@swovohq/fuel 0.1.0

package/dist/infra/orchestrator.js

@@ -0,0 +1,187 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runInfraOrchestrator = runInfraOrchestrator;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const chalk_1 = __importDefault(require("chalk"));
+const tofu_runner_1 = require("./tofu-runner");
+const secrets_manager_client_1 = require("./secrets-manager-client");
+const git_client_1 = require("./git-client");
+const subprocess_1 = require("./subprocess");
+const s3_state_bucket_1 = require("./s3-state-bucket");
+function slugify(name) {
+    return name.replace(/[^a-z0-9]/gi, '_').toLowerCase();
+}
+function buildDestroyArgs(completedPasses, credentials, tofuVars) {
+    const targets = [];
+    if (completedPasses.includes(1)) {
+        targets.push('-target=module.ecr', '-target=module.github_repo');
+    }
+    if (completedPasses.includes(2)) {
+        targets.push('-target=module.github_actions');
+    }
+    return [
+        'destroy',
+        '-var-file=default.tfvars',
+        '-auto-approve',
+        `-var=github_token=${credentials.GITHUB_TOKEN}`,
+        `-var=github_username=${credentials.GITHUB_USERNAME}`,
+        `-var=aws_access_key_id=${credentials.AWS_ACCESS_KEY_ID}`,
+        `-var=aws_secret_access_key=${credentials.AWS_SECRET_ACCESS_KEY}`,
+        `-var=aws_region=${credentials.AWS_REGION}`,
+        `-var=github_organization=${credentials.GITHUB_ORGANIZATION}`,
+        `-var=db_password=${tofuVars.db_password}`,
+        `-var=db_username=${tofuVars.db_username}`,
+        `-var=db_name=${tofuVars.db_name}`,
+        `-var=skip_ecs=true`,
+        ...targets,
+    ];
+}
+async function runCompensation(infraDir, credentials, tofuVars, completedPasses) {
+    if (completedPasses.length === 0)
+        return;
+    console.log(chalk_1.default.red('\n--- Cleaning up partial resources ---'));
+    const args = buildDestroyArgs(completedPasses, credentials, tofuVars);
+    const awsEnv = {
+        AWS_ACCESS_KEY_ID: credentials.AWS_ACCESS_KEY_ID,
+        AWS_SECRET_ACCESS_KEY: credentials.AWS_SECRET_ACCESS_KEY,
+        AWS_REGION: credentials.AWS_REGION,
+    };
+    const { code } = await (0, subprocess_1.spawnStreaming)(args, infraDir, awsEnv);
+    if (code !== 0) {
+        console.error(chalk_1.default.red('Compensation destroy failed. Manually delete these resources:'));
+        if (completedPasses.includes(1)) {
+            console.error(chalk_1.default.red('  - ECR repository (module.ecr)'));
+            console.error(chalk_1.default.red('  - GitHub repository (module.github_repo)'));
+        }
+        if (completedPasses.includes(2)) {
+            console.error(chalk_1.default.red('  - GitHub Actions config (module.github_actions)'));
+        }
+        process.exit(1);
+    }
+    console.log(chalk_1.default.green('Partial resources cleaned up'));
+}
+function printOutputTable(albDns, ecrUrl, githubRepoUrl, dbUsername, dbPassword) {
+    const divider = chalk_1.default.gray('─'.repeat(60));
+    console.log('\n' + divider);
+    console.log(chalk_1.default.bold('  Deployment Complete'));
+    console.log(divider);
+    console.log(`  ${chalk_1.default.dim('ALB DNS')}          ${albDns}`);
+    console.log(`  ${chalk_1.default.dim('ECR URL')}          ${ecrUrl}`);
+    console.log(`  ${chalk_1.default.dim('GitHub Repo')}      ${githubRepoUrl}`);
+    console.log(`  ${chalk_1.default.dim('DB Username')}      ${dbUsername}`);
+    console.log(`  ${chalk_1.default.dim('DB Password')}      ${dbPassword}  ${chalk_1.default.yellow("Save these — they won't be shown again")}`);
+    console.log(divider);
+    console.log(chalk_1.default.cyan('\n  Next steps:'));
+    console.log('  Push to main to trigger your first deploy.\n');
