@swovohq/fuel 0.2.0-alpha.3 → 0.2.0-alpha.30

package/dist/infra/config-writer.d.ts

@@ -1,9 +1,4 @@
-import { InfraConfig, Credentials } from './types';
-export interface FuelConfig extends InfraConfig {
-    seed: string;
-    aws_region?: string;
-    github_org?: string;
-}
+import { InfraConfig } from './types';
 export declare function generateSeed(): string;
-export declare function writeFuelConfig(projectRoot: string, config: InfraConfig, projectName?: string, existingSeed?: string, credentials?: Credentials): Promise<FuelConfig>;
+export declare function writeFuelYml(projectRoot: string, config: InfraConfig, projectName?: string): Promise<void>;
 //# sourceMappingURL=config-writer.d.ts.map

package/dist/infra/config-writer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-writer.d.ts","sourceRoot":"","sources":["../../src/infra/config-writer.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAElD,MAAM,WAAW,UAAW,SAAQ,WAAW;IAC7C,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,wBAAsB,eAAe,CACnC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,WAAW,EACnB,WAAW,CAAC,EAAE,MAAM,EACpB,YAAY,CAAC,EAAE,MAAM,EACrB,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,UAAU,CAAC,CAiBrB"}
+{"version":3,"file":"config-writer.d.ts","sourceRoot":"","sources":["../../src/infra/config-writer.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAErC,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,wBAAsB,YAAY,CAChC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,WAAW,EACnB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAUf"}

package/dist/infra/config-writer.js

@@ -34,25 +34,19 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.generateSeed = generateSeed;
-exports.writeFuelConfig = writeFuelConfig;
+exports.writeFuelYml = writeFuelYml;
 const fs = __importStar(require("fs-extra"));
 const path = __importStar(require("path"));
 const crypto = __importStar(require("crypto"));
+const YAML = __importStar(require("yaml"));
 function generateSeed() {
     return crypto.randomBytes(12).toString('hex'); // 24 hex chars
 }
-async function writeFuelConfig(projectRoot, config, projectName, existingSeed, credentials) {
-    const seed = existingSeed ?? generateSeed();
-    const fuelConfig = {
+async function writeFuelYml(projectRoot, config, projectName) {
+    const output = {
         ...config,
         ...(projectName ? { name: projectName } : {}),
-        seed,
-        ...(credentials ? {
-            aws_region: credentials.AWS_REGION,
-            github_org: credentials.GITHUB_ORGANIZATION,
-        } : {}),
     };
-    await fs.writeJson(path.join(projectRoot, 'fuel.config.json'), fuelConfig, { spaces: 2 });
-    return fuelConfig;
+    await fs.writeFile(path.join(projectRoot, 'fuel.yml'), YAML.stringify(output), 'utf-8');
 }
 //# sourceMappingURL=config-writer.js.map

package/dist/infra/config-writer.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-writer.js","sourceRoot":"","sources":["../../src/infra/config-writer.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,oCAEC;AAED,0CAuBC;AAtCD,6CAA8B;AAC9B,2CAA4B;AAC5B,+CAAgC;AAShC,SAAgB,YAAY;IAC1B,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA,CAAC,eAAe;AAC/D,CAAC;AAEM,KAAK,UAAU,eAAe,CACnC,WAAmB,EACnB,MAAmB,EACnB,WAAoB,EACpB,YAAqB,EACrB,WAAyB;IAEzB,MAAM,IAAI,GAAG,YAAY,IAAI,YAAY,EAAE,CAAA;IAC3C,MAAM,UAAU,GAAe;QAC7B,GAAG,MAAM;QACT,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,IAAI;QACJ,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;YAChB,UAAU,EAAE,WAAW,CAAC,UAAU;YAClC,UAAU,EAAE,WAAW,CAAC,mBAAmB;SAC5C,CAAC,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;IACD,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,EAC1C,UAAU,EACV,EAAE,MAAM,EAAE,CAAC,EAAE,CACd,CAAA;IACD,OAAO,UAAU,CAAA;AACnB,CAAC"}
+{"version":3,"file":"config-writer.js","sourceRoot":"","sources":["../../src/infra/config-writer.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAMA,oCAEC;AAED,oCAcC;AAxBD,6CAA8B;AAC9B,2CAA4B;AAC5B,+CAAgC;AAChC,2CAA4B;AAG5B,SAAgB,YAAY;IAC1B,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA,CAAC,eAAe;AAC/D,CAAC;AAEM,KAAK,UAAU,YAAY,CAChC,WAAmB,EACnB,MAAmB,EACnB,WAAoB;IAEpB,MAAM,MAAM,GAAgB;QAC1B,GAAG,MAAM;QACT,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAA;IACD,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,EAClC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EACtB,OAAO,CACR,CAAA;AACH,CAAC"}

