hereya-cli 0.72.1 → 0.73.1

package/dist/backend/common.d.ts

@@ -9,6 +9,7 @@ export interface Backend {
     exportBackend(): Promise<ExportBackendOutput>;
     getPackageByVersion?(name: string, version: string): Promise<GetPackageOutput>;
     getPackageLatest?(name: string): Promise<GetPackageOutput>;
+    getProjectMetadata?(input: GetProjectMetadataInput): Promise<GetProjectMetadataOutput>;
     getProvisioningId(input: GetProvisioningIdInput): Promise<GetProvisioningIdOutput>;
     getState(input: GetStateInput): Promise<GetStateOutput>;
     getWorkspace(workspace: string): Promise<GetWorkspaceOutput>;
@@ -19,6 +20,7 @@ export interface Backend {
     listWorkspaces(input?: ListWorkspacesInput): Promise<string[]>;
     publishPackage?(input: PublishPackageInput): Promise<PublishPackageOutput>;
     removePackageFromWorkspace(input: RemovePackageFromWorkspaceInput): Promise<RemovePackageFromWorkspaceOutput>;
+    saveProjectMetadata?(input: SaveProjectMetadataInput): Promise<SaveProjectMetadataOutput>;
     saveState(config: Config, workspace?: string): Promise<void>;
     searchPackages?(input: SearchPackagesInput): Promise<SearchPackagesOutput>;
     setEnvVar(input: SetEnvVarInput): Promise<SetEnvVarOutput>;
@@ -311,3 +313,29 @@ export type SearchPackagesOutput = {
     reason: string;
     success: false;
 };
+export type GetProjectMetadataInput = {
+    project: string;
+};
+export type ProjectMetadata = {
+    env?: {
+        [key: string]: string;
+    };
+    template: string;
+};
+export type GetProjectMetadataOutput = {
+    found: false;
+    reason?: string;
+} | {
+    found: true;
+    metadata: ProjectMetadata;
+};
+export type SaveProjectMetadataInput = {
+    metadata: ProjectMetadata;
+    project: string;
+};
+export type SaveProjectMetadataOutput = {
+    reason: string;
+    success: false;
+} | {
+    success: true;
+};