+}
+async function runInfraOrchestrator(targetRoot, appName, config, credentials, options) {
+    const infraDir = path.join(targetRoot, 'infra');
+    // Generate TofuVars
+    const tofuVars = {
+        db_password: crypto.randomBytes(32).toString('hex'),
+        db_username: slugify(config.name),
+        db_name: slugify(config.name),
+    };
+    // Ensure S3 state bucket exists (before Tofu init)
+    console.log(chalk_1.default.cyan('--- Ensuring state bucket exists ---'));
+    const suffix = await (0, s3_state_bucket_1.loadOrCreateSuffix)(targetRoot);
+    const bucketName = (0, s3_state_bucket_1.buildStateBucketName)(config.name, suffix);
+    await (0, s3_state_bucket_1.ensureStateBucket)(credentials, bucketName);
+    // Write secret to AWS Secrets Manager (before Tofu — Tofu reads it via data.tf)
+    const secretName = `${config.name}-infrastructure-variables`;
+    const fuelConfigPath = path.join(targetRoot, 'fuel.config.json');
+    const fuelConfigContents = JSON.parse(fs.readFileSync(fuelConfigPath, 'utf-8'));
+    console.log(chalk_1.default.cyan('--- Writing infrastructure secret ---'));
+    await (0, secrets_manager_client_1.putSecret)(credentials, secretName, fuelConfigContents);
+    console.log(chalk_1.default.green('Secret written to AWS Secrets Manager'));
+    // SIGINT compensation setup
+    const state = { tofuStarted: false, completedPasses: [] };
+    const sigintHandler = async () => {
+        if (options?.skipCompensation) {
+            console.log(chalk_1.default.yellow('\nInterrupted — partial resources preserved.'));
+            console.log(chalk_1.default.yellow('Re-run "fuel infra:deploy" to resume.\n'));
+        }
+        else {
+            console.log(chalk_1.default.yellow('\nInterrupted — running compensation...'));
+            if (state.tofuStarted && state.completedPasses.length > 0) {
+                await runCompensation(infraDir, credentials, tofuVars, state.completedPasses);
+            }
+        }
+        process.exit(1);
+    };
+    process.once('SIGINT', sigintHandler);
+    try {
+        // Run Tofu three-pass sequence
+        state.tofuStarted = true;
+        const result = await (0, tofu_runner_1.runTofuSequence)(infraDir, credentials, tofuVars, {
+            planOnly: options?.planOnly,
+        });
+        state.completedPasses = result.completedPasses;
+        if (options?.planOnly) {
+            console.log(chalk_1.default.green('\n  Plan complete — no resources were created.\n'));
+            return;
+        }
+        // Wire git remote
+        const githubRepoUrl = result.outputs['github_http_repo_url'].value;
+        await (0, git_client_1.wireGitRemote)(targetRoot, githubRepoUrl);
+        console.log(chalk_1.default.green('Git remote origin set'));
+        // Print output table
+        const albDns = result.outputs['alb_dns'].value;
+        const ecrUrl = result.outputs['ecr_url'].value;
+        printOutputTable(albDns, ecrUrl, githubRepoUrl, tofuVars.db_username, tofuVars.db_password);
+    }
+    catch (err) {
+        if (err instanceof tofu_runner_1.TofuPassError) {
+            if (options?.skipCompensation) {
+                console.log(chalk_1.default.yellow('\n  Partial resources preserved. Fix the issue and re-run:'));
+                console.log(chalk_1.default.yellow('    fuel infra:deploy\n'));
+                process.exit(1);
+            }
+            await runCompensation(infraDir, credentials, tofuVars, err.completedPasses);
+            process.exit(1);
+        }
+        throw err;
+    }
+    finally {
+        process.removeListener('SIGINT', sigintHandler);
+    }
+}
+//# sourceMappingURL=orchestrator.js.map