package/dist/infra/credentials.d.ts

@@ -1,3 +1,11 @@
-import { Credentials } from './types';
-export declare function resolveCredentials(searchDir?: string): Promise<Credentials>;
+import { Credentials, CredentialKey } from './types';
+/**
+ * Resolve credentials by merging sources in priority order:
+ * 1. CLI flag overrides (highest)
+ * 2. .fuel-credentials file (searchDir, then CWD fallback)
+ * 3. Environment variables (lowest)
+ *
+ * Sources are merged per-key — e.g., AWS keys from env + GITHUB_TOKEN from file = valid.
+ */
+export declare function resolveCredentials(searchDir?: string, overrides?: Partial<Record<CredentialKey, string>>): Promise<Credentials>;
 //# sourceMappingURL=credentials.d.ts.map

package/dist/infra/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/infra/credentials.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAA2C,MAAM,SAAS,CAAA;AAe9E,wBAAsB,kBAAkB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAmCjF"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/infra/credentials.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAA4B,aAAa,EAAE,MAAM,SAAS,CAAA;AAgB9E;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,GACjD,OAAO,CAAC,WAAW,CAAC,CAkCtB"}

package/dist/infra/credentials.js

@@ -37,38 +37,57 @@ exports.resolveCredentials = resolveCredentials;
 const path = __importStar(require("path"));
 const fs = __importStar(require("fs-extra"));
 const types_1 = require("./types");
-async function readCredentialsFile(credPath) {
-    const file = await fs.readJson(credPath);
-    const missing = types_1.REQUIRED_CREDENTIAL_KEYS.filter((k) => !file[k]);
-    if (missing.length > 0) {
-        throw new Error(`Missing keys in .fuel-credentials: ${missing.join(', ')}`);
+async function tryReadCredentialsFile(credPath) {
+    if (!(await fs.pathExists(credPath)))
+        return {};
+    try {
+        const file = await fs.readJson(credPath);
+        const result = {};
+        for (const key of types_1.REQUIRED_CREDENTIAL_KEYS) {
+            if (file[key])
+                result[key] = file[key];
+        }
+        return result;
     }
-    return Object.fromEntries(types_1.REQUIRED_CREDENTIAL_KEYS.map((k) => [k, file[k]]));
-}
-async function resolveCredentials(searchDir) {
-    // Priority 1: ALL keys present in env
-    const envValues = types_1.REQUIRED_CREDENTIAL_KEYS.map((k) => process.env[k]);
-    if (envValues.every(Boolean)) {
-        return Object.fromEntries(types_1.REQUIRED_CREDENTIAL_KEYS.map((k, i) => [k, envValues[i]]));
+    catch {
+        return {};
     }
-    // Priority 2: .fuel-credentials JSON file in searchDir (or CWD if no searchDir)
+}
+/**
+ * Resolve credentials by merging sources in priority order:
+ * 1. CLI flag overrides (highest)
+ * 2. .fuel-credentials file (searchDir, then CWD fallback)
+ * 3. Environment variables (lowest)
+ *
+ * Sources are merged per-key — e.g., AWS keys from env + GITHUB_TOKEN from file = valid.
+ */
+async function resolveCredentials(searchDir, overrides) {
+    // Collect file values from searchDir and CWD
     const credPath = searchDir
         ? path.join(searchDir, '.fuel-credentials')
         : path.resolve('.fuel-credentials');
-    if (await fs.pathExists(credPath)) {
-        return readCredentialsFile(credPath);
-    }
-    // Priority 3: fallback to CWD when searchDir was provided and differs from CWD
+    const fileValues = await tryReadCredentialsFile(credPath);
+    // Fallback to CWD if searchDir was provided and differs
     const cwd = process.cwd();
+    let cwdValues = {};
     if (searchDir && path.resolve(searchDir) !== cwd) {
-        const cwdCredPath = path.resolve('.fuel-credentials');
-        if (await fs.pathExists(cwdCredPath)) {
-            return readCredentialsFile(cwdCredPath);
-        }
+        cwdValues = await tryReadCredentialsFile(path.resolve('.fuel-credentials'));
+    }
+    // Merge per-key: overrides → file (searchDir) → file (CWD) → env
+    const resolved = {};
+    for (const key of types_1.REQUIRED_CREDENTIAL_KEYS) {
+        resolved[key] =
+            overrides?.[key] ||
+                fileValues[key] ||
+                cwdValues[key] ||
+                process.env[key] ||
+                undefined;
+    }
+    const missing = types_1.REQUIRED_CREDENTIAL_KEYS.filter((k) => !resolved[k]);
+    if (missing.length > 0) {
+        throw new Error(`Missing credentials: ${missing.join(', ')}\n` +
+            `Provide them via CLI flags, .fuel-credentials file, or environment variables.`);
     }
-    // Neither source complete
-    const missingFromEnv = types_1.REQUIRED_CREDENTIAL_KEYS.filter((k) => !process.env[k]);
-    throw new Error(`Credentials not found. Missing env vars: ${missingFromEnv.join(', ')}\n` +
-        `Or create a .fuel-credentials JSON file with those keys.`);
+    return resolved;
 }
 //# sourceMappingURL=credentials.js.map

