hereya-cli 0.87.0 → 0.89.0

package/dist/commands/import-repo/index.js

@@ -0,0 +1,111 @@
+import { Args, Command, Flags } from '@oclif/core';
+import { Listr, ListrLogger, ListrLogLevels } from 'listr2';
+import fs from 'node:fs';
+import path from 'node:path';
+import { getBackend } from '../../backend/index.js';
+import { cloneAndConfigureProjectTasks } from '../../lib/clone-and-configure.js';
+import { getLogPath } from '../../lib/log.js';
+export default class ImportRepo extends Command {
+    static args = {
+        project: Args.string({ description: 'project name', required: true }),
+    };
+    static description = 'Register an existing GitHub repository as a hereya project so it can be deployed via the remote executor.';
+    static examples = [
+        '<%= config.bin %> <%= command.id %> myProject -w=dev -r=https://github.com/acme/api.git',
+        '<%= config.bin %> <%= command.id %> myProject -w=dev -r=https://github.com/acme/api --clone',
+        '<%= config.bin %> <%= command.id %> myProject -w=dev -r=https://github.com/acme/api --clone --chdir=./api',
+    ];
+    static flags = {
+        chdir: Flags.string({
+            description: 'directory to clone into (only meaningful with --clone)',
+            required: false,
+        }),
+        clone: Flags.boolean({
+            default: false,
+            description: 'also clone the repository locally and write hereya.yaml after the import',
+        }),
+        'repo-url': Flags.string({
+            char: 'r',
+            description: 'GitHub HTTPS clone URL (e.g. https://github.com/owner/repo.git)',
+            required: true,
+        }),
+        workspace: Flags.string({
+            char: 'w',
+            description: 'workspace to set as default',
+            required: true,
+        }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(ImportRepo);
+        const targetDir = flags.chdir
+            || path.join(process.cwd(), args.project.replaceAll('/', '-'));
+        if (flags.clone && fs.existsSync(targetDir)) {
+            this.error(`Directory ${targetDir} already exists.`);
+        }
+        const backend = await getBackend();
+        if (!backend.importProject) {
+            this.error('hereya import-repo requires the cloud backend. Run `hereya login` first.');
+        }
+        if (!flags.clone) {
+            const importOutput = await backend.importProject({
+                project: args.project,
+                repoUrl: flags['repo-url'],
+                workspace: flags.workspace,
+            });
+            if (!importOutput.success) {
+                const codeSuffix = importOutput.code ? ` [${importOutput.code}]` : '';
+                this.error(`${importOutput.reason}${codeSuffix}`);
+            }
+            this.log(`Project ${args.project} imported.`);
+            this.log(`Run 'hereya clone ${args.project}' to fetch the source locally, then 'hereya deploy -w <deploy-workspace>' to deploy.`);
+            return;
+        }
+        const task = new Listr([
+            {
+                async task(ctx) {
+                    const importResult = await backend.importProject({
+                        project: args.project,
+                        repoUrl: flags['repo-url'],
+                        workspace: flags.workspace,
+                    });
+                    if (!importResult.success) {
+                        const codeSuffix = importResult.code ? ` [${importResult.code}]` : '';
+                        throw new Error(`${importResult.reason}${codeSuffix}`);
+                    }
+                    ctx.importOutput = importResult;
+                },
+                title: 'Importing project',
+            },
+            {
+                async task(ctx) {
+                    if (!backend.getProjectMetadata) {
+                        throw new Error('hereya import-repo --clone requires the cloud backend. Run `hereya login` first.');
+                    }
+                    const metadata$ = await backend.getProjectMetadata({ project: args.project });
+                    if (!metadata$.found) {
+                        throw new Error(`Project metadata not found for ${args.project} after import.`);
+                    }
+                    ctx.metadata = metadata$.metadata;
+                },
+                title: 'Fetching project metadata',
+            },
+            ...cloneAndConfigureProjectTasks({
+                getEnv: (ctx) => ctx.metadata.env || {},
+                getProject: (ctx) => ctx.importOutput.project.name,
+                getWorkspace: (ctx) => ctx.importOutput.project.defaultWorkspace,
+                hereyaBinPath: process.argv[1],
+                missingRemoteUrlError: `Project metadata does not contain hereyaGitRemoteUrl for ${args.project}. Did the import populate the workspace github-app config?`,
+                targetDir,
+            }),
+        ], { concurrent: false });
+        try {
+            await task.run();
+            const myLogger = new ListrLogger({ useIcons: false });
+            myLogger.log(ListrLogLevels.COMPLETED, `Project ${args.project} imported and cloned successfully`);
+            myLogger.log(ListrLogLevels.COMPLETED, `Project directory: ${targetDir}`);
+        }
+        catch (error) {
+            this.error(`${error.message}\n\nSee ${getLogPath()} for more details`);
+        }
+    }
+}

