.ok) {
+            const reason = typeof result?.error === 'string'
+                ? result.error
+                : (result?.errors && typeof result.errors === 'object'
+                    ? JSON.stringify(result.errors)
+                    : JSON.stringify(result));
+            return {
+                ...(typeof result?.code === 'string' ? { code: result.code } : {}),
+                reason,
+                success: false,
+            };
+        }
+        if (!result?.success || !result?.project) {
+            return {
+                reason: typeof result?.error === 'string' ? result.error : 'Unexpected response from server',
+                success: false,
+            };
+        }
+        return {
+            project: {
+                defaultWorkspace: result.project.defaultWorkspace,
+                name: result.project.name,
+            },
+            success: true,
+        };
+    }
     async init(input) {
         const formData = new FormData();
         formData.append('name', input.project);

package/dist/backend/common.d.ts

@@ -15,6 +15,7 @@ export interface Backend {
     getWorkspace(workspace: string): Promise<GetWorkspaceOutput>;
     getWorkspaceEnv(input: GetWorkspaceEnvInput): Promise<GetWorkspaceEnvOutput>;
     importBackend(input: ImportBackendInput): Promise<ImportBackendOutput>;
+    importProject?(input: ImportProjectInput): Promise<ImportProjectOutput>;
     init(options: InitProjectInput): Promise<InitProjectOutput>;
     listPackageVersions?(name: string): Promise<ListPackageVersionsOutput>;
     listProjects?(): Promise<ListProjectsOutput>;
@@ -363,6 +364,22 @@ export type SaveProjectMetadataOutput = {
 } | {
     success: true;
 };
+export interface ImportProjectInput {
+    project: string;
+    repoUrl: string;
+    workspace: string;
+}
+export type ImportProjectOutput = {
+    code?: string;
+    reason: string;
+    success: false;
+} | {
+    project: {
+        defaultWorkspace: string;
+        name: string;
+    };
+    success: true;
+};
 export type ProjectSummary = {
     defaultWorkspace: string;
     name: string;

package/dist/backend/index.js

@@ -1,5 +1,4 @@
 import { getAwsConfig } from '../infrastructure/aws-config.js';
-import { getEphemeralToken } from '../lib/ephemeral-token.js';
 import { CloudBackend } from './cloud/cloud-backend.js';
 import { loginWithToken, refreshToken } from './cloud/login.js';
 import { getCloudCredentials, loadBackendConfig, saveCloudCredentials } from './config.js';
@@ -67,29 +66,6 @@ export async function getBackend(typeOrOptions) {
     if (backend) {
         return backend;
     }
-    // Ephemeral, in-memory-only token (typically set via the --token flag or by
-    // an embedding integration). We use the supplied token directly as the
-    // bearer for cloud API calls and explicitly do NOT exchange it via
-    // `loginWithToken` — that would mint a long-lived refresh token and we
-    // want this code path to never persist anything to disk or the keychain.
-    const ephemeral = getEphemeralToken();
-    if (ephemeral) {
-        const url = ephemeral.cloudUrl
-            ?? process.env.HEREYA_CLOUD_URL
-            ?? (await loadBackendConfig()).cloud?.url
-            ?? 'https://cloud.hereya.dev';
-        backend = new CloudBackend({
-            accessToken: ephemeral.token,
-            // We have no client/refresh identity for an ephemeral token. Use empty
-            // strings — the CloudBackend never uses these for the request bearer
-            // (it only uses accessToken), and we never call refreshToken() in this
-            // mode.
-            clientId: '',
-            refreshToken: '',
-            url,
-        });
-        return backend;
-    }
     // Handle token-based auth
     if (typeOrOptions && typeof typeOrOptions === 'object' && typeOrOptions.token) {
         const url = typeOrOptions.url || 'https://cloud.hereya.dev';