package/dist/backend/file.d.ts

@@ -1,5 +1,5 @@
 import { Config } from '../lib/config/common.js';
-import { AddPackageToWorkspaceInput, AddPackageToWorkspaceOutput, Backend, CreateWorkspaceInput, CreateWorkspaceOutput, DeleteStateInput, DeleteStateOutput, DeleteWorkspaceInput, DeleteWorkspaceOutput, ExportBackendOutput, GetPackageOutput, GetProvisioningIdInput, GetProvisioningIdOutput, GetStateInput, GetStateOutput, GetWorkspaceEnvInput, GetWorkspaceEnvOutput, GetWorkspaceOutput, ImportBackendInput, ImportBackendOutput, InitProjectInput, InitProjectOutput, ListPackageVersionsOutput, ListWorkspacesInput, PublishPackageInput, PublishPackageOutput, RemovePackageFromWorkspaceInput, RemovePackageFromWorkspaceOutput, SetEnvVarInput, SetEnvVarOutput, UnsetEnvVarInput, UnsetEnvVarOutput, UpdateWorkspaceInput, UpdateWorkspaceOutput } from './common.js';
+import { AddPackageToWorkspaceInput, AddPackageToWorkspaceOutput, Backend, CreateWorkspaceInput, CreateWorkspaceOutput, DeleteStateInput, DeleteStateOutput, DeleteWorkspaceInput, DeleteWorkspaceOutput, ExportBackendOutput, GetPackageOutput, GetProjectMetadataInput, GetProjectMetadataOutput, GetProvisioningIdInput, GetProvisioningIdOutput, GetStateInput, GetStateOutput, GetWorkspaceEnvInput, GetWorkspaceEnvOutput, GetWorkspaceOutput, ImportBackendInput, ImportBackendOutput, InitProjectInput, InitProjectOutput, ListPackageVersionsOutput, ListWorkspacesInput, PublishPackageInput, PublishPackageOutput, RemovePackageFromWorkspaceInput, RemovePackageFromWorkspaceOutput, SaveProjectMetadataInput, SaveProjectMetadataOutput, SetEnvVarInput, SetEnvVarOutput, UnsetEnvVarInput, UnsetEnvVarOutput, UpdateWorkspaceInput, UpdateWorkspaceOutput } from './common.js';
 import { FileStorage } from './file-storage/common.js';
 export declare class FileBackend implements Backend {
     private readonly fileStorage;
@@ -11,6 +11,7 @@ export declare class FileBackend implements Backend {
     exportBackend(): Promise<ExportBackendOutput>;
     getPackageByVersion(_: string, __: string): Promise<GetPackageOutput>;
     getPackageLatest(_: string): Promise<GetPackageOutput>;
+    getProjectMetadata(_input: GetProjectMetadataInput): Promise<GetProjectMetadataOutput>;
     getProvisioningId(input: GetProvisioningIdInput): Promise<GetProvisioningIdOutput>;
     getState(input: GetStateInput): Promise<GetStateOutput>;
     getWorkspace(workspace: string): Promise<GetWorkspaceOutput>;
@@ -21,6 +22,7 @@ export declare class FileBackend implements Backend {
     listWorkspaces(_input?: ListWorkspacesInput): Promise<string[]>;
     publishPackage(_: PublishPackageInput): Promise<PublishPackageOutput>;
     removePackageFromWorkspace(input: RemovePackageFromWorkspaceInput): Promise<RemovePackageFromWorkspaceOutput>;
+    saveProjectMetadata(_input: SaveProjectMetadataInput): Promise<SaveProjectMetadataOutput>;
     saveState(config: Config, workspace?: string): Promise<void>;
     setEnvVar(input: SetEnvVarInput): Promise<SetEnvVarOutput>;
     unsetEnvVar(input: UnsetEnvVarInput): Promise<UnsetEnvVarOutput>;

package/dist/backend/file.js

@@ -192,6 +192,9 @@ export class FileBackend {
             success: false,
         };
     }
+    async getProjectMetadata(_input) {
+        return { found: false };
+    }
     async getProvisioningId(input) {
         const idPaths = [`provisioning/${input.logicalId}.yaml`, `provisioning/${input.logicalId}.yml`];
         const newId = `p-${randomUUID()}`;
@@ -402,6 +405,12 @@ export class FileBackend {
             };
         }
     }
+    async saveProjectMetadata(_input) {
+        return {
+            reason: 'Project metadata is only supported with the cloud backend. Please run `hereya login` first.',
+            success: false,
+        };
+    }
     async saveState(config, workspace) {
         const paths = [
             ['state', 'projects', workspace ?? config.workspace, `${config.project}.yaml`].join('/'),

package/dist/commands/credential-helper/index.d.ts

@@ -0,0 +1,10 @@
+import { Command } from '@oclif/core';
+export default class CredentialHelper extends Command {
+    static args: {
+        operation: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static hidden: boolean;
+    run(): Promise<void>;
+    private readCredentialInput;
+}