package/dist/infra/orchestrator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestrator.js","sourceRoot":"","sources":["../../src/infra/orchestrator.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuGA,oDAoFC;AA3LD,+CAAgC;AAChC,uCAAwB;AACxB,2CAA4B;AAC5B,kDAAyB;AAEzB,+CAAwE;AACxE,qEAAoD;AACpD,6CAA4C;AAC5C,6CAA6C;AAC7C,uDAA+F;AAE/F,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;AACvD,CAAC;AAED,SAAS,gBAAgB,CACvB,eAAyB,EACzB,WAAwB,EACxB,QAAkB;IAElB,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE,4BAA4B,CAAC,CAAA;IAClE,CAAC;IACD,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO;QACL,SAAS;QACT,0BAA0B;QAC1B,eAAe;QACf,qBAAqB,WAAW,CAAC,YAAY,EAAE;QAC/C,wBAAwB,WAAW,CAAC,eAAe,EAAE;QACrD,0BAA0B,WAAW,CAAC,iBAAiB,EAAE;QACzD,8BAA8B,WAAW,CAAC,qBAAqB,EAAE;QACjE,mBAAmB,WAAW,CAAC,UAAU,EAAE;QAC3C,4BAA4B,WAAW,CAAC,mBAAmB,EAAE;QAC7D,oBAAoB,QAAQ,CAAC,WAAW,EAAE;QAC1C,oBAAoB,QAAQ,CAAC,WAAW,EAAE;QAC1C,gBAAgB,QAAQ,CAAC,OAAO,EAAE;QAClC,oBAAoB;QACpB,GAAG,OAAO;KACX,CAAA;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,QAAgB,EAChB,WAAwB,EACxB,QAAkB,EAClB,eAAyB;IAEzB,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAExC,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC,CAAA;IACjE,MAAM,IAAI,GAAG,gBAAgB,CAAC,eAAe,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAA;IACrE,MAAM,MAAM,GAAG;QACb,iBAAiB,EAAE,WAAW,CAAC,iBAAiB;QAChD,qBAAqB,EAAE,WAAW,CAAC,qBAAqB;QACxD,UAAU,EAAE,WAAW,CAAC,UAAU;KACnC,CAAA;IACD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAA,2BAAc,EAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IAE7D,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC,CAAA;QACzF,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC,CAAA;YAC3D,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC,CAAA;QACxE,CAAC;QACD,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC,CAAA;QAC/E,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAA;AAC1D,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAc,EACd,MAAc,EACd,aAAqB,EACrB,UAAkB,EAClB,UAAkB;IAElB,MAAM,OAAO,GAAG,eAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;IAC1C,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC,CAAA;IAC3B,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAA;IAChD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACpB,OAAO,CAAC,GAAG,CAAC,KAAK,eAAK,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,MAAM,EAAE,CAAC,CAAA;IAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,eAAK,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,MAAM,EAAE,CAAC,CAAA;IAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,eAAK,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,aAAa,EAAE,CAAC,CAAA;IAClE,OAAO,CAAC,GAAG,CAAC,KAAK,eAAK,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,UAAU,EAAE,CAAC,CAAA;IAC/D,OAAO,CAAC,GAAG,CAAC,KAAK,eAAK,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,UAAU,KAAK,eAAK,CAAC,MAAM,CAAC,wCAAwC,CAAC,EAAE,CAAC,CAAA;IAC1H,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACpB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAA;IAC1C,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAA;AAC/D,CAAC;AAOM,KAAK,UAAU,oBAAoB,CACxC,UAAkB,EAClB,OAAe,EACf,MAAmB,EACnB,WAAwB,EACxB,OAA6B;IAE7B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IAE/C,oBAAoB;IACpB,MAAM,QAAQ,GAAa;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACnD,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QACjC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;KAC9B,CAAA;IAED,mDAAmD;IACnD,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC,CAAA;IAC/D,MAAM,MAAM,GAAG,MAAM,IAAA,oCAAkB,EAAC,UAAU,CAAC,CAAA;IACnD,MAAM,UAAU,GAAG,IAAA,sCAAoB,EAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC5D,MAAM,IAAA,mCAAiB,EAAC,WAAW,EAAE,UAAU,CAAC,CAAA;IAEhD,gFAAgF;IAChF,MAAM,UAAU,GAAG,GAAG,MAAM,CAAC,IAAI,2BAA2B,CAAA;IAC5D,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAA;IAChE,MAAM,kBAAkB,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAA;IAC/E,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC,CAAA;IAChE,MAAM,IAAA,kCAAS,EAAC,WAAW,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAA;IAC5D,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAA;IAEjE,4BAA4B;IAC5B,MAAM,KAAK,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,eAAe,EAAE,EAAc,EAAE,CAAA;IAErE,MAAM,aAAa,GAAG,KAAK,IAAI,EAAE;QAC/B,IAAI,OAAO,EAAE,gBAAgB,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,8CAA8C,CAAC,CAAC,CAAA;YACzE,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,yCAAyC,CAAC,CAAC,CAAA;QACtE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,yCAAyC,CAAC,CAAC,CAAA;YACpE,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1D,MAAM,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,eAAe,CAAC,CAAA;YAC/E,CAAC;QACH,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAA;IAED,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;IAErC,IAAI,CAAC;QACH,+BAA+B;QAC/B,KAAK,CAAC,WAAW,GAAG,IAAI,CAAA;QACxB,MAAM,MAAM,GAAG,MAAM,IAAA,6BAAe,EAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE;YACpE,QAAQ,EAAE,OAAO,EAAE,QAAQ;SAC5B,CAAC,CAAA;QACF,KAAK,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,CAAA;QAE9C,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC,CAAA;YAC5E,OAAM;QACR,CAAC;QAED,kBAAkB;QAClB,MAAM,aAAa,GAAG,MAAM,CAAC,OAAQ,CAAC,sBAAsB,CAAC,CAAC,KAAK,CAAA;QACnE,MAAM,IAAA,0BAAa,EAAC,UAAU,EAAE,aAAa,CAAC,CAAA;QAC9C,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAA;QAEjD,qBAAqB;QACrB,MAAM,MAAM,GAAG,MAAM,CAAC,OAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAA;QAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAA;QAC/C,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAA;IAC7F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,2BAAa,EAAE,CAAC;YACjC,IAAI,OAAO,EAAE,gBAAgB,EAAE,CAAC;gBAC9B,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,4DAA4D,CAAC,CAAC,CAAA;gBACvF,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC,CAAA;gBACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACjB,CAAC;YACD,MAAM,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,CAAC,eAAe,CAAC,CAAA;YAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;IACjD,CAAC;AACH,CAAC"}