package/dist/commands/init/index.d.ts

@@ -10,9 +10,7 @@ export default class Init extends Command {
         'deploy-workspace': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         parameter: import("@oclif/core/interfaces").OptionFlag<string[], import("@oclif/core/interfaces").CustomOptions>;
         template: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
-    private runInner;
 }

package/dist/commands/init/index.js

@@ -4,11 +4,10 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { getBackend } from '../../backend/index.js';
 import { getExecutorForWorkspace } from '../../executor/context.js';
+import { cloneAndConfigureProjectTasks } from '../../lib/clone-and-configure.js';
 import { getConfigManager } from '../../lib/config/index.js';
-import { withEphemeralToken } from '../../lib/ephemeral-token.js';
-import { gitUtils } from '../../lib/git-utils.js';
 import { hereyaTokenUtils } from '../../lib/hereya-token.js';
-import { getDefaultLogger, getLogger, getLogPath } from '../../lib/log.js';
+import { getLogger, getLogPath } from '../../lib/log.js';
 import { arrayOfStringToObject } from '../../lib/object-utils.js';
 export default class Init extends Command {
     static args = {
@@ -42,10 +41,6 @@ export default class Init extends Command {
             description: 'template package name (e.g. owner/repo)',
             required: false,
         }),
-        token: Flags.string({
-            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
-            required: false,
-        }),
         workspace: Flags.string({
             char: 'w',
             description: 'workspace to set as default',
@@ -53,18 +48,6 @@ export default class Init extends Command {
         }),
     };
     async run() {
-        const { flags } = await this.parse(Init);
-        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
-        // The flag wins; emit a debug log if both are present.
-        if (flags.token) {
-            if (process.env.HEREYA_TOKEN) {
-                getDefaultLogger().debug('[init] --token flag overrides HEREYA_TOKEN environment variable.');
-            }
-            return withEphemeralToken(flags.token, () => this.runInner());
-        }
-        return this.runInner();
-    }
-    async runInner() {
         const { args, flags } = await this.parse(Init);
         const projectRootDir = flags.chdir || process.env.HEREYA_PROJECT_ROOT_DIR;
         // Template flow
@@ -132,57 +115,14 @@ export default class Init extends Command {
                     },
                     title: 'Saving template metadata',
                 },
-                {
-                    async task(ctx) {
-                        const gitEnvToResolve = {};
-                        for (const [key, value] of Object.entries(ctx.prefixedEnv)) {
-                            if (key.startsWith('hereyaGit'))
-                                gitEnvToResolve[key] = value;
-                        }
-                        const executor$ = await getExecutorForWorkspace(flags.workspace);
-                        if (!executor$.success)
-                            throw new Error(executor$.reason);
-                        ctx.resolvedGitEnv = await executor$.executor.resolveEnvValues({
-                            env: gitEnvToResolve,
-                            project: args.project,
-                            workspace: flags.workspace,
-                        });
-                        if (!ctx.resolvedGitEnv.hereyaGitRemoteUrl) {
-                            throw new Error('Template did not provide hereyaGitRemoteUrl. Templates must export hereyaGitRemoteUrl.');
-                        }
-                    },
-                    title: 'Resolving git credentials',
-                },
-                {
-                    async task(ctx) {
-                        const cloneResult = await gitUtils.cloneWithCredentialHelper({
-                            gitUrl: ctx.resolvedGitEnv.hereyaGitRemoteUrl,
-                            hereyaBinPath: process.argv[1],
-                            password: ctx.resolvedGitEnv.hereyaGitPassword,
-                            targetDir,
-                            username: ctx.resolvedGitEnv.hereyaGitUsername,
-                        });
-                        if (!cloneResult.success)
-                            throw new Error(cloneResult.reason);
-                    },
-                    title: 'Cloning project repository',
-                },
-                {
-                    async task(ctx) {
-                        const configManager = getConfigManager();
-                        const existing = await configManager.loadConfig({ projectRootDir: targetDir });
-                        const config = {
-                            ...(existing.found ? existing.config : {}),
-                            project: ctx.initOutput.project.name,
-                            workspace: ctx.initOutput.workspace.name,
-                        };
-                        await configManager.saveConfig({ config, projectRootDir: targetDir });
-                        await gitUtils.setupCredentialHelper({ hereyaBinPath: process.argv[1], projectDir: targetDir });
-                        const backend = await getBackend();
-                        await backend.saveState(config, flags.workspace);
-                    },
-                    title: 'Setting up project',
-                },
+                ...cloneAndConfigureProjectTasks({
+                    getEnv: (ctx) => ctx.prefixedEnv,
+                    getProject: (ctx) => ctx.initOutput.project.name,
+                    getWorkspace: () => flags.workspace,
+                    hereyaBinPath: process.argv[1],
+                    missingRemoteUrlError: 'Template did not provide hereyaGitRemoteUrl. Templates must export hereyaGitRemoteUrl.',
+                    targetDir,
+                }),
             ], { concurrent: false });
             try {
                 await task.run();