package/dist/commands/app/deploy/index.d.ts

@@ -9,12 +9,10 @@ export default class AppDeploy extends Command {
         chdir: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         local: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         parameter: import("@oclif/core/interfaces").OptionFlag<string[], import("@oclif/core/interfaces").CustomOptions>;
-        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         version: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
-    private runInner;
     private runLocal;
     private runRemote;
 }

package/dist/commands/app/deploy/index.js

@@ -8,8 +8,6 @@ import { getBackend } from '../../../backend/index.js';
 import { LocalExecutor } from '../../../executor/local.js';
 import { resolveAndSubstituteAppParams, resolveAppParameters } from '../../../lib/app-parameters.js';
 import { getEnvManager } from '../../../lib/env/index.js';
-import { withEphemeralToken } from '../../../lib/ephemeral-token.js';
-import { getDefaultLogger } from '../../../lib/log.js';
 import { arrayOfStringToObject } from '../../../lib/object-utils.js';
 import { stripOrgPrefix } from '../../../lib/org-utils.js';
 import { getProfileFromWorkspace } from '../../../lib/profile-utils.js';
@@ -90,10 +88,6 @@ export default class AppDeploy extends Command {
             description: 'parameter for the app deployment, in the form of key=value (repeatable)',
             multiple: true,
         }),
-        token: Flags.string({
-            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
-            required: false,
-        }),
         version: Flags.string({
             description: 'specific app version to deploy (defaults to latest)',
         }),
@@ -104,17 +98,6 @@ export default class AppDeploy extends Command {
         }),
     };
     async run() {
-        const { flags } = await this.parse(AppDeploy);
-        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
-        if (flags.token) {
-            if (process.env.HEREYA_TOKEN) {
-                getDefaultLogger().debug('[app deploy] --token flag overrides HEREYA_TOKEN environment variable.');
-            }
-            return withEphemeralToken(flags.token, () => this.runInner());
-        }
-        return this.runInner();
-    }
-    async runInner() {
         const { args, flags } = await this.parse(AppDeploy);
         const forceLocal = flags.local || process.env.HEREYA_LOCAL_EXECUTION === 'true';
         if (forceLocal) {

package/dist/commands/app/deployments/index.d.ts

@@ -5,9 +5,5 @@ export default class AppDeployments extends Command {
     };
     static description: string;
     static examples: string[];
-    static flags: {
-        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-    };
     run(): Promise<void>;
-    private runInner;
 }

package/dist/commands/app/deployments/index.js

@@ -1,32 +1,13 @@
-import { Args, Command, Flags } from '@oclif/core';
+import { Args, Command } from '@oclif/core';
 import { CloudBackend } from '../../../backend/cloud/cloud-backend.js';
 import { getBackend } from '../../../backend/index.js';
-import { withEphemeralToken } from '../../../lib/ephemeral-token.js';
-import { getDefaultLogger } from '../../../lib/log.js';
 export default class AppDeployments extends Command {
     static args = {
         name: Args.string({ description: 'app name in org/name format', required: true }),
     };
     static description = 'List workspaces a hereya-app has been deployed to.';
     static examples = ['<%= config.bin %> <%= command.id %> my-org/my-app'];
-    static flags = {
-        token: Flags.string({
-            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
-            required: false,
-        }),
-    };
     async run() {
-        const { flags } = await this.parse(AppDeployments);
-        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
-        if (flags.token) {
-            if (process.env.HEREYA_TOKEN) {
-                getDefaultLogger().debug('[app deployments] --token flag overrides HEREYA_TOKEN environment variable.');
-            }
-            return withEphemeralToken(flags.token, () => this.runInner());
-        }
-        return this.runInner();
-    }
-    async runInner() {
         const { args } = await this.parse(AppDeployments);
         const backend = await getBackend();
         if (!(backend instanceof CloudBackend)) {

package/dist/commands/app/destroy/index.d.ts

@@ -9,11 +9,9 @@ export default class AppDestroy extends Command {
         chdir: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         local: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         parameter: import("@oclif/core/interfaces").OptionFlag<string[], import("@oclif/core/interfaces").CustomOptions>;
-        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
-    private runInner;
     private runLocal;
     private runRemote;
 }