package/dist/commands/credential-helper/index.js

@@ -0,0 +1,87 @@
+import { Args, Command } from '@oclif/core';
+import { createInterface } from 'node:readline';
+import { getBackend } from '../../backend/index.js';
+import { getExecutorForWorkspace } from '../../executor/context.js';
+import { getConfigManager } from '../../lib/config/index.js';
+export default class CredentialHelper extends Command {
+    static args = {
+        operation: Args.string({ description: 'Git credential operation (get, store, erase)', required: true }),
+    };
+    static description = 'Git credential helper for hereya-managed repositories';
+    static hidden = true;
+    async run() {
+        const { args } = await this.parse(CredentialHelper);
+        // Only handle 'get' - store and erase are no-ops
+        if (args.operation !== 'get') {
+            return;
+        }
+        // Read stdin input per git credential protocol (key=value pairs, blank line terminated)
+        await this.readCredentialInput();
+        // Strategy 1: Check environment variables (used during init clone)
+        const envUsername = process.env.hereyaGitUsername;
+        const envPassword = process.env.hereyaGitPassword;
+        if (envUsername || envPassword) {
+            if (envUsername)
+                process.stdout.write(`username=${envUsername}\n`);
+            if (envPassword)
+                process.stdout.write(`password=${envPassword}\n`);
+            process.stdout.write('\n');
+            return;
+        }
+        // Strategy 2: Load from project metadata via backend + resolve through executor
+        try {
+            const configManager = getConfigManager();
+            const config$ = await configManager.loadConfig({});
+            if (!config$.found)
+                return;
+            const backend = await getBackend();
+            if (!backend.getProjectMetadata)
+                return;
+            const metadata$ = await backend.getProjectMetadata({ project: config$.config.project });
+            if (!metadata$.found || !metadata$.metadata.env)
+                return;
+            const envToResolve = {};
+            if (metadata$.metadata.env.hereyaGitUsername)
+                envToResolve.hereyaGitUsername = metadata$.metadata.env.hereyaGitUsername;
+            if (metadata$.metadata.env.hereyaGitPassword)
+                envToResolve.hereyaGitPassword = metadata$.metadata.env.hereyaGitPassword;
+            if (Object.keys(envToResolve).length === 0)
+                return;
+            const executor$ = await getExecutorForWorkspace(config$.config.workspace, config$.config.project);
+            if (!executor$.success)
+                return;
+            const resolved = await executor$.executor.resolveEnvValues({ env: envToResolve });
+            if (resolved.hereyaGitUsername)
+                process.stdout.write(`username=${resolved.hereyaGitUsername}\n`);
+            if (resolved.hereyaGitPassword)
+                process.stdout.write(`password=${resolved.hereyaGitPassword}\n`);
+            process.stdout.write('\n');
+        }
+        catch {
+            // Silently fail - git will prompt for credentials
+        }
+    }
+    readCredentialInput() {
+        return new Promise((resolve) => {
+            const result = {};
+            const rl = createInterface({ input: process.stdin });
+            rl.on('line', (line) => {
+                if (line === '') {
+                    rl.close();
+                    return;
+                }
+                const eqIndex = line.indexOf('=');
+                if (eqIndex !== -1) {
+                    result[line.slice(0, eqIndex)] = line.slice(eqIndex + 1);
+                }
+            });
+            rl.on('close', () => resolve(result));
+            // Timeout in case stdin never provides input
+            const timeoutMs = process.env.NODE_ENV === 'test' ? 10 : 5000;
+            setTimeout(() => {
+                rl.close();
+                resolve(result);
+            }, timeoutMs);
+        });
+    }
+}

package/dist/commands/devenv/install/index.js

@@ -1,8 +1,8 @@
 import { Command, Flags } from '@oclif/core';
 import { Listr, ListrLogger, ListrLogLevels } from 'listr2';
-import { getCloudCredentials, loadBackendConfig } from '../../../backend/config.js';
 import { getBackend } from '../../../backend/index.js';
 import { getExecutorForWorkspace } from '../../../executor/context.js';
+import { hereyaTokenUtils } from '../../../lib/hereya-token.js';
 import { getLogger, getLogPath, isDebug, setDebug } from '../../../lib/log.js';
 import { arrayOfStringToObject } from '../../../lib/object-utils.js';
 import { delay } from '../../../lib/shell.js';
@@ -78,7 +78,7 @@ export default class DevenvInstall extends Command {
                         },
                         {
                             async task(ctx) {
-                                const token = await generateHereyaToken(flags.workspace);
+                                const token = await hereyaTokenUtils.generateHereyaToken(`Dev environment: ${flags.workspace}`);
                                 if (token) {
                                     ctx.parameters = { ...ctx.parameters, hereyaCloudUrl: token.cloudUrl, hereyaToken: token.token };
                                 }
@@ -142,29 +142,3 @@ See ${getLogPath()} for more details`);
         }
     }
 }
-async function generateHereyaToken(workspace) {
-    const backendConfig = await loadBackendConfig();
-    if (!backendConfig.cloud) {
-        return null;
-    }
-    const { clientId, url } = backendConfig.cloud;
-    const credentials = await getCloudCredentials(clientId);
-    if (!credentials) {
-        return null;
-    }
-    const formData = new FormData();
-    formData.append('description', `Dev environment: ${workspace}`);
-    formData.append('expiresInDays', '365');
-    const response = await fetch(`${url}/api/personal-tokens`, {
-        body: formData,
-        headers: {
-            Authorization: `Bearer ${credentials.accessToken}`,
-        },
-        method: 'POST',
-    });
-    if (!response.ok) {
-        return null;
-    }
-    const result = await response.json();
-    return { cloudUrl: url, token: result.data.token };
-}

