@swovohq/fuel 0.2.2-alpha.87 → 0.2.2-alpha.89

package/dist/infra/azure-state-storage.js

@@ -0,0 +1,229 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STATE_CONTAINER_NAME = exports.deriveSuffix = void 0;
+exports.buildResourceGroupName = buildResourceGroupName;
+exports.buildStateStorageAccountName = buildStateStorageAccountName;
+exports.buildKeyVaultName = buildKeyVaultName;
+exports.waitForDns = waitForDns;
+exports.ensureResourceGroup = ensureResourceGroup;
+exports.ensureStateStorage = ensureStateStorage;
+exports.ensureBootstrapKeyVault = ensureBootstrapKeyVault;
+const https = __importStar(require("https"));
+const dns = __importStar(require("dns"));
+const chalk_1 = __importDefault(require("chalk"));
+const identity_1 = require("@azure/identity");
+const arm_resources_1 = require("@azure/arm-resources");
+const arm_storage_1 = require("@azure/arm-storage");
+const arm_keyvault_1 = require("@azure/arm-keyvault");
+const storage_blob_1 = require("@azure/storage-blob");
+const s3_state_bucket_1 = require("./s3-state-bucket");
+Object.defineProperty(exports, "deriveSuffix", { enumerable: true, get: function () { return s3_state_bucket_1.deriveSuffix; } });
+function slugify(name) {
+    return name.replace(/[^a-z0-9]/gi, '').toLowerCase();
+}
+function buildResourceGroupName(projectName) {
+    return `${projectName}-rg`.replace(/[^a-zA-Z0-9-_.()]/g, '-');
+}
+function buildStateStorageAccountName(projectName, suffix) {
+    const safeSuffix = slugify(suffix).slice(-8);
+    const base = slugify(projectName).slice(0, 24 - 2 - safeSuffix.length) || 'app';
+    return `st${base}${safeSuffix}`;
+}
+function buildKeyVaultName(projectName, suffix) {
+    const safeSuffix = slugify(suffix).slice(-8);
+    const base = slugify(projectName).slice(0, 24 - 3 - 1 - safeSuffix.length) || 'app';
+    return `kv-${base}-${safeSuffix}`;
+}
+exports.STATE_CONTAINER_NAME = 'tfstate';
+function credential(credentials) {
+    return new identity_1.ClientSecretCredential(credentials.AZURE_TENANT_ID, credentials.AZURE_CLIENT_ID, credentials.AZURE_CLIENT_SECRET);
+}
+function isNotFound(err) {
+    return err?.statusCode === 404 || err?.code === 'ResourceNotFound';
+}
+/**
+ * Polls DNS until `hostname` resolves. A freshly-created Azure PaaS resource (Key Vault,
+ * Storage Account, ...) is reported "Succeeded" by the ARM control plane before its public
+ * DNS record has actually propagated — an immediate follow-up call can fail with ENOTFOUND
+ * even though the resource exists. Only needed right after creating a new resource.
+ */
+async function waitForDns(hostname, timeoutMs = 60_000, intervalMs = 3_000) {
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+        try {
+            await dns.promises.lookup(hostname);
+            return;
+        }
+        catch {
+            if (Date.now() >= deadline)
+                return; // give up silently — the caller's own request will surface the real error
+            await new Promise((resolve) => setTimeout(resolve, intervalMs));
+        }
+    }
+}
+/** Looks up the AAD object ID for the service principal identified by AZURE_CLIENT_ID, via Microsoft Graph. */
+async function getServicePrincipalObjectId(cred, clientId) {
+    const token = await cred.getToken('https://graph.microsoft.com/.default');
+    const url = `https://graph.microsoft.com/v1.0/servicePrincipals?$filter=appId eq '${clientId}'`;
+    const body = await new Promise((resolve, reject) => {
+        const req = https.get(url, { headers: { Authorization: `Bearer ${token.token}` } }, (res) => {
+            let data = '';
+            res.on('data', (chunk) => (data += chunk));
+            res.on('end', () => resolve(data));
+        });
+        req.on('error', reject);
+    });
+    const parsed = JSON.parse(body);
+    if (!parsed.value || parsed.value.length === 0) {
+        throw new Error(`Could not resolve service principal object ID for AZURE_CLIENT_ID=${clientId}: ${parsed.error?.message ?? 'not found'}`);
+    }
+    return parsed.value[0].id;
+}
+async function ensureResourceGroup(credentials, resourceGroupName, location) {
+    const client = new arm_resources_1.ResourceManagementClient(credential(credentials), credentials.AZURE_SUBSCRIPTION_ID);
+    // checkExistence resolves to { body: boolean }, not a plain boolean — the object itself is always truthy.
+    const { body: exists } = await client.resourceGroups.checkExistence(resourceGroupName);
+    if (exists) {
+        console.log(chalk_1.default.green(`  ✓ Resource group already exists: ${resourceGroupName}`));
+        return;
+    }
+    console.log(chalk_1.default.cyan(`  Creating resource group: ${resourceGroupName}`));
+    await client.resourceGroups.createOrUpdate(resourceGroupName, { location });
+    console.log(chalk_1.default.green('  ✓ Resource group created'));
+}