package/dist/infra/preflight.d.ts

@@ -0,0 +1,9 @@
+import { InfraConfig, Credentials } from './types';
+export declare function checkTofuVersion(): string;
+export interface PreflightResult {
+    config: InfraConfig;
+    credentials: Credentials;
+    tofuVersion: string;
+}
+export declare function runPreflight(configPath: string): Promise<PreflightResult>;
+//# sourceMappingURL=preflight.d.ts.map

package/dist/infra/preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../../src/infra/preflight.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAclD,wBAAgB,gBAAgB,IAAI,MAAM,CA2BzC;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,WAAW,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,wBAAsB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CA8B/E"}

package/dist/infra/preflight.js

@@ -0,0 +1,75 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkTofuVersion = checkTofuVersion;
+exports.runPreflight = runPreflight;
+const child_process_1 = require("child_process");
+const chalk_1 = __importDefault(require("chalk"));
+const config_loader_1 = require("./config-loader");
+const credentials_1 = require("./credentials");
+const MIN_TOFU_MAJOR = 1;
+const MIN_TOFU_MINOR = 7;
+function pass(label) {
+    console.log(chalk_1.default.green('✓') + ' ' + label);
+}
+function fail(label, detail) {
+    console.error(chalk_1.default.red('✗') + ' ' + label + ': ' + detail);
+    process.exit(1);
+}
+function checkTofuVersion() {
+    let output;
+    try {
+        output = (0, child_process_1.execSync)('tofu version', {
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+    }
+    catch (e) {
+        throw new Error('tofu not found. Install OpenTofu >= 1.7.0: https://opentofu.org/docs/intro/install/');
+    }
+    const match = output.match(/OpenTofu v(\d+)\.(\d+)\.(\d+)/);
+    if (!match) {
+        throw new Error('Could not parse tofu version output');
+    }
+    const [major, minor] = [Number(match[1]), Number(match[2])];
+    if (major < MIN_TOFU_MAJOR ||
+        (major === MIN_TOFU_MAJOR && minor < MIN_TOFU_MINOR)) {
+        throw new Error(`tofu v${match[1]}.${match[2]}.${match[3]} found but >= ${MIN_TOFU_MAJOR}.${MIN_TOFU_MINOR}.0 required. ` +
+            `Upgrade at https://opentofu.org/docs/intro/install/`);
+    }
+    return `${match[1]}.${match[2]}.${match[3]}`;
+}
+async function runPreflight(configPath) {
+    // Check 1: tofu binary
+    let tofuVersion;
+    try {
+        tofuVersion = checkTofuVersion();
+        pass(`tofu ${tofuVersion}`);
+    }
+    catch (err) {
+        fail('tofu', err.message);
+    }
+    // Check 2: credentials
+    let credentials;
+    try {
+        credentials = await (0, credentials_1.resolveCredentials)();
+        pass('AWS credentials valid');
+        pass('GitHub token valid');
+    }
+    catch (err) {
+        fail('credentials', err.message);
+    }
+    // Check 3: config
+    let config;
+    try {
+        config = await (0, config_loader_1.loadInfraConfig)(configPath);
+        pass(`config.json valid — ${config.apps.length} app(s) (${config.apps.map((a) => a.name).join(', ')})`);
+    }
+    catch (err) {
+        fail('config.json', err.message);
+    }
+    return { config: config, credentials: credentials, tofuVersion: tofuVersion };
+}
+//# sourceMappingURL=preflight.js.map