package/dist/infra/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/infra/credentials.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBA,gDAmCC;AApDD,2CAA4B;AAC5B,6CAA8B;AAC9B,mCAA8E;AAE9E,KAAK,UAAU,mBAAmB,CAAC,QAAgB;IACjD,MAAM,IAAI,GAA2B,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAChE,MAAM,OAAO,GAAG,gCAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IAChE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,sCAAsC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3D,CAAA;IACH,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CACvB,gCAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CACnC,CAAA;AAClB,CAAC;AAEM,KAAK,UAAU,kBAAkB,CAAC,SAAkB;IACzD,sCAAsC;IACtC,MAAM,SAAS,GAAG,gCAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IACrE,IAAI,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,WAAW,CACvB,gCAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAW,CAAC,CAAC,CACrD,CAAA;IAClB,CAAC;IAED,gFAAgF;IAChF,MAAM,QAAQ,GAAG,SAAS;QACxB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC;QAC3C,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAErC,IAAI,MAAM,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAA;IACtC,CAAC;IAED,+EAA+E;IAC/E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;IACzB,IAAI,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,GAAG,EAAE,CAAC;QACjD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAA;QACrD,IAAI,MAAM,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YACrC,OAAO,mBAAmB,CAAC,WAAW,CAAC,CAAA;QACzC,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,MAAM,cAAc,GAAG,gCAAwB,CAAC,MAAM,CACpD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CACvB,CAAA;IACD,MAAM,IAAI,KAAK,CACb,4CAA4C,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QACvE,0DAA0D,CAC7D,CAAA;AACH,CAAC"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/infra/credentials.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,gDAqCC;AA/DD,2CAA4B;AAC5B,6CAA8B;AAC9B,mCAA8E;AAE9E,KAAK,UAAU,sBAAsB,CAAC,QAAgB;IACpD,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,EAAE,CAAA;IAC/C,IAAI,CAAC;QACH,MAAM,IAAI,GAA2B,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAChE,MAAM,MAAM,GAA2C,EAAE,CAAA;QACzD,KAAK,MAAM,GAAG,IAAI,gCAAwB,EAAE,CAAC;YAC3C,IAAI,IAAI,CAAC,GAAG,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAA;QACxC,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,kBAAkB,CACtC,SAAkB,EAClB,SAAkD;IAElD,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,SAAS;QACxB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC;QAC3C,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAA;IACrC,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAA;IAEzD,wDAAwD;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;IACzB,IAAI,SAAS,GAA2C,EAAE,CAAA;IAC1D,IAAI,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,GAAG,EAAE,CAAC;QACjD,SAAS,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAA;IAC7E,CAAC;IAED,iEAAiE;IACjE,MAAM,QAAQ,GAA2C,EAAE,CAAA;IAC3D,KAAK,MAAM,GAAG,IAAI,gCAAwB,EAAE,CAAC;QAC3C,QAAQ,CAAC,GAAG,CAAC;YACX,SAAS,EAAE,CAAC,GAAG,CAAC;gBAChB,UAAU,CAAC,GAAG,CAAC;gBACf,SAAS,CAAC,GAAG,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;gBAChB,SAAS,CAAA;IACb,CAAC;IAED,MAAM,OAAO,GAAG,gCAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IACpE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,wBAAwB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC5C,+EAA+E,CAClF,CAAA;IACH,CAAC;IAED,OAAO,QAAuB,CAAA;AAChC,CAAC"}

package/dist/infra/git-client.d.ts

@@ -1,2 +1,4 @@
 export declare function wireGitRemote(projectDir: string, repoUrl: string): Promise<void>;
+export declare function commitAll(projectDir: string, message: string): Promise<boolean>;
+export declare function pushToRemote(projectDir: string, githubToken: string, branches: string[], forcePush?: boolean): Promise<void>;
 //# sourceMappingURL=git-client.d.ts.map

package/dist/infra/git-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git-client.d.ts","sourceRoot":"","sources":["../../src/infra/git-client.ts"],"names":[],"mappings":"AAeA,wBAAsB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUtF"}
+{"version":3,"file":"git-client.d.ts","sourceRoot":"","sources":["../../src/infra/git-client.ts"],"names":[],"mappings":"AAgCA,wBAAsB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWtF;AAED,wBAAsB,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAarF;AAED,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAAE,EAClB,SAAS,CAAC,EAAE,OAAO,GAClB,OAAO,CAAC,IAAI,CAAC,CAoCf"}