+/** Ensures the storage account + blob container backing the `azurerm` Tofu state backend exist. */
+async function ensureStateStorage(credentials, resourceGroupName, storageAccountName, location, containerName = exports.STATE_CONTAINER_NAME) {
+    const cred = credential(credentials);
+    const storageClient = new arm_storage_1.StorageManagementClient(cred, credentials.AZURE_SUBSCRIPTION_ID);
+    let exists = true;
+    try {
+        await storageClient.storageAccounts.getProperties(resourceGroupName, storageAccountName);
+    }
+    catch (err) {
+        if (!isNotFound(err)) {
+            throw new Error(`Failed to check state storage account "${storageAccountName}": ${err.message || err}`);
+        }
+        exists = false;
+    }
+    if (!exists) {
+        console.log(chalk_1.default.cyan(`  Creating state storage account: ${storageAccountName}`));
+        const poller = await storageClient.storageAccounts.beginCreate(resourceGroupName, storageAccountName, {
+            location,
+            sku: { name: 'Standard_LRS' },
+            kind: 'StorageV2',
+            allowBlobPublicAccess: false,
+            minimumTlsVersion: 'TLS1_2',
+        });
+        await poller.pollUntilDone();
+        await waitForDns(`${storageAccountName}.blob.core.windows.net`);
+        console.log(chalk_1.default.green('  ✓ State storage account created'));
+    }
+    else {
+        console.log(chalk_1.default.green(`  ✓ State storage account already exists: ${storageAccountName}`));
+    }
+    const keys = await storageClient.storageAccounts.listKeys(resourceGroupName, storageAccountName);
+    const key = keys.keys?.[0]?.value;
+    if (!key) {
+        throw new Error(`Could not retrieve an access key for storage account "${storageAccountName}"`);
+    }
+    const blobServiceClient = new storage_blob_1.BlobServiceClient(`https://${storageAccountName}.blob.core.windows.net`, new storage_blob_1.StorageSharedKeyCredential(storageAccountName, key));
+    const containerClient = blobServiceClient.getContainerClient(containerName);
+    if (await containerClient.exists()) {
+        console.log(chalk_1.default.green(`  ✓ State container already exists: ${containerName}`));
+    }
+    else {
+        console.log(chalk_1.default.cyan(`  Creating state container: ${containerName}`));
+        await containerClient.create();
+        console.log(chalk_1.default.green('  ✓ State container created'));
+    }
+}
+/** Ensures the Key Vault that stores the fuel.yml infrastructure secret exists and grants the CLI's SP access to it. */
+async function ensureBootstrapKeyVault(credentials, resourceGroupName, keyVaultName, location) {
+    const cred = credential(credentials);
+    const client = new arm_keyvault_1.KeyVaultManagementClient(cred, credentials.AZURE_SUBSCRIPTION_ID);
+    let exists = true;
+    try {
+        await client.vaults.get(resourceGroupName, keyVaultName);
+    }
+    catch (err) {
+        if (!isNotFound(err)) {
+            throw new Error(`Failed to check Key Vault "${keyVaultName}": ${err.message || err}`);
+        }
+        exists = false;
+    }
+    const objectId = await getServicePrincipalObjectId(cred, credentials.AZURE_CLIENT_ID);
+    if (exists) {
+        // A vault created outside this flow (or before this SP existed) may not grant it
+        // secret access yet. "add" merges/replaces just this principal's policy, leaving
+        // every other access policy on the vault untouched.
+        await client.vaults.updateAccessPolicy(resourceGroupName, keyVaultName, 'add', {
+            properties: {
+                accessPolicies: [
+                    {
+                        tenantId: credentials.AZURE_TENANT_ID,
+                        objectId,
+                        permissions: { secrets: ['Get', 'List', 'Set', 'Delete'] },
+                    },
+                ],
+            },
+        });
+        console.log(chalk_1.default.green(`  ✓ Key Vault already exists: ${keyVaultName}`));
+        return;
+    }
+    console.log(chalk_1.default.cyan(`  Creating Key Vault: ${keyVaultName}`));
+    const poller = await client.vaults.beginCreateOrUpdate(resourceGroupName, keyVaultName, {
+        location,
+        properties: {
+            tenantId: credentials.AZURE_TENANT_ID,
+            sku: { family: 'A', name: 'standard' },
+            enableRbacAuthorization: false,
+            accessPolicies: [
+                {
+                    tenantId: credentials.AZURE_TENANT_ID,
+                    objectId,
+                    permissions: { secrets: ['Get', 'List', 'Set', 'Delete'] },
+                },
+            ],
+        },
+    });
+    await poller.pollUntilDone();
+    await waitForDns(`${keyVaultName}.vault.azure.net`);
+    console.log(chalk_1.default.green('  ✓ Key Vault created'));
+}
+//# sourceMappingURL=azure-state-storage.js.map