package/dist/commands/app/destroy/index.js

@@ -8,8 +8,6 @@ import { getBackend } from '../../../backend/index.js';
 import { LocalExecutor } from '../../../executor/local.js';
 import { resolveAndSubstituteAppParams } from '../../../lib/app-parameters.js';
 import { getEnvManager } from '../../../lib/env/index.js';
-import { withEphemeralToken } from '../../../lib/ephemeral-token.js';
-import { getDefaultLogger } from '../../../lib/log.js';
 import { arrayOfStringToObject } from '../../../lib/object-utils.js';
 import { stripOrgPrefix } from '../../../lib/org-utils.js';
 import { getProfileFromWorkspace } from '../../../lib/profile-utils.js';
@@ -78,10 +76,6 @@ export default class AppDestroy extends Command {
             description: 'parameter for the app deployment, in the form of key=value (repeatable)',
             multiple: true,
         }),
-        token: Flags.string({
-            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
-            required: false,
-        }),
         workspace: Flags.string({
             char: 'w',
             description: 'workspace where the app is currently deployed',
@@ -89,17 +83,6 @@ export default class AppDestroy extends Command {
         }),
     };
     async run() {
-        const { flags } = await this.parse(AppDestroy);
-        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
-        if (flags.token) {
-            if (process.env.HEREYA_TOKEN) {
-                getDefaultLogger().debug('[app destroy] --token flag overrides HEREYA_TOKEN environment variable.');
-            }
-            return withEphemeralToken(flags.token, () => this.runInner());
-        }
-        return this.runInner();
-    }
-    async runInner() {
         const { args, flags } = await this.parse(AppDestroy);
         const forceLocal = flags.local || process.env.HEREYA_LOCAL_EXECUTION === 'true';
         if (forceLocal) {

package/dist/commands/app/env/index.d.ts

@@ -7,9 +7,7 @@ export default class AppEnv extends Command {
     static description: string;
     static examples: string[];
     static flags: {
-        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
-    private runInner;
 }

package/dist/commands/app/env/index.js

@@ -1,8 +1,6 @@
 import { Args, Command, Flags } from '@oclif/core';
 import { CloudBackend } from '../../../backend/cloud/cloud-backend.js';
 import { getBackend } from '../../../backend/index.js';
-import { withEphemeralToken } from '../../../lib/ephemeral-token.js';
-import { getDefaultLogger } from '../../../lib/log.js';
 export default class AppEnv extends Command {
     static args = {
         name: Args.string({ description: 'app name in org/name format', required: true }),
@@ -15,10 +13,6 @@ export default class AppEnv extends Command {
         '<%= config.bin %> <%= command.id %> my-org/my-app -w my-workspace DATABASE_URL',
     ];
     static flags = {
-        token: Flags.string({
-            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
-            required: false,
-        }),
         workspace: Flags.string({
             char: 'w',
             description: 'workspace to read env outputs from',
@@ -26,17 +20,6 @@ export default class AppEnv extends Command {
         }),
     };
     async run() {
-        const { flags } = await this.parse(AppEnv);
-        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
-        if (flags.token) {
-            if (process.env.HEREYA_TOKEN) {
-                getDefaultLogger().debug('[app env] --token flag overrides HEREYA_TOKEN environment variable.');
-            }
-            return withEphemeralToken(flags.token, () => this.runInner());
-        }
-        return this.runInner();
-    }
-    async runInner() {
         const { args, flags } = await this.parse(AppEnv);
         const backend = await getBackend();
         if (!(backend instanceof CloudBackend)) {

package/dist/commands/app/list/index.d.ts

@@ -2,9 +2,5 @@ import { Command } from '@oclif/core';
 export default class AppList extends Command {
     static description: string;
     static examples: string[];
-    static flags: {
-        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-    };
     run(): Promise<void>;
-    private runInner;
 }