package/dist/commands/login/index.js

@@ -17,11 +17,6 @@ export default class Login extends Command {
         '$ hereya login --token=your-token https://cloud.hereya.dev',
     ];
     static flags = {
-        // NOTE: `login --token` intentionally exchanges the supplied token for a
-        // long-lived refresh token via `loginWithToken` and PERSISTS the result
-        // to the keychain / `~/.hereya/secrets/`. This is the right behavior for
-        // an explicit `login` step. Other commands accept a `--token` flag with
-        // ephemeral, in-memory-only semantics (see `withEphemeralToken`).
         token: Flags.string({
             char: 't',
             description: 'Token to use for login',

package/dist/commands/publish/index.d.ts

@@ -19,7 +19,6 @@ export default class Publish extends Command {
     static examples: string[];
     static flags: {
         chdir: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     calculateGitArchiveSha256(packageDir: string): Promise<string>;
     displayPublishError(reason: string, config: HereyarcConfig): void;
@@ -31,7 +30,6 @@ export default class Publish extends Command {
     loadConfig(packageDir: string): Promise<HereyarcConfig>;
     loadReadme(packageDir: string): string | undefined;
     run(): Promise<void>;
-    runInner(): Promise<void>;
     validateAppParameters(rawParameters: unknown): Record<string, IParameterSpec>;
     validateConfig(config: HereyarcConfig): void;
     private publishApp;

package/dist/commands/publish/index.js

@@ -5,8 +5,6 @@ import { simpleGit } from 'simple-git';
 import * as yaml from 'yaml';
 import { CloudBackend } from '../../backend/cloud/cloud-backend.js';
 import { getBackend } from '../../backend/index.js';
-import { withEphemeralToken } from '../../lib/ephemeral-token.js';
-import { getDefaultLogger } from '../../lib/log.js';
 import { PARAMETER_NAME_PATTERN, ParameterSpec } from '../../lib/package/index.js';
 export default class Publish extends Command {
     static description = 'Publish a package to the Hereya registry';
@@ -22,10 +20,6 @@ export default class Publish extends Command {
       `,
             required: false,
         }),
-        token: Flags.string({
-            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
-            required: false,
-        }),
     };
     async calculateGitArchiveSha256(packageDir) {
         const { exec } = await import('node:child_process');
@@ -168,17 +162,6 @@ export default class Publish extends Command {
         return undefined;
     }
     async run() {
-        const { flags } = await this.parse(Publish);
-        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
-        if (flags.token) {
-            if (process.env.HEREYA_TOKEN) {
-                getDefaultLogger().debug('[publish] --token flag overrides HEREYA_TOKEN environment variable.');
-            }
-            return withEphemeralToken(flags.token, () => this.runInner());
-        }
-        return this.runInner();
-    }
-    async runInner() {
         const { flags } = await this.parse(Publish);
         const packageDir = flags.chdir || process.cwd();
         try {

package/dist/commands/run/index.d.ts

@@ -7,10 +7,8 @@ export default class Run extends Command {
     static examples: string[];
     static flags: {
         chdir: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     static strict: boolean;
     run(): Promise<void>;
-    private runInner;
 }