package/dist/infra/azure-state-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure-state-storage.js","sourceRoot":"","sources":["../../src/infra/azure-state-storage.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBA,wDAEC;AAED,oEAIC;AAED,8CAIC;AAsBD,gCAWC;AAuBD,kDAeC;AAGD,gDAsDC;AAGD,0DA2DC;AA7ND,6CAA8B;AAC9B,yCAA0B;AAC1B,kDAAyB;AACzB,8CAAyE;AACzE,wDAA+D;AAC/D,oDAA4D;AAC5D,sDAA8D;AAC9D,sDAAmF;AAEnF,uDAAgD;AAEvC,6FAFA,8BAAY,OAEA;AAErB,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;AACtD,CAAC;AAED,SAAgB,sBAAsB,CAAC,WAAmB;IACxD,OAAO,GAAG,WAAW,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAA;AAC/D,CAAC;AAED,SAAgB,4BAA4B,CAAC,WAAmB,EAAE,MAAc;IAC9E,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,CAAA;IAC/E,OAAO,KAAK,IAAI,GAAG,UAAU,EAAE,CAAA;AACjC,CAAC;AAED,SAAgB,iBAAiB,CAAC,WAAmB,EAAE,MAAc;IACnE,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,CAAA;IACnF,OAAO,MAAM,IAAI,IAAI,UAAU,EAAE,CAAA;AACnC,CAAC;AAEY,QAAA,oBAAoB,GAAG,SAAS,CAAA;AAE7C,SAAS,UAAU,CAAC,WAAwB;IAC1C,OAAO,IAAI,iCAAsB,CAC/B,WAAW,CAAC,eAAe,EAC3B,WAAW,CAAC,eAAe,EAC3B,WAAW,CAAC,mBAAmB,CAChC,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAQ;IAC1B,OAAO,GAAG,EAAE,UAAU,KAAK,GAAG,IAAI,GAAG,EAAE,IAAI,KAAK,kBAAkB,CAAA;AACpE,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,UAAU,CAAC,QAAgB,EAAE,SAAS,GAAG,MAAM,EAAE,UAAU,GAAG,KAAK;IACvF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAA;IACvC,SAAS,CAAC;QACR,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YACnC,OAAM;QACR,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;gBAAE,OAAM,CAAC,0EAA0E;YAC7G,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAA;QACjE,CAAC;IACH,CAAC;AACH,CAAC;AAED,+GAA+G;AAC/G,KAAK,UAAU,2BAA2B,CAAC,IAAqB,EAAE,QAAgB;IAChF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,sCAAsC,CAAC,CAAA;IACzE,MAAM,GAAG,GAAG,wEAAwE,QAAQ,GAAG,CAAA;IAC/F,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACzD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAM,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;YAC3F,IAAI,IAAI,GAAG,EAAE,CAAA;YACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,CAAA;YAC1C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;QACpC,CAAC,CAAC,CAAA;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmE,CAAA;IACjG,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,qEAAqE,QAAQ,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,CACzH,CAAA;IACH,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAC3B,CAAC;AAEM,KAAK,UAAU,mBAAmB,CACvC,WAAwB,EACxB,iBAAyB,EACzB,QAAgB;IAEhB,MAAM,MAAM,GAAG,IAAI,wCAAwB,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,qBAAqB,CAAC,CAAA;IACvG,0GAA0G;IAC1G,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAA;IACtF,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,sCAAsC,iBAAiB,EAAE,CAAC,CAAC,CAAA;QACnF,OAAM;IACR,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,8BAA8B,iBAAiB,EAAE,CAAC,CAAC,CAAA;IAC1E,MAAM,MAAM,CAAC,cAAc,CAAC,cAAc,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC3E,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAA;AACxD,CAAC;AAED,mGAAmG;AAC5F,KAAK,UAAU,kBAAkB,CACtC,WAAwB,EACxB,iBAAyB,EACzB,kBAA0B,EAC1B,QAAgB,EAChB,gBAAwB,4BAAoB;IAE5C,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,CAAC,CAAA;IACpC,MAAM,aAAa,GAAG,IAAI,qCAAuB,CAAC,IAAI,EAAE,WAAW,CAAC,qBAAqB,CAAC,CAAA;IAE1F,IAAI,MAAM,GAAG,IAAI,CAAA;IACjB,