package/dist/commands/devenv/project/init/index.d.ts

@@ -7,6 +7,8 @@ export default class DevenvProjectInit extends Command {
     static examples: string[];
     static flags: {
         force: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        parameter: import("@oclif/core/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        template: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;

package/dist/commands/devenv/project/init/index.js

@@ -17,6 +17,8 @@ export default class DevenvProjectInit extends Command {
     static description = 'Initialize a project on a remote dev environment.';
     static examples = [
         '<%= config.bin %> <%= command.id %> my-app -w my-workspace',
+        '<%= config.bin %> <%= command.id %> my-app -w my-workspace -t acme/node-starter',
+        '<%= config.bin %> <%= command.id %> my-app -w my-workspace -t acme/node-starter -p region=us-east-1',
     ];
     static flags = {
         force: Flags.boolean({
@@ -24,6 +26,18 @@ export default class DevenvProjectInit extends Command {
             default: false,
             description: 'continue even if folder already exists',
         }),
+        parameter: Flags.string({
+            char: 'p',
+            default: [],
+            description: "parameter for the template, in the form of 'key=value'. Can be specified multiple times.",
+            multiple: true,
+            required: false,
+        }),
+        template: Flags.string({
+            char: 't',
+            description: 'template package to scaffold the project from',
+            required: false,
+        }),
         workspace: Flags.string({
             char: 'w',
             description: 'name of the workspace',
@@ -33,7 +47,7 @@ export default class DevenvProjectInit extends Command {
     async run() {
         const { args, flags } = await this.parse(DevenvProjectInit);
         const { project } = args;
-        const { force, workspace } = flags;
+        const { force, parameter, template, workspace } = flags;
         const backend = await getBackend();
         const getWorkspaceEnvOutput = await backend.getWorkspaceEnv({ workspace });
         if (!getWorkspaceEnvOutput.success) {
@@ -58,9 +72,21 @@ export default class DevenvProjectInit extends Command {
         try {
             await fs.writeFile(tempKeyPath, sshPrivateKey);
             await setKeyFilePermissions(tempKeyPath);
-            const remoteScript = force
-                ? `mkdir -p ~/${project} && cd ~/${project} && hereya init ${project} -w ${workspace}`
-                : `if [ -d ~/${project} ]; then echo "ERROR: Folder ~/${project} already exists. Use --force to continue." && exit 1; fi && mkdir -p ~/${project} && cd ~/${project} && hereya init ${project} -w ${workspace}`;
+            const templateFlag = template ? ` -t ${template}` : '';
+            const paramFlags = (parameter ?? []).map((p) => ` -p ${p}`).join('');
+            let remoteScript;
+            if (template) {
+                // With template: hereya init creates dir via git clone, no need for mkdir
+                remoteScript = force
+                    ? `cd ~ && hereya init ${project} -w ${workspace}${templateFlag}${paramFlags}`
+                    : `if [ -d ~/${project} ]; then echo "ERROR: Folder ~/${project} already exists. Use --force to continue." && exit 1; fi && cd ~ && hereya init ${project} -w ${workspace}${templateFlag}${paramFlags}`;
+            }
+            else {
+                // Without template: existing behavior (mkdir + cd + init)
+                remoteScript = force
+                    ? `mkdir -p ~/${project} && cd ~/${project} && hereya init ${project} -w ${workspace}`
+                    : `if [ -d ~/${project} ]; then echo "ERROR: Folder ~/${project} already exists. Use --force to continue." && exit 1; fi && mkdir -p ~/${project} && cd ~/${project} && hereya init ${project} -w ${workspace}`;
+            }
             const sshArgs = ['-i', tempKeyPath, '-o', 'StrictHostKeyChecking=no', `${sshUser}@${host}`, remoteScript];
             await this.spawnSsh(sshArgs);
         }