package/dist/infra/git-client.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.wireGitRemote = wireGitRemote;
+exports.commitAll = commitAll;
+exports.pushToRemote = pushToRemote;
 const child_process_1 = require("child_process");
 function spawnSimple(cmd, args, cwd) {
     return new Promise((resolve) => {
@@ -10,13 +12,65 @@ function spawnSimple(cmd, args, cwd) {
         });
     });
 }
+function spawnQuiet(cmd, args, cwd) {
+    return new Promise((resolve) => {
+        const proc = (0, child_process_1.spawn)(cmd, args, { cwd, stdio: ['pipe', 'pipe', 'pipe'] });
+        let stdout = '';
+        proc.stdout.on('data', (chunk) => {
+            stdout += chunk.toString();
+        });
+        proc.on('close', (code) => {
+            resolve({ code: code ?? 1, stdout: stdout.trim() });
+        });
+    });
+}
 async function wireGitRemote(projectDir, repoUrl) {
-    const setUrlResult = await spawnSimple('git', ['remote', 'set-url', 'origin', repoUrl], projectDir);
+    // Try set-url quietly — it fails if origin doesn't exist yet
+    const setUrlResult = await spawnQuiet('git', ['remote', 'set-url', 'origin', repoUrl], projectDir);
     if (setUrlResult.code !== 0) {
-        const addResult = await spawnSimple('git', ['remote', 'add', 'origin', repoUrl], projectDir);
+        const addResult = await spawnQuiet('git', ['remote', 'add', 'origin', repoUrl], projectDir);
         if (addResult.code !== 0) {
             throw new Error(`Failed to set git remote origin to ${repoUrl}`);
         }
     }
 }
+async function commitAll(projectDir, message) {
+    await spawnSimple('git', ['add', '-A'], projectDir);
+    const diffResult = await spawnQuiet('git', ['diff', '--cached', '--quiet'], projectDir);
+    if (diffResult.code === 0) {
+        return false;
+    }
+    const commitResult = await spawnSimple('git', ['commit', '-m', message], projectDir);
+    if (commitResult.code !== 0) {
+        throw new Error(`Failed to commit: ${message}`);
+    }
+    return true;
+}
+async function pushToRemote(projectDir, githubToken, branches, forcePush) {
+    const { stdout: originalUrl } = await spawnQuiet('git', ['remote', 'get-url', 'origin'], projectDir);
+    const authUrl = originalUrl.replace('https://github.com/', `https://x-access-token:${githubToken}@github.com/`);
+    await spawnSimple('git', ['remote', 'set-url', 'origin', authUrl], projectDir);
+    try {
+        for (const branch of branches) {
+            // Create local branch if it doesn't exist (non-main branches)
+            const branchCheck = await spawnQuiet('git', ['rev-parse', '--verify', branch], projectDir);
+            if (branchCheck.code !== 0) {
+                const createResult = await spawnSimple('git', ['branch', branch], projectDir);
+                if (createResult.code !== 0) {
+                    throw new Error(`Failed to create local branch: ${branch}`);
+                }
+            }
+            const pushArgs = forcePush
+                ? ['push', '--force', '-u', 'origin', branch]
+                : ['push', '-u', 'origin', branch];
+            const pushResult = await spawnSimple('git', pushArgs, projectDir);
+            if (pushResult.code !== 0) {
+                throw new Error(`Failed to push branch: ${branch}`);
+            }
+        }
+    }
+    finally {
+        await spawnSimple('git', ['remote', 'set-url', 'origin', originalUrl], projectDir);
+    }
+}
 //# sourceMappingURL=git-client.js.map