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,eAAe,CAAC,aAAa,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,CAAA;IAC1F,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,0CAA0C,kBAAkB,MAAM,GAAG,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC,CAAA;QACzG,CAAC;QACD,MAAM,GAAG,KAAK,CAAA;IAChB,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,qCAAqC,kBAAkB,EAAE,CAAC,CAAC,CAAA;QAClF,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,eAAe,CAAC,WAAW,CAAC,iBAAiB,EAAE,kBAAkB,EAAE;YACpG,QAAQ;YACR,GAAG,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE;YAC7B,IAAI,EAAE,WAAW;YACjB,qBAAqB,EAAE,KAAK;YAC5B,iBAAiB,EAAE,QAAQ;SAC5B,CAAC,CAAA;QACF,MAAM,MAAM,CAAC,aAAa,EAAE,CAAA;QAC5B,MAAM,UAAU,CAAC,GAAG,kBAAkB,wBAAwB,CAAC,CAAA;QAC/D,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAA;IAC/D,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,6CAA6C,kBAAkB,EAAE,CAAC,CAAC,CAAA;IAC7F,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,eAAe,CAAC,QAAQ,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,CAAA;IAChG,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAA;IACjC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,yDAAyD,kBAAkB,GAAG,CAAC,CAAA;IACjG,CAAC;IAED,MAAM,iBAAiB,GAAG,IAAI,gCAAiB,CAC7C,WAAW,kBAAkB,wBAAwB,EACrD,IAAI,yCAA0B,CAAC,kBAAkB,EAAE,GAAG,CAAC,CACxD,CAAA;IACD,MAAM,eAAe,GAAG,iBAAiB,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAA;IAC3E,IAAI,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,uCAAuC,aAAa,EAAE,CAAC,CAAC,CAAA;IAClF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,+BAA+B,aAAa,EAAE,CAAC,CAAC,CAAA;QACvE,MAAM,eAAe,CAAC,MAAM,EAAE,CAAA;QAC9B,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAA;IACzD,CAAC;AACH,CAAC;AAED,wHAAwH;AACjH,KAAK,UAAU,uBAAuB,CAC3C,WAAwB,EACxB,iBAAyB,EACzB,YAAoB,EACpB,QAAgB;IAEhB,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,CAAC,CAAA;IACpC,MAAM,MAAM,GAAG,IAAI,uCAAwB,CAAC,IAAI,EAAE,WAAW,CAAC,qBAAqB,CAAC,CAAA;IAEpF,IAAI,MAAM,GAAG,IAAI,CAAA;IACjB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAA;IAC1D,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,8BAA8B,YAAY,MAAM,GAAG,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC,CAAA;QACvF,CAAC;QACD,MAAM,GAAG,KAAK,CAAA;IAChB,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC,IAAI,EAAE,WAAW,CAAC,eAAe,CAAC,CAAA;IAErF,IAAI,MAAM,EAAE,CAAC;QACX,iFAAiF;QACjF,iFAAiF;QACjF,oDAAoD;QACpD,MAAM,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,iBAAiB,EAAE,YAAY,EAAE,KAAK,EAAE;YAC7E,UAAU,EAAE;gBACV,cAAc,EAAE;oBACd;wBACE,QAAQ,EAAE,WAAW,CAAC,eAAe;wBACrC,QAAQ;wBACR,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE;qBAC3D;iBACF;aACF;SACF,CAAC,CAAA;QACF,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,iCAAiC,YAAY,EAAE,CAAC,CAAC,CAAA;QACzE,OAAM;IACR,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,yBAAyB,YAAY,EAAE,CAAC,CAAC,CAAA;IAChE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,YAAY,EAAE;QACtF,QAAQ;QACR,UAAU,EAAE;YACV,QAAQ,EAAE,WAAW,CAAC,eAAe;YACrC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE;YACtC,uBAAuB,EAAE,KAAK;YAC9B,cAAc,EAAE;gBACd;oBACE,QAAQ,EAAE,WAAW,CAAC,eAAe;oBACrC,QAAQ;oBACR,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE;iBAC3D;aACF;SACF;KACF,CAAC,CAAA;IACF,MAAM,MAAM,CAAC,aAAa,EAAE,CAAA;IAC5B,MAAM,UAAU,CAAC,GAAG,YAAY,kBAAkB,CAAC,CAAA;IACnD,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAA;AACnD,CAAC"}