package/dist/commands/devenv/project/uninit/index.d.ts

@@ -0,0 +1,14 @@
+import { Command } from '@oclif/core';
+export default class DevenvProjectUninit extends Command {
+    static args: {
+        project: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        force: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+    protected spawnSsh(args: string[]): Promise<void>;
+}

package/dist/commands/devenv/project/uninit/index.js

@@ -0,0 +1,95 @@
+import { Args, Command, Flags } from '@oclif/core';
+import { spawn } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { getBackend } from '../../../../backend/index.js';
+import { getExecutorForWorkspace } from '../../../../executor/context.js';
+import { setKeyFilePermissions } from '../../../../lib/ssh-utils.js';
+export default class DevenvProjectUninit extends Command {
+    static args = {
+        project: Args.string({
+            description: 'project name',
+            required: true,
+        }),
+    };
+    static description = 'Uninitialize a project on a remote dev environment.';
+    static examples = [
+        '<%= config.bin %> <%= command.id %> my-app -w my-workspace',
+        '<%= config.bin %> <%= command.id %> my-app -w my-workspace --force',
+    ];
+    static flags = {
+        force: Flags.boolean({
+            char: 'f',
+            default: false,
+            description: 'also remove the project directory after uninit',
+        }),
+        workspace: Flags.string({
+            char: 'w',
+            description: 'name of the workspace',
+            required: true,
+        }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(DevenvProjectUninit);
+        const { project } = args;
+        const { force, workspace } = flags;
+        const backend = await getBackend();
+        const getWorkspaceEnvOutput = await backend.getWorkspaceEnv({ workspace });
+        if (!getWorkspaceEnvOutput.success) {
+            this.error(getWorkspaceEnvOutput.reason);
+        }
+        let { env } = getWorkspaceEnvOutput;
+        const executor$ = await getExecutorForWorkspace(workspace);
+        if (!executor$.success) {
+            this.error(executor$.reason);
+        }
+        const { executor } = executor$;
+        env = await executor.resolveEnvValues({ env });
+        const sshHost = env.devEnvSshHost;
+        const sshPrivateKey = env.devEnvSshPrivateKey;
+        const sshUser = env.devEnvSshUser;
+        const sshHostDns = env.devEnvSshHostDns;
+        if (!sshHost || !sshPrivateKey || !sshUser) {
+            this.error('devEnvSshHost, devEnvSshPrivateKey, and devEnvSshUser must be set in the workspace environment');
+        }
+        const host = sshHostDns || sshHost;
+        const tempKeyPath = path.join(os.tmpdir(), `hereya-ssh-${randomUUID()}`);
+        try {
+            await fs.writeFile(tempKeyPath, sshPrivateKey);
+            await setKeyFilePermissions(tempKeyPath);
+            const remoteScript = force
+                ? `cd ~ && hereya uninit ${project} -w ${workspace} && rm -rf ~/${project}`
+                : `cd ~ && hereya uninit ${project} -w ${workspace}`;
+            const sshArgs = ['-i', tempKeyPath, '-o', 'StrictHostKeyChecking=no', `${sshUser}@${host}`, remoteScript];
+            await this.spawnSsh(sshArgs);
+        }
+        finally {
+            try {
+                await fs.unlink(tempKeyPath);
+            }
+            catch {
+                // Ignore cleanup errors
+            }
+        }
+    }
+    spawnSsh(args) {
+        return new Promise((resolve, reject) => {
+            const child = spawn('ssh', args, {
+                stdio: 'inherit',
+            });
+            child.on('close', (code) => {
+                if (code === 0) {
+                    resolve();
+                }
+                else {
+                    reject(new Error(`SSH exited with code ${code}`));
+                }
+            });
+            child.on('error', (err) => {
+                reject(err);
+            });
+        });
+    }
+}