package/dist/commands/app/list/index.js

@@ -1,29 +1,10 @@
-import { Command, Flags } from '@oclif/core';
+import { Command } from '@oclif/core';
 import { CloudBackend } from '../../../backend/cloud/cloud-backend.js';
 import { getBackend } from '../../../backend/index.js';
-import { withEphemeralToken } from '../../../lib/ephemeral-token.js';
-import { getDefaultLogger } from '../../../lib/log.js';
 export default class AppList extends Command {
     static description = 'List hereya-apps available to your account.';
     static examples = ['<%= config.bin %> <%= command.id %>'];
-    static flags = {
-        token: Flags.string({
-            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
-            required: false,
-        }),
-    };
     async run() {
-        const { flags } = await this.parse(AppList);
-        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
-        if (flags.token) {
-            if (process.env.HEREYA_TOKEN) {
-                getDefaultLogger().debug('[app list] --token flag overrides HEREYA_TOKEN environment variable.');
-            }
-            return withEphemeralToken(flags.token, () => this.runInner());
-        }
-        return this.runInner();
-    }
-    async runInner() {
         const backend = await getBackend();
         if (!(backend instanceof CloudBackend)) {
             this.error('Listing apps requires the cloud backend. Run `hereya login` first.');

package/dist/commands/app/status/index.d.ts

@@ -6,9 +6,7 @@ export default class AppStatus extends Command {
     static description: string;
     static examples: string[];
     static flags: {
-        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
-    private runInner;
 }

package/dist/commands/app/status/index.js

@@ -1,8 +1,6 @@
 import { Args, Command, Flags } from '@oclif/core';
 import { CloudBackend } from '../../../backend/cloud/cloud-backend.js';
 import { getBackend } from '../../../backend/index.js';
-import { withEphemeralToken } from '../../../lib/ephemeral-token.js';
-import { getDefaultLogger } from '../../../lib/log.js';
 export default class AppStatus extends Command {
     static args = {
         name: Args.string({ description: 'app name in org/name format', required: true }),
@@ -10,10 +8,6 @@ export default class AppStatus extends Command {
     static description = 'Show the deployment status of a hereya-app on a workspace.';
     static examples = ['<%= config.bin %> <%= command.id %> my-org/my-app -w my-workspace'];
     static flags = {
-        token: Flags.string({
-            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
-            required: false,
-        }),
         workspace: Flags.string({
             char: 'w',
             description: 'workspace to read deployment status from',
@@ -21,17 +15,6 @@ export default class AppStatus extends Command {
         }),
     };
     async run() {
-        const { flags } = await this.parse(AppStatus);
-        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
-        if (flags.token) {
-            if (process.env.HEREYA_TOKEN) {
-                getDefaultLogger().debug('[app status] --token flag overrides HEREYA_TOKEN environment variable.');
-            }
-            return withEphemeralToken(flags.token, () => this.runInner());
-        }
-        return this.runInner();
-    }
-    async runInner() {
         const { args, flags } = await this.parse(AppStatus);
         const backend = await getBackend();
         if (!(backend instanceof CloudBackend)) {

package/dist/commands/clone/index.js

@@ -36,7 +36,7 @@ export default class Clone extends Command {
                     }
                     const metadata$ = await backend.getProjectMetadata({ project: args.project });
                     if (!metadata$.found) {
-                        throw new Error(`Project metadata not found for ${args.project}. Was it initialized with a template?`);
+                        throw new Error(`Project metadata not found for ${args.project}. Was it initialized or imported?`);
                     }
                     ctx.metadata = metadata$.metadata;
                     ctx.defaultWorkspace = metadata$.defaultWorkspace;
@@ -59,7 +59,7 @@ export default class Clone extends Command {
                         workspace: ctx.defaultWorkspace,
                     });
                     if (!ctx.resolvedGitEnv.hereyaGitRemoteUrl) {
-                        throw new Error('Project metadata does not contain hereyaGitRemoteUrl. Was it initialized with a template?');
+                        throw new Error(`Project metadata does not contain hereyaGitRemoteUrl for ${args.project}. Was it initialized or imported?`);
                     }
                 },
                 title: 'Resolving git credentials',