package/dist/infra/preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../../src/infra/preflight.ts"],"names":[],"mappings":";;;;;AAkBA,4CA2BC;AAQD,oCA8BC;AAnFD,iDAAwC;AACxC,kDAAyB;AACzB,mDAAiD;AACjD,+CAAkD;AAGlD,MAAM,cAAc,GAAG,CAAC,CAAA;AACxB,MAAM,cAAc,GAAG,CAAC,CAAA;AAExB,SAAS,IAAI,CAAC,KAAa;IACzB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,KAAK,CAAC,CAAA;AAC7C,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,MAAc;IACzC,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,KAAK,GAAG,IAAI,GAAG,MAAM,CAAC,CAAA;IAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC;AAED,SAAgB,gBAAgB;IAC9B,IAAI,MAAc,CAAA;IAClB,IAAI,CAAC;QACH,MAAM,GAAG,IAAA,wBAAQ,EAAC,cAAc,EAAE;YAChC,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAA;IACH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACxD,CAAC;IACD,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC3D,IACE,KAAK,GAAG,cAAc;QACtB,CAAC,KAAK,KAAK,cAAc,IAAI,KAAK,GAAG,cAAc,CAAC,EACpD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,SAAS,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,iBAAiB,cAAc,IAAI,cAAc,eAAe;YACzG,qDAAqD,CACtD,CAAA;IACH,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;AAC9C,CAAC;AAQM,KAAK,UAAU,YAAY,CAAC,UAAkB;IACnD,uBAAuB;IACvB,IAAI,WAAmB,CAAA;IACvB,IAAI,CAAC;QACH,WAAW,GAAG,gBAAgB,EAAE,CAAA;QAChC,IAAI,CAAC,QAAQ,WAAW,EAAE,CAAC,CAAA;IAC7B,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IAC3B,CAAC;IAED,uBAAuB;IACvB,IAAI,WAAwB,CAAA;IAC5B,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,IAAA,gCAAkB,GAAE,CAAA;QACxC,IAAI,CAAC,uBAAuB,CAAC,CAAA;QAC7B,IAAI,CAAC,oBAAoB,CAAC,CAAA;IAC5B,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IAClC,CAAC;IAED,kBAAkB;IAClB,IAAI,MAAmB,CAAA;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAA,+BAAe,EAAC,UAAU,CAAC,CAAA;QAC1C,IAAI,CAAC,uBAAuB,MAAM,CAAC,IAAI,CAAC,MAAM,YAAY,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACzG,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IAClC,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAO,EAAE,WAAW,EAAE,WAAY,EAAE,WAAW,EAAE,WAAY,EAAE,CAAA;AAClF,CAAC"}

package/dist/infra/s3-state-bucket.d.ts

@@ -0,0 +1,5 @@
+import { Credentials } from './types';
+export declare function loadOrCreateSuffix(projectRoot: string): Promise<string>;
+export declare function buildStateBucketName(projectName: string, suffix: string): string;
+export declare function ensureStateBucket(credentials: Credentials, bucketName: string): Promise<void>;
+//# sourceMappingURL=s3-state-bucket.d.ts.map