package/dist/commands/run/index.js

@@ -2,8 +2,6 @@ import { Args, Command, Flags } from '@oclif/core';
 import { getBackend } from '../../backend/index.js';
 import { getConfigManager } from '../../lib/config/index.js';
 import { getEnvManager } from '../../lib/env/index.js';
-import { withEphemeralToken } from '../../lib/ephemeral-token.js';
-import { getDefaultLogger } from '../../lib/log.js';
 import { getProfileFromWorkspace } from '../../lib/profile-utils.js';
 import { runShell } from '../../lib/shell.js';
 import { validateDevelopmentWorkspace } from '../../lib/workspace-validation.js';
@@ -21,10 +19,6 @@ export default class Run extends Command {
             description: 'directory to run command in',
             required: false,
         }),
-        token: Flags.string({
-            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
-            required: false,
-        }),
         workspace: Flags.string({
             char: 'w',
             description: 'name of the workspace to run the command in',
@@ -33,17 +27,6 @@ export default class Run extends Command {
     };
     static strict = false;
     async run() {
-        const { flags } = await this.parse(Run);
-        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
-        if (flags.token) {
-            if (process.env.HEREYA_TOKEN) {
-                getDefaultLogger().debug('[run] --token flag overrides HEREYA_TOKEN environment variable.');
-            }
-            return withEphemeralToken(flags.token, () => this.runInner());
-        }
-        return this.runInner();
-    }
-    async runInner() {
         const { args, argv, flags } = await this.parse(Run);
         const projectRootDir = flags.chdir || process.env.HEREYA_PROJECT_ROOT_DIR;
         const configManager = getConfigManager();

package/dist/commands/search/index.d.ts

@@ -9,9 +9,7 @@ export default class Search extends Command {
         chdir: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         limit: import("@oclif/core/interfaces").OptionFlag<number, import("@oclif/core/interfaces").CustomOptions>;
-        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
     private displayResults;
-    private runInner;
 }

package/dist/commands/search/index.js

@@ -1,8 +1,6 @@
 import { Args, Command, Flags } from '@oclif/core';
 import chalk from 'chalk';
 import { getBackend } from '../../backend/index.js';
-import { withEphemeralToken } from '../../lib/ephemeral-token.js';
-import { getDefaultLogger } from '../../lib/log.js';
 export default class Search extends Command {
     static args = {
         query: Args.string({
@@ -32,44 +30,8 @@ export default class Search extends Command {
             default: 20,
             description: 'Maximum number of results to return',
         }),
-        token: Flags.string({
-            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
-            required: false,
-        }),
     };
     async run() {
-        const { flags } = await this.parse(Search);
-        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
-        if (flags.token) {
-            if (process.env.HEREYA_TOKEN) {
-                getDefaultLogger().debug('[search] --token flag overrides HEREYA_TOKEN environment variable.');
-            }
-            return withEphemeralToken(flags.token, () => this.runInner());
-        }
-        return this.runInner();
-    }
-    displayResults(packages, hasMore) {
-        if (packages.length === 0) {
-            this.log(chalk.yellow('No packages found matching your query.'));
-            return;
-        }
-        this.log(`Found ${chalk.bold(packages.length)} package(s):`);
-        this.log();
-        for (const pkg of packages) {
-            const visibilityBadge = pkg.visibility === 'PUBLIC'
-                ? chalk.green('PUBLIC')
-                : chalk.yellow('PRIVATE');
-            this.log(`  ${chalk.cyan.bold(`${pkg.name}@${pkg.version}`)} ${visibilityBadge}`);
-            if (pkg.description) {
-                this.log(`    ${chalk.gray(pkg.description)}`);
-            }
-            this.log();
-        }
-        if (hasMore) {
-            this.log(chalk.dim('More results available. Use --limit to see more.'));
-        }
-    }
-    async runInner() {
         const { args, flags } = await this.parse(Search);
         // Change to specified directory
         if (flags.chdir !== '.') {
@@ -104,4 +66,25 @@ export default class Search extends Command {
             this.error(error instanceof Error ? error.message : 'Failed to search packages');
         }
     }
+    displayResults(packages, hasMore) {
+        if (packages.length === 0) {
+            this.log(chalk.yellow('No packages found matching your query.'));
+            return;
+        }
+        this.log(`Found ${chalk.bold(packages.length)} package(s):`);
+        this.log();
+        for (const pkg of packages) {
+            const visibilityBadge = pkg.visibility === 'PUBLIC'
+                ? chalk.green('PUBLIC')
+                : chalk.yellow('PRIVATE');
+            this.log(`  ${chalk.cyan.bold(`${pkg.name}@${pkg.version}`)} ${visibilityBadge}`);
+            if (pkg.description) {
+                this.log(`    ${chalk.gray(pkg.description)}`);
+            }
+            this.log();
+        }
+        if (hasMore) {
+            this.log(chalk.dim('More results available. Use --limit to see more.'));
+        }
+    }
 }