package/dist/commands/deploy/index.d.ts

@@ -6,10 +6,8 @@ export default class Deploy extends Command {
         chdir: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         debug: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         local: import("@oclif/core/interfaces").BooleanFlag<boolean>;
-        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
     private deployRemotely;
-    private runInner;
 }

package/dist/commands/deploy/index.js

@@ -2,14 +2,13 @@ import { Command, Flags } from '@oclif/core';
 import { getRendererClass, Listr, ListrLogger, ListrLogLevels } from 'listr2';
 import path from 'node:path';
 import { CloudBackend } from '../../backend/cloud/cloud-backend.js';
+import { getCloudCredentials, loadBackendConfig } from '../../backend/config.js';
 import { getBackend } from '../../backend/index.js';
 import { getExecutor } from '../../executor/index.js';
-import { getActiveCloudAuth } from '../../lib/active-cloud.js';
 import { getConfigManager } from '../../lib/config/index.js';
 import { getEnvManager } from '../../lib/env/index.js';
-import { withEphemeralToken } from '../../lib/ephemeral-token.js';
 import { gitUtils } from '../../lib/git-utils.js';
-import { getDefaultLogger, getLogger, getLogPath, isDebug, setDebug } from '../../lib/log.js';
+import { getLogger, getLogPath, isDebug, setDebug } from '../../lib/log.js';
 import { getParameterManager } from '../../lib/parameter/index.js';
 import { getProfileFromWorkspace } from '../../lib/profile-utils.js';
 import { pollExecutorJob } from '../../lib/remote-job-utils.js';
@@ -36,10 +35,6 @@ export default class Deploy extends Command {
             default: false,
             description: 'force local execution (skip remote executor)',
         }),
-        token: Flags.string({
-            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
-            required: false,
-        }),
         workspace: Flags.string({
             char: 'w',
             description: 'name of the workspace to deploy the packages for',
@@ -47,68 +42,6 @@ export default class Deploy extends Command {
         }),
     };
     async run() {
-        const { flags } = await this.parse(Deploy);
-        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
-        if (flags.token) {
-            if (process.env.HEREYA_TOKEN) {
-                getDefaultLogger().debug('[deploy] --token flag overrides HEREYA_TOKEN environment variable.');
-            }
-            return withEphemeralToken(flags.token, () => this.runInner());
-        }
-        return this.runInner();
-    }
-    async deployRemotely(input) {
-        const myLogger = new ListrLogger({ useIcons: false });
-        // 1. Ensure clean working tree
-        const cleanCheck = await gitUtils.ensureCleanAndPushed({ cwd: input.projectRootDir });
-        if (!cleanCheck.clean) {
-            this.error(cleanCheck.reason);
-        }
-        myLogger.log(ListrLogLevels.STARTED, `Deploying to ${input.workspace} via remote executor (branch: ${input.gitBranch})`);
-        // 2. Resolve cloud auth (ephemeral --token first, then persisted creds)
-        // and build a CloudBackend for job submission + polling.
-        const auth = await getActiveCloudAuth();
-        if (!auth) {
-            this.error('Remote deployment requires cloud backend. Run `hereya login` or pass `--token <token>`.');
-        }
-        const resolvedWorkspaceName = resolveWorkspaceName(input.workspace, input.project);
-        const cloudBackend = new CloudBackend({
-            accessToken: auth.accessToken,
-            clientId: auth.clientId ?? '',
-            refreshToken: auth.refreshToken ?? '',
-            url: auth.cloudUrl,
-        });
-        // 3. Submit deploy job
-        const submitResult = await cloudBackend.submitExecutorJob({
-            payload: {
-                gitBranch: input.gitBranch,
-                project: input.project,
-                workspace: input.workspace,
-            },
-            type: 'deploy',
-            workspace: resolvedWorkspaceName,