package/dist/infra/git-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"git-client.js","sourceRoot":"","sources":["../../src/infra/git-client.ts"],"names":[],"mappings":";;AAeA,sCAUC;AAzBD,iDAAqC;AAErC,SAAS,WAAW,CAClB,GAAW,EACX,IAAc,EACd,GAAW;IAEX,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,IAAA,qBAAK,EAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,EAAE;YACvC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAA;QAC9B,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAEM,KAAK,UAAU,aAAa,CAAC,UAAkB,EAAE,OAAe;IACrE,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,CAAA;IAEnG,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,CAAA;QAE5F,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,sCAAsC,OAAO,EAAE,CAAC,CAAA;QAClE,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"git-client.js","sourceRoot":"","sources":["../../src/infra/git-client.ts"],"names":[],"mappings":";;AAgCA,sCAWC;AAED,8BAaC;AAED,oCAyCC;AArGD,iDAAqC;AAErC,SAAS,WAAW,CAClB,GAAW,EACX,IAAc,EACd,GAAW;IAEX,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,IAAA,qBAAK,EAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,EAAE;YACvC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAA;QAC9B,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,UAAU,CACjB,GAAW,EACX,IAAc,EACd,GAAW;IAEX,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,IAAA,qBAAK,EAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QACvE,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACvC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAA;QAC5B,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,EAAE;YACvC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QACrD,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAEM,KAAK,UAAU,aAAa,CAAC,UAAkB,EAAE,OAAe;IACrE,6DAA6D;IAC7D,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,CAAA;IAElG,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,CAAA;QAE3F,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,sCAAsC,OAAO,EAAE,CAAC,CAAA;QAClE,CAAC;IACH,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,SAAS,CAAC,UAAkB,EAAE,OAAe;IACjE,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,UAAU,CAAC,CAAA;IAEnD,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,UAAU,CAAC,CAAA;IACvF,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,CAAA;IACpF,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAA;IACjD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAEM,KAAK,UAAU,YAAY,CAChC,UAAkB,EAClB,WAAmB,EACnB,QAAkB,EAClB,SAAmB;IAEnB,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,UAAU,CAC9C,KAAK,EACL,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAC/B,UAAU,CACX,CAAA;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CACjC,qBAAqB,EACrB,0BAA0B,WAAW,cAAc,CACpD,CAAA;IAED,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,CAAA;IAE9E,IAAI,CAAC;QACH,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;YAC9B,8DAA8D;YAC9D,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,CAAA;YAC1F,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBAC3B,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,CAAA;gBAC7E,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;oBAC5B,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,EAAE,CAAC,CAAA;gBAC7D,CAAC;YACH,CAAC;YAED,MAAM,QAAQ,GAAG,SAAS;gBACxB,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC;gBAC7C,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;YACpC,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAA;YACjE,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,EAAE,CAAC,CAAA;YACrD,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,UAAU,CAAC,CAAA;IACpF,CAAC;AACH,CAAC"}

package/dist/infra/github-client.d.ts

@@ -0,0 +1,6 @@
+export declare function createGitHubRepo(token: string, org: string, name: string): Promise<{
+    name: string;
+    htmlUrl: string;
+}>;
+export declare function setBranchProtection(token: string, owner: string, repo: string, branch: string): Promise<void>;
+//# sourceMappingURL=github-client.d.ts.map

package/dist/infra/github-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-client.d.ts","sourceRoot":"","sources":["../../src/infra/github-client.ts"],"names":[],"mappings":"AAEA,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAY5C;AAED,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAmBf"}

package/dist/infra/github-client.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createGitHubRepo = createGitHubRepo;
+exports.setBranchProtection = setBranchProtection;
+const rest_1 = require("@octokit/rest");
+async function createGitHubRepo(token, org, name) {
+    const octokit = new rest_1.Octokit({ auth: token });
+    const { data } = await octokit.rest.repos.createInOrg({
+        org,
+        name,
+        auto_init: false,
+        visibility: 'private',
+        description: 'FUEL Monorepo — generated by Fuel CLI',
+    });
+    return { name: data.name, htmlUrl: data.html_url };
+}
+async function setBranchProtection(token, owner, repo, branch) {
+    const octokit = new rest_1.Octokit({ auth: token });
+    await octokit.rest.repos.updateBranchProtection({
+        owner,
+        repo,
+        branch,
+        enforce_admins: false,
+        required_pull_request_reviews: {
+            required_approving_review_count: 1,
+            dismiss_stale_reviews: true,
+        },
+        required_status_checks: {
+            strict: true,
+            contexts: ['Title matches Jira Issue'],
+        },
+        restrictions: null,
+        allow_deletions: false,
+    });
+}
+//# sourceMappingURL=github-client.js.map

package/dist/infra/github-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-client.js","sourceRoot":"","sources":["../../src/infra/github-client.ts"],"names":[],"mappings":";;AAEA,4CAgBC;AAED,kDAwBC;AA5CD,wCAAuC;AAEhC,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,GAAW,EACX,IAAY;IAEZ,MAAM,OAAO,GAAG,IAAI,cAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAE5C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;QACpD,GAAG;QACH,IAAI;QACJ,SAAS,EAAE,KAAK;QAChB,UAAU,EAAE,SAAS;QACrB,WAAW,EAAE,uCAAuC;KACrD,CAAC,CAAA;IAEF,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAA;AACpD,CAAC;AAEM,KAAK,UAAU,mBAAmB,CACvC,KAAa,EACb,KAAa,EACb,IAAY,EACZ,MAAc;IAEd,MAAM,OAAO,GAAG,IAAI,cAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAE5C,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC;QAC9C,KAAK;QACL,IAAI;QACJ,MAAM;QACN,cAAc,EAAE,KAAK;QACrB,6BAA6B,EAAE;YAC7B,+BAA+B,EAAE,CAAC;YAClC,qBAAqB,EAAE,IAAI;SAC5B;QACD,sBAAsB,EAAE;YACtB,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,CAAC,0BAA0B,CAAC;SACvC;QACD,YAAY,EAAE,IAAI;QAClB,eAAe,EAAE,KAAK;KACvB,CAAC,CAAA;AACJ,CAAC"}