package/dist/infra/credentials.d.ts

@@ -1,4 +1,4 @@
-import { Credentials, CredentialKey } from './types';
+import { Credentials, CredentialKey, Deployment } from './types';
 /**
  * Resolve credentials by merging sources in priority order:
  * 1. CLI flag overrides (highest)
@@ -7,5 +7,5 @@ import { Credentials, CredentialKey } from './types';
  *
  * Sources are merged per-key — e.g., AWS keys from env + GITHUB_TOKEN from file = valid.
  */
-export declare function resolveCredentials(searchDir?: string, overrides?: Partial<Record<CredentialKey, string>>): Promise<Credentials>;
+export declare function resolveCredentials(searchDir?: string, overrides?: Partial<Record<CredentialKey, string>>, deployment?: Deployment): Promise<Credentials>;
 //# sourceMappingURL=credentials.d.ts.map

package/dist/infra/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/infra/credentials.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAA4B,aAAa,EAAE,MAAM,SAAS,CAAA;AAgB9E;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,GACjD,OAAO,CAAC,WAAW,CAAC,CAkCtB"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/infra/credentials.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAA4B,aAAa,EAAE,UAAU,EAA6B,MAAM,SAAS,CAAA;AAgBrH;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,EAClD,UAAU,GAAE,UAAkB,GAC7B,OAAO,CAAC,WAAW,CAAC,CAqCtB"}

package/dist/infra/credentials.js

@@ -61,7 +61,8 @@ async function tryReadCredentialsFile(credPath) {
  *
  * Sources are merged per-key — e.g., AWS keys from env + GITHUB_TOKEN from file = valid.
  */
-async function resolveCredentials(searchDir, overrides) {
+async function resolveCredentials(searchDir, overrides, deployment = 'ecs') {
+    const requiredKeys = (0, types_1.requiredCredentialKeysFor)(deployment);
     // Collect file values from searchDir and CWD
     const credPath = searchDir
         ? path.join(searchDir, '.fuel-credentials')
@@ -83,10 +84,13 @@ async function resolveCredentials(searchDir, overrides) {
                 process.env[key] ||
                 undefined;
     }
-    const missing = types_1.REQUIRED_CREDENTIAL_KEYS.filter((k) => !resolved[k]);
+    const missing = requiredKeys.filter((k) => !resolved[k]);
     if (missing.length > 0) {
-        throw new Error(`Missing credentials: ${missing.join(', ')}\n` +
-            `Provide them via CLI flags, .fuel-credentials file, or environment variables.`);
+        const missingGitHubOnly = missing.every((k) => k.startsWith('GITHUB_'));
+        const hint = missingGitHubOnly
+            ? 'Run "fuel auth:init" to set up GitHub credentials interactively (guides you to a token with the right permissions), or provide them via CLI flags, .fuel-credentials, or environment variables.'
+            : 'Provide them via CLI flags, .fuel-credentials file, or environment variables.';
+        throw new Error(`Missing credentials: ${missing.join(', ')}\n${hint}`);
     }
     return resolved;
 }