package/dist/commands/init/index.d.ts

@@ -7,6 +7,8 @@ export default class Init extends Command {
     static examples: string[];
     static flags: {
         chdir: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        parameter: import("@oclif/core/interfaces").OptionFlag<string[], import("@oclif/core/interfaces").CustomOptions>;
+        template: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;

package/dist/commands/init/index.js

@@ -1,6 +1,14 @@
 import { Args, Command, Flags } from '@oclif/core';
+import { Listr, ListrLogger, ListrLogLevels } from 'listr2';
+import fs from 'node:fs';
+import path from 'node:path';
 import { getBackend } from '../../backend/index.js';
+import { getExecutorForWorkspace } from '../../executor/context.js';
 import { getConfigManager } from '../../lib/config/index.js';
+import { gitUtils } from '../../lib/git-utils.js';
+import { hereyaTokenUtils } from '../../lib/hereya-token.js';
+import { getLogger, getLogPath } from '../../lib/log.js';
+import { arrayOfStringToObject } from '../../lib/object-utils.js';
 export default class Init extends Command {
     static args = {
         project: Args.string({ description: 'project name', required: true }),
@@ -9,12 +17,25 @@ export default class Init extends Command {
     static examples = [
         '<%= config.bin %> <%= command.id %> myProject -w=defaultWorkspace',
         '<%= config.bin %> <%= command.id %> myProject -w=defaultWorkspace --chdir=./myProject',
+        '<%= config.bin %> <%= command.id %> myProject -w=dev -t=acme/node-starter',
+        '<%= config.bin %> <%= command.id %> myProject -w=dev -t=acme/node-starter -p region=us-east-1',
     ];
     static flags = {
         chdir: Flags.string({
             description: 'directory to run command in',
             required: false,
         }),
+        parameter: Flags.string({
+            char: 'p',
+            default: [],
+            description: "template parameter, in the form of 'key=value'. Can be specified multiple times.",
+            multiple: true,
+        }),
+        template: Flags.string({
+            char: 't',
+            description: 'template package name (e.g. owner/repo)',
+            required: false,
+        }),
         workspace: Flags.string({
             char: 'w',
             description: 'workspace to set as default',
@@ -24,6 +45,118 @@ export default class Init extends Command {
     async run() {
         const { args, flags } = await this.parse(Init);
         const projectRootDir = flags.chdir || process.env.HEREYA_PROJECT_ROOT_DIR;
+        // Template flow
+        if (flags.template) {
+            const targetDir = projectRootDir || path.join(process.cwd(), args.project);
+            if (fs.existsSync(targetDir)) {
+                this.error(`Directory ${targetDir} already exists.`);
+            }
+            const task = new Listr([
+                {
+                    async task(ctx) {
+                        const backend = await getBackend();
+                        ctx.initOutput = await backend.init({ project: args.project, workspace: flags.workspace });
+                    },
+                    title: 'Initializing project',
+                },
+                {
+                    async task(ctx, task) {
+                        const executor$ = await getExecutorForWorkspace(flags.workspace);
+                        if (!executor$.success)
+                            throw new Error(executor$.reason);
+                        const userParams = arrayOfStringToObject(flags.parameter);
+                        const tokenResult = await hereyaTokenUtils.generateHereyaToken(`Template: ${args.project}`);
+                        const provisionOutput = await executor$.executor.provision({
+                            logger: getLogger(task),
+                            package: flags.template,
+                            parameters: {
+                                ...userParams,
+                                projectName: args.project,
+                                workspace: flags.workspace,
+                                ...(tokenResult ? { hereyaCloudUrl: tokenResult.cloudUrl, hereyaToken: tokenResult.token } : {}),
+                            },
+                            project: args.project,
+                            workspace: flags.workspace,
+                        });
+                        if (!provisionOutput.success)
+                            throw new Error(provisionOutput.reason);