package/dist/infra/orchestrator.d.ts

@@ -1,7 +1,10 @@
 import { InfraConfig, Credentials } from './types';
 export interface OrchestratorOptions {
-    skipCompensation?: boolean;
+    destroyOnFailure?: boolean;
     planOnly?: boolean;
+    targetBranch?: string;
+    forcePush?: boolean;
+    skipBranchProtection?: boolean;
 }
-export declare function runInfraOrchestrator(targetRoot: string, appName: string, config: InfraConfig, credentials: Credentials, options?: OrchestratorOptions): Promise<void>;
+export declare function runInfraOrchestrator(targetRoot: string, _appName: string, config: InfraConfig, credentials: Credentials, options?: OrchestratorOptions): Promise<void>;
 //# sourceMappingURL=orchestrator.d.ts.map

package/dist/infra/orchestrator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orchestrator.d.ts","sourceRoot":"","sources":["../../src/infra/orchestrator.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AA8FlD,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,WAAW,EACnB,WAAW,EAAE,WAAW,EACxB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,IAAI,CAAC,CA8Ef"}
+{"version":3,"file":"orchestrator.d.ts","sourceRoot":"","sources":["../../src/infra/orchestrator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAqDlD,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,WAAW,EACnB,WAAW,EAAE,WAAW,EACxB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,IAAI,CAAC,CA0Jf"}