package/dist/infra/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/infra/credentials.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,gDAqCC;AA/DD,2CAA4B;AAC5B,6CAA8B;AAC9B,mCAA8E;AAE9E,KAAK,UAAU,sBAAsB,CAAC,QAAgB;IACpD,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,EAAE,CAAA;IAC/C,IAAI,CAAC;QACH,MAAM,IAAI,GAA2B,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAChE,MAAM,MAAM,GAA2C,EAAE,CAAA;QACzD,KAAK,MAAM,GAAG,IAAI,gCAAwB,EAAE,CAAC;YAC3C,IAAI,IAAI,CAAC,GAAG,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAA;QACxC,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,kBAAkB,CACtC,SAAkB,EAClB,SAAkD;IAElD,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,SAAS;QACxB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC;QAC3C,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAA;IACrC,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAA;IAEzD,wDAAwD;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;IACzB,IAAI,SAAS,GAA2C,EAAE,CAAA;IAC1D,IAAI,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,GAAG,EAAE,CAAC;QACjD,SAAS,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAA;IAC7E,CAAC;IAED,iEAAiE;IACjE,MAAM,QAAQ,GAA2C,EAAE,CAAA;IAC3D,KAAK,MAAM,GAAG,IAAI,gCAAwB,EAAE,CAAC;QAC3C,QAAQ,CAAC,GAAG,CAAC;YACX,SAAS,EAAE,CAAC,GAAG,CAAC;gBAChB,UAAU,CAAC,GAAG,CAAC;gBACf,SAAS,CAAC,GAAG,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;gBAChB,SAAS,CAAA;IACb,CAAC;IAED,MAAM,OAAO,GAAG,gCAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IACpE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,wBAAwB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC5C,+EAA+E,CAClF,CAAA;IACH,CAAC;IAED,OAAO,QAAuB,CAAA;AAChC,CAAC"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/infra/credentials.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,gDAyCC;AAnED,2CAA4B;AAC5B,6CAA8B;AAC9B,mCAAqH;AAErH,KAAK,UAAU,sBAAsB,CAAC,QAAgB;IACpD,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,EAAE,CAAA;IAC/C,IAAI,CAAC;QACH,MAAM,IAAI,GAA2B,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAChE,MAAM,MAAM,GAA2C,EAAE,CAAA;QACzD,KAAK,MAAM,GAAG,IAAI,gCAAwB,EAAE,CAAC;YAC3C,IAAI,IAAI,CAAC,GAAG,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAA;QACxC,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,kBAAkB,CACtC,SAAkB,EAClB,SAAkD,EAClD,aAAyB,KAAK;IAE9B,MAAM,YAAY,GAAG,IAAA,iCAAyB,EAAC,UAAU,CAAC,CAAA;IAE1D,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,SAAS;QACxB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC;QAC3C,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAA;IACrC,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAA;IAEzD,wDAAwD;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;IACzB,IAAI,SAAS,GAA2C,EAAE,CAAA;IAC1D,IAAI,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,GAAG,EAAE,CAAC;QACjD,SAAS,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAA;IAC7E,CAAC;IAED,iEAAiE;IACjE,MAAM,QAAQ,GAA2C,EAAE,CAAA;IAC3D,KAAK,MAAM,GAAG,IAAI,gCAAwB,EAAE,CAAC;QAC3C,QAAQ,CAAC,GAAG,CAAC;YACX,SAAS,EAAE,CAAC,GAAG,CAAC;gBAChB,UAAU,CAAC,GAAG,CAAC;gBACf,SAAS,CAAC,GAAG,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;gBAChB,SAAS,CAAA;IACb,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IACxD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,iBAAiB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;QACvE,MAAM,IAAI,GAAG,iBAAiB;YAC5B,CAAC,CAAC,iMAAiM;YACnM,CAAC,CAAC,+EAA+E,CAAA;QACnF,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,OAAO,QAAuB,CAAA;AAChC,CAAC"}

package/dist/infra/deployment-detect.d.ts

@@ -0,0 +1,9 @@
+import { Deployment } from './types';
+/**
+ * Infers the deployment provider from an already-generated /infra folder,
+ * for flows that need it before fuel.yml/the remote secret has been read
+ * (e.g. `--tofu-only`, `infra:pull`). Based on which provider block
+ * providers.tf declares.
+ */
+export declare function detectDeploymentFromInfraDir(infraDir: string): Promise<Deployment>;
+//# sourceMappingURL=deployment-detect.d.ts.map

package/dist/infra/deployment-detect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-detect.d.ts","sourceRoot":"","sources":["../../src/infra/deployment-detect.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAEpC;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAOxF"}

package/dist/infra/deployment-detect.js

@@ -0,0 +1,53 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectDeploymentFromInfraDir = detectDeploymentFromInfraDir;
+const path = __importStar(require("path"));
+const fs = __importStar(require("fs-extra"));
+/**
+ * Infers the deployment provider from an already-generated /infra folder,
+ * for flows that need it before fuel.yml/the remote secret has been read
+ * (e.g. `--tofu-only`, `infra:pull`). Based on which provider block
+ * providers.tf declares.
+ */
+async function detectDeploymentFromInfraDir(infraDir) {
+    const providersPath = path.join(infraDir, 'providers.tf');
+    if (!(await fs.pathExists(providersPath))) {
+        return 'ecs';
+    }
+    const content = await fs.readFile(providersPath, 'utf-8');
+    return content.includes('azurerm') ? 'azure' : 'ecs';
+}
+//# sourceMappingURL=deployment-detect.js.map