package/dist/infra/s3-state-bucket.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3-state-bucket.d.ts","sourceRoot":"","sources":["../../src/infra/s3-state-bucket.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAYrC,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAW7E;AAED,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEhF;AAED,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,WAAW,EACxB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CA4Bf"}

package/dist/infra/s3-state-bucket.js

@@ -0,0 +1,92 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadOrCreateSuffix = loadOrCreateSuffix;
+exports.buildStateBucketName = buildStateBucketName;
+exports.ensureStateBucket = ensureStateBucket;
+const client_s3_1 = require("@aws-sdk/client-s3");
+const fs = __importStar(require("fs-extra"));
+const path = __importStar(require("path"));
+const crypto = __importStar(require("crypto"));
+const chalk_1 = __importDefault(require("chalk"));
+const STATE_FILE = '.fuel-infra-state.json';
+function generateSuffix() {
+    return crypto.randomBytes(4).toString('hex');
+}
+async function loadOrCreateSuffix(projectRoot) {
+    const stateFilePath = path.join(projectRoot, STATE_FILE);
+    if (await fs.pathExists(stateFilePath)) {
+        const state = await fs.readJson(stateFilePath);
+        if (state.stateBucketSuffix) {
+            return state.stateBucketSuffix;
+        }
+    }
+    const suffix = generateSuffix();
+    await fs.writeJson(stateFilePath, { stateBucketSuffix: suffix }, { spaces: 2 });
+    return suffix;
+}
+function buildStateBucketName(projectName, suffix) {
+    return `${projectName}-infrastructure-tf-${suffix}`;
+}
+async function ensureStateBucket(credentials, bucketName) {
+    const client = new client_s3_1.S3Client({
+        region: credentials.AWS_REGION,
+        credentials: {
+            accessKeyId: credentials.AWS_ACCESS_KEY_ID,
+            secretAccessKey: credentials.AWS_SECRET_ACCESS_KEY,
+        },
+    });
+    try {
+        await client.send(new client_s3_1.HeadBucketCommand({ Bucket: bucketName }));
+        console.log(chalk_1.default.green(`  ✓ State bucket already exists: ${bucketName}`));
+        return;
+    }
+    catch (err) {
+        if (err.name !== 'NotFound' && err['$metadata']?.httpStatusCode !== 404) {
+            throw err;
+        }
+    }
+    console.log(chalk_1.default.cyan(`  Creating state bucket: ${bucketName}`));
+    await client.send(new client_s3_1.CreateBucketCommand({ Bucket: bucketName }));
+    await client.send(new client_s3_1.PutBucketVersioningCommand({
+        Bucket: bucketName,
+        VersioningConfiguration: { Status: 'Enabled' },
+    }));
+    console.log(chalk_1.default.green(`  ✓ State bucket created with versioning enabled`));
+}
+//# sourceMappingURL=s3-state-bucket.js.map

package/dist/infra/s3-state-bucket.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3-state-bucket.js","sourceRoot":"","sources":["../../src/infra/s3-state-bucket.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBA,gDAWC;AAED,oDAEC;AAED,8CA+BC;AAtED,kDAK2B;AAC3B,6CAA8B;AAC9B,2CAA4B;AAC5B,+CAAgC;AAChC,kDAAyB;AAGzB,MAAM,UAAU,GAAG,wBAAwB,CAAA;AAM3C,SAAS,cAAc;IACrB,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAC9C,CAAC;AAEM,KAAK,UAAU,kBAAkB,CAAC,WAAmB;IAC1D,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;IACxD,IAAI,MAAM,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACvC,MAAM,KAAK,GAAe,MAAM,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAA;QAC1D,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,iBAAiB,CAAA;QAChC,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,EAAE,CAAA;IAC/B,MAAM,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,iBAAiB,EAAE,MAAM,EAAgB,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;IAC7F,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAgB,oBAAoB,CAAC,WAAmB,EAAE,MAAc;IACtE,OAAO,GAAG,WAAW,sBAAsB,MAAM,EAAE,CAAA;AACrD,CAAC;AAEM,KAAK,UAAU,iBAAiB,CACrC,WAAwB,EACxB,UAAkB;IAElB,MAAM,MAAM,GAAG,IAAI,oBAAQ,CAAC;QAC1B,MAAM,EAAE,WAAW,CAAC,UAAU;QAC9B,WAAW,EAAE;YACX,WAAW,EAAE,WAAW,CAAC,iBAAiB;YAC1C,eAAe,EAAE,WAAW,CAAC,qBAAqB;SACnD;KACF,CAAC,CAAA;IAEF,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,6BAAiB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAA;QAChE,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,oCAAoC,UAAU,EAAE,CAAC,CAAC,CAAA;QAC1E,OAAM;IACR,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,IAAI,GAAG,CAAC,WAAW,CAAC,EAAE,cAAc,KAAK,GAAG,EAAE,CAAC;YACxE,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,4BAA4B,UAAU,EAAE,CAAC,CAAC,CAAA;IACjE,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,+BAAmB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAA;IAClE,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,sCAA0B,CAAC;QAC7B,MAAM,EAAE,UAAU;QAClB,uBAAuB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;KAC/C,CAAC,CACH,CAAA;IACD,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC,CAAA;AAC9E,CAAC"}