package/dist/infra/orchestrator.js

@@ -37,48 +37,22 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runInfraOrchestrator = runInfraOrchestrator;
-const crypto = __importStar(require("crypto"));
-const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const chalk_1 = __importDefault(require("chalk"));
 const tofu_runner_1 = require("./tofu-runner");
 const secrets_manager_client_1 = require("./secrets-manager-client");
+const config_writer_1 = require("./config-writer");
 const git_client_1 = require("./git-client");
+const github_client_1 = require("./github-client");
+const github_secrets_client_1 = require("./github-secrets-client");
 const subprocess_1 = require("./subprocess");
 const s3_state_bucket_1 = require("./s3-state-bucket");
 function slugify(name) {
     return name.replace(/[^a-z0-9]/gi, '_').toLowerCase();
 }
-function buildDestroyArgs(completedPasses, credentials, tofuVars) {
-    const targets = [];
-    if (completedPasses.includes(1)) {
-        targets.push('-target=module.ecr', '-target=module.github_repo');
-    }
-    if (completedPasses.includes(2)) {
-        targets.push('-target=module.github_actions');
-    }
-    return [
-        'destroy',
-        '-var-file=default.tfvars',
-        '-auto-approve',
-        `-var=github_token=${credentials.GITHUB_TOKEN}`,
-        `-var=github_username=${credentials.GITHUB_USERNAME}`,
-        `-var=aws_access_key_id=${credentials.AWS_ACCESS_KEY_ID}`,
-        `-var=aws_secret_access_key=${credentials.AWS_SECRET_ACCESS_KEY}`,
-        `-var=aws_region=${credentials.AWS_REGION}`,
-        `-var=github_organization=${credentials.GITHUB_ORGANIZATION}`,
-        `-var=db_password=${tofuVars.db_password}`,
-        `-var=db_username=${tofuVars.db_username}`,
-        `-var=db_name=${tofuVars.db_name}`,
-        `-var=skip_ecs=true`,
-        ...targets,
-    ];
-}
-async function runCompensation(infraDir, credentials, tofuVars, completedPasses) {
-    if (completedPasses.length === 0)
-        return;
-    console.log(chalk_1.default.red('\n--- Cleaning up partial resources ---'));
-    const args = buildDestroyArgs(completedPasses, credentials, tofuVars);
+async function runCompensation(infraDir, credentials, tofuVars) {
+    console.log(chalk_1.default.red('\n--- Cleaning up AWS resources ---'));
+    const args = (0, tofu_runner_1.buildDestroyArgs)(credentials, tofuVars);
     const awsEnv = {
         AWS_ACCESS_KEY_ID: credentials.AWS_ACCESS_KEY_ID,
         AWS_SECRET_ACCESS_KEY: credentials.AWS_SECRET_ACCESS_KEY,
@@ -86,19 +60,12 @@ async function runCompensation(infraDir, credentials, tofuVars, completedPasses)
     };
     const { code } = await (0, subprocess_1.spawnStreaming)(args, infraDir, awsEnv);
     if (code !== 0) {
-        console.error(chalk_1.default.red('Compensation destroy failed. Manually delete these resources:'));
-        if (completedPasses.includes(1)) {
-            console.error(chalk_1.default.red('  - ECR repository (module.ecr)'));
-            console.error(chalk_1.default.red('  - GitHub repository (module.github_repo)'));
-        }
-        if (completedPasses.includes(2)) {
-            console.error(chalk_1.default.red('  - GitHub Actions config (module.github_actions)'));
-        }
+        console.error(chalk_1.default.red('Compensation destroy failed. Manually delete AWS resources.'));
         process.exit(1);
     }
-    console.log(chalk_1.default.green('Partial resources cleaned up'));
+    console.log(chalk_1.default.green('AWS resources cleaned up'));
 }
-function printOutputTable(albDns, ecrUrl, githubRepoUrl, dbUsername, dbPassword) {
+function printOutputTable(albDns, ecrUrl, githubRepoUrl) {
     const divider = chalk_1.default.gray('─'.repeat(60));
     console.log('\n' + divider);
     console.log(chalk_1.default.bold('  Deployment Complete'));
@@ -106,76 +73,137 @@ function printOutputTable(albDns, ecrUrl, githubRepoUrl, dbUsername, dbPassword)
     console.log(`  ${chalk_1.default.dim('ALB DNS')}          ${albDns}`);
     console.log(`  ${chalk_1.default.dim('ECR URL')}          ${ecrUrl}`);
     console.log(`  ${chalk_1.default.dim('GitHub Repo')}      ${githubRepoUrl}`);
-    console.log(`  ${chalk_1.default.dim('DB Username')}      ${dbUsername}`);
-    console.log(`  ${chalk_1.default.dim('DB Password')}      ${dbPassword}  ${chalk_1.default.yellow("Save these — they won't be shown again")}`);
     console.log(divider);
     console.log(chalk_1.default.cyan('\n  Next steps:'));
-    console.log('  Push to main to trigger your first deploy.\n');
+    console.log('  Your code has been pushed. Your first deploy will start shortly.\n');
 }
-async function runInfraOrchestrator(targetRoot, appName, config, credentials, options) {
+async function runInfraOrchestrator(targetRoot, _appName, config, credentials, options) {
     const infraDir = path.join(targetRoot, 'infra');
+    const repoName = `${config.name}-monorepo`;
     // Generate TofuVars
     const tofuVars = {
-        db_password: crypto.randomBytes(32).toString('hex'),
         db_username: slugify(config.name),
         db_name: slugify(config.name),
+        github_repo_name: repoName,
     };
     // Ensure S3 state bucket exists (before Tofu init)
     console.log(chalk_1.default.cyan('--- Ensuring state bucket exists ---'));
-    const suffix = await (0, s3_state_bucket_1.loadOrCreateSuffix)(targetRoot);
+    const suffix = (0, s3_state_bucket_1.deriveSuffix)(config.name);
     const bucketName = (0, s3_state_bucket_1.buildStateBucketName)(config.name, suffix);
     await (0, s3_state_bucket_1.ensureStateBucket)(credentials, bucketName);
     // Write secret to AWS Secrets Manager (before Tofu — Tofu reads it via data.tf)
     const secretName = `${config.name}-infrastructure-variables`;
-    const fuelConfigPath = path.join(targetRoot, 'fuel.config.json');
-    const fuelConfigContents = JSON.parse(fs.readFileSync(fuelConfigPath, 'utf-8'));
+    const secretPayload = {
+        ...config,
+        seed: (0, config_writer_1.generateSeed)(),
+        aws_region: credentials.AWS_REGION,
+        github_org: credentials.GITHUB_ORGANIZATION,
+    };
     console.log(chalk_1.default.cyan('--- Writing infrastructure secret ---'));
-    await (0, secrets_manager_client_1.putSecret)(credentials, secretName, fuelConfigContents);
+    await (0, secrets_manager_client_1.putSecret)(credentials, secretName, secretPayload);