package/dist/infra/deployment-detect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-detect.js","sourceRoot":"","sources":["../../src/infra/deployment-detect.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUA,oEAOC;AAjBD,2CAA4B;AAC5B,6CAA8B;AAG9B;;;;;GAKG;AACI,KAAK,UAAU,4BAA4B,CAAC,QAAgB;IACjE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;IACzD,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IACzD,OAAO,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAA;AACtD,CAAC"}

package/dist/infra/github-client.d.ts

@@ -1,3 +1,9 @@
+/**
+ * Verifies the GitHub token authenticates and — for classic PATs, which report their
+ * scopes via the `x-oauth-scopes` response header — that it has repo push/admin access.
+ * Fine-grained PATs don't expose scopes this way, so we can only confirm those authenticate.
+ */
+export declare function validateGitHubToken(token: string): Promise<void>;
 export declare function repoExists(token: string, org: string, name: string): Promise<boolean>;
 export declare function createGitHubRepo(token: string, org: string, name: string): Promise<{
     name: string;

package/dist/infra/github-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"github-client.d.ts","sourceRoot":"","sources":["../../src/infra/github-client.ts"],"names":[],"mappings":"AAEA,wBAAsB,UAAU,CAC9B,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,CAAC,CASlB;AAED,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAY5C;AAED,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAmBf"}
+{"version":3,"file":"github-client.d.ts","sourceRoot":"","sources":["../../src/infra/github-client.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA6BtE;AAED,wBAAsB,UAAU,CAC9B,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,CAAC,CASlB;AAED,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAY5C;AAED,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAgBf"}

package/dist/infra/github-client.js

@@ -1,9 +1,39 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateGitHubToken = validateGitHubToken;
 exports.repoExists = repoExists;
 exports.createGitHubRepo = createGitHubRepo;
 exports.setBranchProtection = setBranchProtection;
 const rest_1 = require("@octokit/rest");
+const REQUIRED_SCOPES = ['repo', 'public_repo'];
+/**
+ * Verifies the GitHub token authenticates and — for classic PATs, which report their
+ * scopes via the `x-oauth-scopes` response header — that it has repo push/admin access.
+ * Fine-grained PATs don't expose scopes this way, so we can only confirm those authenticate.
+ */
+async function validateGitHubToken(token) {
+    const octokit = new rest_1.Octokit({ auth: token });
+    let scopesHeader;
+    try {
+        const response = await octokit.request('GET /user');
+        scopesHeader = response.headers['x-oauth-scopes'];
+    }
+    catch (err) {
+        throw new Error(`GitHub token is invalid or expired: ${err.message || err}`);
+    }
+    if (scopesHeader === undefined) {
+        // Fine-grained PAT — no scopes header to check. Token authenticates; proceed.
+        return;
+    }
+    const scopes = scopesHeader
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean);
+    if (!scopes.some((s) => REQUIRED_SCOPES.includes(s))) {
+        throw new Error(`GitHub token is missing the "repo" scope (found: ${scopes.join(', ') || 'none'}). ` +
+            'Regenerate a classic Personal Access Token with the "repo" scope so the CLI can create the repo, push code, and set branch protections.');
+    }
+}
 async function repoExists(token, org, name) {
     const octokit = new rest_1.Octokit({ auth: token });
     try {
@@ -38,10 +68,7 @@ async function setBranchProtection(token, owner, repo, branch) {
             required_approving_review_count: 1,
             dismiss_stale_reviews: true,
         },
-        required_status_checks: {
-            strict: true,
-            contexts: ['Title matches Jira Issue'],
-        },
+        required_status_checks: null,
         restrictions: null,
         allow_deletions: false,
     });