package/dist/infra/secrets-manager-client.d.ts

@@ -0,0 +1,3 @@
+import { Credentials } from './types';
+export declare function putSecret(credentials: Credentials, name: string, value: Record<string, unknown>): Promise<void>;
+//# sourceMappingURL=secrets-manager-client.d.ts.map

package/dist/infra/secrets-manager-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-manager-client.d.ts","sourceRoot":"","sources":["../../src/infra/secrets-manager-client.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAErC,wBAAsB,SAAS,CAC7B,WAAW,EAAE,WAAW,EACxB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC,IAAI,CAAC,CAoBf"}

package/dist/infra/secrets-manager-client.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.putSecret = putSecret;
+const client_secrets_manager_1 = require("@aws-sdk/client-secrets-manager");
+async function putSecret(credentials, name, value) {
+    const client = new client_secrets_manager_1.SecretsManagerClient({
+        region: credentials.AWS_REGION,
+        credentials: {
+            accessKeyId: credentials.AWS_ACCESS_KEY_ID,
+            secretAccessKey: credentials.AWS_SECRET_ACCESS_KEY,
+        },
+    });
+    const secretString = JSON.stringify(value);
+    try {
+        await client.send(new client_secrets_manager_1.CreateSecretCommand({ Name: name, SecretString: secretString }));
+    }
+    catch (e) {
+        if (e.name === 'ResourceExistsException') {
+            await client.send(new client_secrets_manager_1.PutSecretValueCommand({ SecretId: name, SecretString: secretString }));
+        }
+        else {
+            throw e;
+        }
+    }
+}
+//# sourceMappingURL=secrets-manager-client.js.map

package/dist/infra/secrets-manager-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-manager-client.js","sourceRoot":"","sources":["../../src/infra/secrets-manager-client.ts"],"names":[],"mappings":";;AAOA,8BAwBC;AA/BD,4EAIwC;AAGjC,KAAK,UAAU,SAAS,CAC7B,WAAwB,EACxB,IAAY,EACZ,KAA8B;IAE9B,MAAM,MAAM,GAAG,IAAI,6CAAoB,CAAC;QACtC,MAAM,EAAE,WAAW,CAAC,UAAU;QAC9B,WAAW,EAAE;YACX,WAAW,EAAE,WAAW,CAAC,iBAAiB;YAC1C,eAAe,EAAE,WAAW,CAAC,qBAAqB;SACnD;KACF,CAAC,CAAA;IAEF,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAE1C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,4CAAmB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC,CAAA;IACxF,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,IAAI,CAAC,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;YACzC,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,8CAAqB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC,CAAA;QAC9F,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,CAAA;QACT,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/infra/subprocess.d.ts