     console.log(chalk_1.default.green('Secret written to AWS Secrets Manager'));
     // SIGINT compensation setup
-    const state = { tofuStarted: false, completedPasses: [] };
+    const state = { tofuStarted: false };
     const sigintHandler = async () => {
-        if (options?.skipCompensation) {
-            console.log(chalk_1.default.yellow('\nInterrupted — partial resources preserved.'));
-            console.log(chalk_1.default.yellow('Re-run "fuel infra:deploy" to resume.\n'));
-        }
-        else {
+        if (options?.destroyOnFailure) {
             console.log(chalk_1.default.yellow('\nInterrupted — running compensation...'));
-            if (state.tofuStarted && state.completedPasses.length > 0) {
-                await runCompensation(infraDir, credentials, tofuVars, state.completedPasses);
+            if (state.tofuStarted) {
+                await runCompensation(infraDir, credentials, tofuVars);
             }
         }
+        else {
+            console.log(chalk_1.default.yellow('\nInterrupted — partial resources preserved.'));
+            console.log(chalk_1.default.yellow('Re-run "fuel infra:deploy" to resume.\n'));
+        }
         process.exit(1);
     };
     process.once('SIGINT', sigintHandler);
     try {
-        // Run Tofu three-pass sequence
+        // Step 1: Create GitHub repo (skip in plan-only mode)
+        if (!options?.planOnly) {
+            console.log(chalk_1.default.cyan('--- Creating GitHub repository ---'));
+            try {
+                await (0, github_client_1.createGitHubRepo)(credentials.GITHUB_TOKEN, credentials.GITHUB_ORGANIZATION, repoName);
+                console.log(chalk_1.default.green(`✓ Repository created: ${credentials.GITHUB_ORGANIZATION}/${repoName}`));
+            }
+            catch (err) {
+                // If repo already exists (422), continue — it may be a re-run
+                if (err?.status === 422) {
+                    console.log(chalk_1.default.yellow(`Repository ${credentials.GITHUB_ORGANIZATION}/${repoName} already exists, continuing...`));
+                }
+                else {
+                    throw err;
+                }
+            }
+        }
+        // Step 2: Single Tofu apply (all AWS resources)
         state.tofuStarted = true;
-        const result = await (0, tofu_runner_1.runTofuSequence)(infraDir, credentials, tofuVars, {
+        const result = await (0, tofu_runner_1.runTofuApply)(infraDir, credentials, tofuVars, {
             planOnly: options?.planOnly,
         });
-        state.completedPasses = result.completedPasses;
         if (options?.planOnly) {
             console.log(chalk_1.default.green('\n  Plan complete — no resources were created.\n'));
             return;
         }
-        // Wire git remote
+        // Step 3: Set GitHub Actions secrets
+        console.log(chalk_1.default.cyan('--- Setting GitHub Actions secrets ---'));
+        const roleArn = result.outputs['oidc_role_arn'].value;
+        const secrets = {
+            AWS_REGION: credentials.AWS_REGION,
+            AWS_ROLE_ARN: roleArn,
+            PROJECT_NAME: config.name,
+        };
+        await (0, github_secrets_client_1.setRepoSecrets)(credentials.GITHUB_TOKEN, credentials.GITHUB_ORGANIZATION, repoName, secrets);
+        console.log(chalk_1.default.green('✓ GitHub Actions secrets configured'));
+        // Step 4: Push code
         const githubRepoUrl = result.outputs['github_http_repo_url'].value;
         await (0, git_client_1.wireGitRemote)(targetRoot, githubRepoUrl);
         console.log(chalk_1.default.green('Git remote origin set'));
+        const committed = await (0, git_client_1.commitAll)(targetRoot, 'Add infrastructure configuration');
+        if (committed) {
+            console.log(chalk_1.default.green('Infrastructure files committed'));
+        }
+        const allBranches = [...new Set(config.apps.map(app => app.branch))];
+        const branches = options?.targetBranch
+            ? allBranches.filter(b => b === options.targetBranch)
+            : allBranches;
+        try {
+            await (0, git_client_1.pushToRemote)(targetRoot, credentials.GITHUB_TOKEN, branches, options?.forcePush);
+            console.log(chalk_1.default.green(`Code pushed to: ${branches.join(', ')}`));
+        }
+        catch {
+            console.log(chalk_1.default.yellow(`Warning: automatic push failed. Push manually: git push -u origin ${branches.join(' ')}`));
+        }
+        // Step 5: Branch protections
+        if (!options?.skipBranchProtection) {
+            console.log(chalk_1.default.cyan('--- Applying branch protections ---'));
+            for (const branch of branches) {
+                try {
+                    await (0, github_client_1.setBranchProtection)(credentials.GITHUB_TOKEN, credentials.GITHUB_ORGANIZATION, repoName, branch);
+                    console.log(chalk_1.default.green(`✓ Branch protection set for: ${branch}`));
+                }
+                catch {
+                    console.log(chalk_1.default.yellow(`Warning: could not set branch protection for ${branch}`));
+                }
+            }
+        }
+        else {
+            console.log(chalk_1.default.yellow('--- Skipping branch protections (--skip-branch-protection) ---'));
+        }
         // Print output table
         const albDns = result.outputs['alb_dns'].value;
         const ecrUrl = result.outputs['ecr_url'].value;
-        printOutputTable(albDns, ecrUrl, githubRepoUrl, tofuVars.db_username, tofuVars.db_password);
+        printOutputTable(albDns, ecrUrl, githubRepoUrl);
     }
     catch (err) {
-        if (err instanceof tofu_runner_1.TofuPassError) {
-            if (options?.skipCompensation) {
+        if (err instanceof tofu_runner_1.TofuApplyError) {
+            if (options?.destroyOnFailure) {
+                await runCompensation(infraDir, credentials, tofuVars);
+            }
+            else {
                 console.log(chalk_1.default.yellow('\n  Partial resources preserved. Fix the issue and re-run:'));
                 console.log(chalk_1.default.yellow('    fuel infra:deploy\n'));
-                process.exit(1);
             }
-            await runCompensation(infraDir, credentials, tofuVars, err.completedPasses);
             process.exit(1);
         }
         throw err;