-        });
-        if (!submitResult.success) {
-            this.error(`Failed to submit remote deploy job: ${submitResult.reason}`);
-        }
-        // 4. Poll for results
-        const logger = {
-            debug: (msg) => myLogger.log(ListrLogLevels.OUTPUT, msg),
-            error: (msg) => myLogger.log(ListrLogLevels.OUTPUT, msg),
-            info: (msg) => myLogger.log(ListrLogLevels.OUTPUT, msg),
-        };
-        const pollResult = await pollExecutorJob({
-            cloudBackend,
-            jobId: submitResult.jobId,
-            logger,
-            workspace: resolvedWorkspaceName,
-        });
-        if (!pollResult.success) {
-            this.error(pollResult.reason);
-        }
-        myLogger.log(ListrLogLevels.COMPLETED, 'Remote deployment completed successfully');
-    }
-    async runInner() {
         const { flags } = await this.parse(Deploy);
         setDebug(flags.debug);
         const projectRootDir = path.resolve(flags.chdir || process.env.HEREYA_PROJECT_ROOT_DIR || process.cwd());
@@ -521,4 +454,58 @@ export default class Deploy extends Command {
 See ${getLogPath()} for more details`);
         }
     }
+    async deployRemotely(input) {
+        const myLogger = new ListrLogger({ useIcons: false });
+        // 1. Ensure clean working tree
+        const cleanCheck = await gitUtils.ensureCleanAndPushed({ cwd: input.projectRootDir });
+        if (!cleanCheck.clean) {
+            this.error(cleanCheck.reason);
+        }
+        myLogger.log(ListrLogLevels.STARTED, `Deploying to ${input.workspace} via remote executor (branch: ${input.gitBranch})`);
+        // 2. Build CloudBackend for job submission + polling
+        const backendConfig = await loadBackendConfig();
+        if (!backendConfig.cloud) {
+            this.error('Remote deployment requires cloud backend. Run `hereya login` first.');
+        }
+        const credentials = await getCloudCredentials(backendConfig.cloud.clientId);
+        if (!credentials) {
+            this.error('Cloud credentials not found. Run `hereya login` first.');
+        }
+        const resolvedWorkspaceName = resolveWorkspaceName(input.workspace, input.project);
+        const cloudBackend = new CloudBackend({
+            accessToken: credentials.accessToken,
+            clientId: backendConfig.cloud.clientId,
+            refreshToken: credentials.refreshToken,
+            url: backendConfig.cloud.url,
+        });
+        // 3. Submit deploy job
+        const submitResult = await cloudBackend.submitExecutorJob({
+            payload: {
+                gitBranch: input.gitBranch,
+                project: input.project,
+                workspace: input.workspace,
+            },
+            type: 'deploy',
+            workspace: resolvedWorkspaceName,
+        });
+        if (!submitResult.success) {
+            this.error(`Failed to submit remote deploy job: ${submitResult.reason}`);
+        }
+        // 4. Poll for results
+        const logger = {
+            debug: (msg) => myLogger.log(ListrLogLevels.OUTPUT, msg),
+            error: (msg) => myLogger.log(ListrLogLevels.OUTPUT, msg),
+            info: (msg) => myLogger.log(ListrLogLevels.OUTPUT, msg),
+        };
+        const pollResult = await pollExecutorJob({
+            cloudBackend,
+            jobId: submitResult.jobId,
+            logger,
+            workspace: resolvedWorkspaceName,
+        });
+        if (!pollResult.success) {
+            this.error(pollResult.reason);
+        }
+        myLogger.log(ListrLogLevels.COMPLETED, 'Remote deployment completed successfully');
+    }
 }

package/dist/commands/import-repo/index.d.ts

@@ -0,0 +1,15 @@
+import { Command } from '@oclif/core';
+export default class ImportRepo extends Command {
+    static args: {
+        project: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        chdir: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        clone: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        'repo-url': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}