@@ -0,0 +1,5 @@
+export declare function spawnStreaming(args: string[], cwd: string, env?: Record<string, string>): Promise<{
+    code: number;
+    combined: string;
+}>;
+//# sourceMappingURL=subprocess.d.ts.map

package/dist/infra/subprocess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subprocess.d.ts","sourceRoot":"","sources":["../../src/infra/subprocess.ts"],"names":[],"mappings":"AAEA,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,EAAE,MAAM,EACX,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAwB7C"}

package/dist/infra/subprocess.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.spawnStreaming = spawnStreaming;
+const child_process_1 = require("child_process");
+function spawnStreaming(args, cwd, env) {
+    return new Promise((resolve) => {
+        const proc = (0, child_process_1.spawn)('tofu', args, {
+            stdio: ['ignore', 'pipe', 'pipe'],
+            cwd,
+            env: env ? { ...process.env, ...env } : undefined,
+        });
+        let combined = '';
+        proc.stdout.on('data', (chunk) => {
+            process.stdout.write(chunk);
+            combined += chunk.toString();
+        });
+        proc.stderr.on('data', (chunk) => {
+            process.stderr.write(chunk);
+            combined += chunk.toString();
+        });
+        proc.on('close', (code) => {
+            resolve({ code: code ?? 1, combined });
+        });
+    });
+}
+//# sourceMappingURL=subprocess.js.map

package/dist/infra/subprocess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subprocess.js","sourceRoot":"","sources":["../../src/infra/subprocess.ts"],"names":[],"mappings":";;AAEA,wCA4BC;AA9BD,iDAAqC;AAErC,SAAgB,cAAc,CAC5B,IAAc,EACd,GAAW,EACX,GAA4B;IAE5B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,IAAA,qBAAK,EAAC,MAAM,EAAE,IAAI,EAAE;YAC/B,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,GAAG;YACH,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS;SAClD,CAAC,CAAA;QAEF,IAAI,QAAQ,GAAG,EAAE,CAAA;QAEjB,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YAC3B,QAAQ,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAA;QAC9B,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YAC3B,QAAQ,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAA;QAC9B,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,EAAE;YACvC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;QACxC,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/infra/template-engine.d.ts

@@ -0,0 +1,43 @@
+import { InfraConfig, Credentials } from './types';
+/**
+ * Parse a .tfvars file content into a Record<string, string>.
+ * Handles lines in the format: key = "value"
+ */
+export declare function parseTfvars(content: string): Record<string, string>;
+/**
+ * Serialize a Record<string, string> into .tfvars format.
+ * Produces: key = "value"\n lines joined with newline, ending with newline.
+ */
+export declare function serializeTfvars(vars: Record<string, string>): string;
+/**
+ * Patch main.tf: replace all ../../modules references with ./modules.
+ */
+export declare function patchMainTf(infraRoot: string): Promise<void>;
+/**
+ * Patch backend.tf: replace {project_name}, {aws_region}, and {unique_suffix} placeholders.
+ */
+export declare function patchBackendTf(infraRoot: string, projectName: string, awsRegion: string, uniqueSuffix: string): Promise<void>;
+/**
+ * Patch default.tfvars: set project_name, aws_region, db_password from config and credentials.
+ */
+export declare function patchDefaultTfvars(infraRoot: string, config: InfraConfig, credentials: Credentials): Promise<void>;
+/**
+ * Prune modules not referenced in main.tf (after patching).
+ * Always keeps modules listed in MODULES_DONT_REMOVE (e.g., secret-main).
+ */
+export declare function pruneUnusedModules(infraRoot: string): Promise<void>;
+/**
+ * Copy GitHub Actions workflow files into <projectDir>/.github/workflows/.
+ * Replaces what Terraform's github_repository_file resources used to do.
+ */
+export declare function copyWorkflowFiles(projectDir: string, config: InfraConfig, infraSrcRoot: string): Promise<void>;
+/**
+ * Generate a self-contained /infra folder in targetRoot.
+ * Copies ECS templates and all Terraform modules, then patches and prunes.
+ *
+ * The fuel-infrastructure sibling path is resolved via:
+ *   - FUEL_INFRA_PATH env var (override for testing / CI)
+ *   - process.cwd()/../fuel-infrastructure (default monorepo layout)
+ */
+export declare function generateInfra(targetRoot: string, config: InfraConfig, credentials: Credentials): Promise<void>;
+//# sourceMappingURL=template-engine.d.ts.map

package/dist/infra/template-engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"template-engine.d.ts","sourceRoot":"","sources":["../../src/infra/template-engine.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAyBlD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAenE;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAMpE;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKlE;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,WAAW,EACnB,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,IAAI,CAAC,CAWf;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBzE;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,WAAW,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CA2Ef;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,WAAW,EACnB,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,IAAI,CAAC,CAyCf"}