+                        ctx.provisionOutput = provisionOutput;
+                    },
+                    title: 'Provisioning template',
+                },
+                {
+                    async task(ctx) {
+                        const backend = await getBackend();
+                        if (!backend.saveProjectMetadata) {
+                            throw new Error('Templates require cloud backend. Run `hereya login` first.');
+                        }
+                        const result = await backend.saveProjectMetadata({
+                            metadata: { env: ctx.provisionOutput.env, template: flags.template },
+                            project: args.project,
+                        });
+                        if (!result.success)
+                            throw new Error(result.reason);
+                    },
+                    title: 'Saving template metadata',
+                },
+                {
+                    async task(ctx) {
+                        const gitEnvToResolve = {};
+                        for (const [key, value] of Object.entries(ctx.provisionOutput.env)) {
+                            if (key.startsWith('hereyaGit'))
+                                gitEnvToResolve[key] = value;
+                        }
+                        const executor$ = await getExecutorForWorkspace(flags.workspace);
+                        if (!executor$.success)
+                            throw new Error(executor$.reason);
+                        ctx.resolvedGitEnv = await executor$.executor.resolveEnvValues({ env: gitEnvToResolve });
+                        if (!ctx.resolvedGitEnv.hereyaGitRemoteUrl) {
+                            throw new Error('Template did not provide hereyaGitRemoteUrl. Templates must export hereyaGitRemoteUrl.');
+                        }
+                    },
+                    title: 'Resolving git credentials',
+                },
+                {
+                    async task(ctx) {
+                        const cloneResult = await gitUtils.cloneWithCredentialHelper({
+                            gitUrl: ctx.resolvedGitEnv.hereyaGitRemoteUrl,
+                            hereyaBinPath: process.argv[1],
+                            password: ctx.resolvedGitEnv.hereyaGitPassword,
+                            targetDir,
+                            username: ctx.resolvedGitEnv.hereyaGitUsername,
+                        });
+                        if (!cloneResult.success)
+                            throw new Error(cloneResult.reason);
+                    },
+                    title: 'Cloning project repository',
+                },
+                {
+                    async task(ctx) {
+                        const config = {
+                            project: ctx.initOutput.project.name,
+                            workspace: ctx.initOutput.workspace.name,
+                        };
+                        const configManager = getConfigManager();
+                        await configManager.saveConfig({ config, projectRootDir: targetDir });
+                        await gitUtils.setupCredentialHelper({ hereyaBinPath: process.argv[1], projectDir: targetDir });
+                        const backend = await getBackend();
+                        await backend.saveState(config, flags.workspace);
+                    },
+                    title: 'Setting up project',
+                },
+            ], { concurrent: false });
+            try {
+                await task.run();
+                const myLogger = new ListrLogger({ useIcons: false });
+                myLogger.log(ListrLogLevels.COMPLETED, `Project ${args.project} scaffolded from template ${flags.template}`);
+                myLogger.log(ListrLogLevels.COMPLETED, `Project directory: ${targetDir}`);
+            }
+            catch (error) {
+                this.error(`${error.message}\n\nSee ${getLogPath()} for more details`);
+            }
+            return;
+        }
+        // Non-template flow (existing behavior, unchanged)
         const configManager = getConfigManager();
         const config$ = await configManager.loadConfig({ projectRootDir });
         if (config$.found) {

package/dist/commands/uninit/index.d.ts

@@ -0,0 +1,13 @@
+import { Command } from '@oclif/core';
+export default class Uninit extends Command {
+    static args: {
+        project: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        chdir: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}