package/dist/commands/undeploy/index.d.ts

@@ -6,10 +6,8 @@ export default class Undeploy extends Command {
         chdir: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         debug: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         local: import("@oclif/core/interfaces").BooleanFlag<boolean>;
-        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
-    private runInner;
     private undeployRemotely;
 }

package/dist/commands/undeploy/index.js

@@ -2,14 +2,13 @@ import { Command, Flags } from '@oclif/core';
 import { getRendererClass, Listr, ListrLogger, ListrLogLevels } from 'listr2';
 import path from 'node:path';
 import { CloudBackend } from '../../backend/cloud/cloud-backend.js';
+import { getCloudCredentials, loadBackendConfig } from '../../backend/config.js';
 import { getBackend } from '../../backend/index.js';
 import { getExecutor } from '../../executor/index.js';
-import { getActiveCloudAuth } from '../../lib/active-cloud.js';
 import { getConfigManager } from '../../lib/config/index.js';
 import { getEnvManager } from '../../lib/env/index.js';
-import { withEphemeralToken } from '../../lib/ephemeral-token.js';
 import { gitUtils } from '../../lib/git-utils.js';
-import { getDefaultLogger, getLogger, getLogPath, isDebug, setDebug } from '../../lib/log.js';
+import { getLogger, getLogPath, isDebug, setDebug } from '../../lib/log.js';
 import { getParameterManager } from '../../lib/parameter/index.js';
 import { getProfileFromWorkspace } from '../../lib/profile-utils.js';
 import { pollExecutorJob } from '../../lib/remote-job-utils.js';
@@ -36,10 +35,6 @@ export default class Undeploy extends Command {
             default: false,
             description: 'force local execution (skip remote executor)',
         }),
-        token: Flags.string({
-            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
-            required: false,
-        }),
         workspace: Flags.string({
             char: 'w',
             description: 'name of the workspace to undeploy the packages for',
@@ -47,17 +42,6 @@ export default class Undeploy extends Command {
         }),
     };
     async run() {
-        const { flags } = await this.parse(Undeploy);
-        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
-        if (flags.token) {
-            if (process.env.HEREYA_TOKEN) {
-                getDefaultLogger().debug('[undeploy] --token flag overrides HEREYA_TOKEN environment variable.');
-            }
-            return withEphemeralToken(flags.token, () => this.runInner());
-        }
-        return this.runInner();
-    }
-    async runInner() {
         const { flags } = await this.parse(Undeploy);
         setDebug(flags.debug);
         const projectRootDir = path.resolve(flags.chdir || process.env.HEREYA_PROJECT_ROOT_DIR || process.cwd());
@@ -338,18 +322,21 @@ See ${getLogPath()} for more details`);
             this.error(cleanCheck.reason);
         }
         myLogger.log(ListrLogLevels.STARTED, `Undeploying ${input.workspace} via remote executor (branch: ${input.gitBranch})`);
-        // 2. Resolve cloud auth (ephemeral --token first, then persisted creds)
-        // and build a CloudBackend for job submission + polling.
-        const auth = await getActiveCloudAuth();
-        if (!auth) {
-            this.error('Remote undeployment requires cloud backend. Run `hereya login` or pass `--token <token>`.');
+        // 2. Build CloudBackend for job submission + polling
+        const backendConfig = await loadBackendConfig();
+        if (!backendConfig.cloud) {
+            this.error('Remote undeployment requires cloud backend. Run `hereya login` first.');
+        }
+        const credentials = await getCloudCredentials(backendConfig.cloud.clientId);
+        if (!credentials) {
+            this.error('Cloud credentials not found. Run `hereya login` first.');
         }
         const resolvedWorkspaceName = resolveWorkspaceName(input.workspace, input.project);
         const cloudBackend = new CloudBackend({
-            accessToken: auth.accessToken,
-            clientId: auth.clientId ?? '',
-            refreshToken: auth.refreshToken ?? '',
-            url: auth.cloudUrl,
+            accessToken: credentials.accessToken,
+            clientId: backendConfig.cloud.clientId,
+            refreshToken: credentials.refreshToken,
+            url: backendConfig.cloud.url,
         });
         // 3. Submit undeploy job
         const submitResult = await cloudBackend.submitExecutorJob({

package/dist/commands/up/index.d.ts

@@ -7,9 +7,7 @@ export default class Up extends Command {
         debug: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         deploy: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         select: import("@oclif/core/interfaces").OptionFlag<string[], import("@oclif/core/interfaces").CustomOptions>;
-        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
-    private runInner;
 }

package/dist/commands/up/index.js

@@ -4,8 +4,7 @@ import { getBackend } from '../../backend/index.js';
 import { getExecutorForWorkspace } from '../../executor/context.js';
 import { getConfigManager } from '../../lib/config/index.js';
 import { getEnvManager } from '../../lib/env/index.js';
-import { withEphemeralToken } from '../../lib/ephemeral-token.js';
-import { getDefaultLogger, getLogger, getLogPath, isDebug, setDebug } from '../../lib/log.js';
+import { getLogger, getLogPath, isDebug, setDebug } from '../../lib/log.js';
 import { getParameterManager } from '../../lib/parameter/index.js';
 import { getProfileFromWorkspace } from '../../lib/profile-utils.js';
 import { delay } from '../../lib/shell.js';
@@ -36,10 +35,6 @@ export default class Up extends Command {
             description: 'select the packages to provision',
             multiple: true,
         }),
-        token: Flags.string({
-            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
-            required: false,
-        }),
         workspace: Flags.string({
             char: 'w',
             description: 'name of the workspace to install the packages for',
@@ -47,17 +42,6 @@ export default class Up extends Command {
         }),
     };
     async run() {
-        const { flags } = await this.parse(Up);
-        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
-        if (flags.token) {
-            if (process.env.HEREYA_TOKEN) {
-                getDefaultLogger().debug('[up] --token flag overrides HEREYA_TOKEN environment variable.');
-            }
-            return withEphemeralToken(flags.token, () => this.runInner());
-        }
-        return this.runInner();
-    }
-    async runInner() {
         const { flags } = await this.parse(Up);
         setDebug(flags.debug);
         const projectRootDir = flags.chdir || process.env.HEREYA_PROJECT_ROOT_DIR;

package/dist/commands/workspace/executor/install/index.d.ts

@@ -4,9 +4,7 @@ export default class WorkspaceExecutorInstall extends Command {
     static flags: {
         debug: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         force: import("@oclif/core/interfaces").BooleanFlag<boolean>;
-        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
-    private runInner;
 }

package/dist/commands/workspace/executor/install/index.js

@@ -3,8 +3,7 @@ import { Listr, ListrLogger, ListrLogLevels } from 'listr2';
 import { CloudBackend } from '../../../../backend/cloud/cloud-backend.js';
 import { getBackend } from '../../../../backend/index.js';
 import { getExecutor } from '../../../../executor/index.js';
-import { withEphemeralToken } from '../../../../lib/ephemeral-token.js';
-import { getDefaultLogger, getLogger, getLogPath, isDebug, setDebug } from '../../../../lib/log.js';
+import { getLogger, getLogPath, isDebug, setDebug } from '../../../../lib/log.js';
 import { delay } from '../../../../lib/shell.js';
 const DEFAULT_EXECUTOR_PACKAGE = 'hereya/remote-executor-aws';
 export default class WorkspaceExecutorInstall extends Command {
@@ -12,10 +11,6 @@ export default class WorkspaceExecutorInstall extends Command {
     static flags = {
         debug: Flags.boolean({ default: false, description: 'enable debug mode' }),
         force: Flags.boolean({ char: 'f', default: false, description: 'force reinstall even if executor is already installed' }),
-        token: Flags.string({
-            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
-            required: false,
-        }),
         workspace: Flags.string({
             char: 'w',
             description: 'name of the workspace',
@@ -23,17 +18,6 @@ export default class WorkspaceExecutorInstall extends Command {
         }),
     };
     async run() {
-        const { flags } = await this.parse(WorkspaceExecutorInstall);
-        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
-        if (flags.token) {
-            if (process.env.HEREYA_TOKEN) {
-                getDefaultLogger().debug('[workspace executor install] --token flag overrides HEREYA_TOKEN environment variable.');
-            }
-            return withEphemeralToken(flags.token, () => this.runInner());
-        }
-        return this.runInner();
-    }
-    async runInner() {
         const { flags } = await this.parse(WorkspaceExecutorInstall);
         setDebug(flags.debug);
         const myLogger = new ListrLogger({ useIcons: false });

package/dist/commands/workspace/executor/token/index.d.ts

@@ -2,9 +2,7 @@ import { Command } from '@oclif/core';
 export default class WorkspaceExecutorToken extends Command {
     static description: string;
     static flags: {
-        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
-    private runInner;
 }