package/dist/infra/github-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"github-client.js","sourceRoot":"","sources":["../../src/infra/github-client.ts"],"names":[],"mappings":";;AAEA,gCAaC;AAED,4CAgBC;AAED,kDAwBC;AA3DD,wCAAuC;AAEhC,KAAK,UAAU,UAAU,CAC9B,KAAa,EACb,GAAW,EACX,IAAY;IAEZ,MAAM,OAAO,GAAG,IAAI,cAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC5C,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACxD,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,MAAM,KAAK,GAAG;YAAE,OAAO,KAAK,CAAA;QACrC,MAAM,GAAG,CAAA;IACX,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,GAAW,EACX,IAAY;IAEZ,MAAM,OAAO,GAAG,IAAI,cAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAE5C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;QACpD,GAAG;QACH,IAAI;QACJ,SAAS,EAAE,KAAK;QAChB,UAAU,EAAE,SAAS;QACrB,WAAW,EAAE,uCAAuC;KACrD,CAAC,CAAA;IAEF,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAA;AACpD,CAAC;AAEM,KAAK,UAAU,mBAAmB,CACvC,KAAa,EACb,KAAa,EACb,IAAY,EACZ,MAAc;IAEd,MAAM,OAAO,GAAG,IAAI,cAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAE5C,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC;QAC9C,KAAK;QACL,IAAI;QACJ,MAAM;QACN,cAAc,EAAE,KAAK;QACrB,6BAA6B,EAAE;YAC7B,+BAA+B,EAAE,CAAC;YAClC,qBAAqB,EAAE,IAAI;SAC5B;QACD,sBAAsB,EAAE;YACtB,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,CAAC,0BAA0B,CAAC;SACvC;QACD,YAAY,EAAE,IAAI;QAClB,eAAe,EAAE,KAAK;KACvB,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"github-client.js","sourceRoot":"","sources":["../../src/infra/github-client.ts"],"names":[],"mappings":";;AASA,kDA6BC;AAED,gCAaC;AAED,4CAgBC;AAED,kDAqBC;AA9FD,wCAAuC;AAEvC,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;AAE/C;;;;GAIG;AACI,KAAK,UAAU,mBAAmB,CAAC,KAAa;IACrD,MAAM,OAAO,GAAG,IAAI,cAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAE5C,IAAI,YAAgC,CAAA;IACpC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QACnD,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAA;IACzE,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,uCAAuC,GAAG,CAAC,OAAO,IAAI,GAAG,EAAE,CAC5D,CAAA;IACH,CAAC;IAED,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,8EAA8E;QAC9E,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,YAAY;SACxB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAA;IAElB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,oDAAoD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK;YAClF,yIAAyI,CAC5I,CAAA;IACH,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,UAAU,CAC9B,KAAa,EACb,GAAW,EACX,IAAY;IAEZ,MAAM,OAAO,GAAG,IAAI,cAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC5C,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACxD,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,MAAM,KAAK,GAAG;YAAE,OAAO,KAAK,CAAA;QACrC,MAAM,GAAG,CAAA;IACX,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,GAAW,EACX,IAAY;IAEZ,MAAM,OAAO,GAAG,IAAI,cAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAE5C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;QACpD,GAAG;QACH,IAAI;QACJ,SAAS,EAAE,KAAK;QAChB,UAAU,EAAE,SAAS;QACrB,WAAW,EAAE,uCAAuC;KACrD,CAAC,CAAA;IAEF,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAA;AACpD,CAAC;AAEM,KAAK,UAAU,mBAAmB,CACvC,KAAa,EACb,KAAa,EACb,IAAY,EACZ,MAAc;IAEd,MAAM,OAAO,GAAG,IAAI,cAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAE5C,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC;QAC9C,KAAK;QACL,IAAI;QACJ,MAAM;QACN,cAAc,EAAE,KAAK;QACrB,6BAA6B,EAAE;YAC7B,+BAA+B,EAAE,CAAC;YAClC,qBAAqB,EAAE,IAAI;SAC5B;QACD,sBAAsB,EAAE,IAAI;QAC5B,YAAY,EAAE,IAAI;QAClB,eAAe,EAAE,KAAK;KACvB,CAAC,CAAA;AACJ,CAAC"}

package/dist/infra/github-token-link.d.ts

@@ -0,0 +1,4 @@
+/** Builds a GitHub token-creation URL with the CLI's required scope(s) pre-selected. */
+export declare function buildGitHubTokenUrl(description?: string): string;
+export declare function openInBrowser(url: string): void;
+//# sourceMappingURL=github-token-link.d.ts.map

package/dist/infra/github-token-link.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-token-link.d.ts","sourceRoot":"","sources":["../../src/infra/github-token-link.ts"],"names":[],"mappings":"AAQA,wFAAwF;AACxF,wBAAgB,mBAAmB,CAAC,WAAW,SAAa,GAAG,MAAM,CAMpE;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAQ/C"}

package/dist/infra/github-token-link.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildGitHubTokenUrl = buildGitHubTokenUrl;
+exports.openInBrowser = openInBrowser;
+const child_process_1 = require("child_process");
+// The single scope every CLI-driven GitHub operation needs (create repo, push,
+// set branch protection, configure Actions secrets). Pre-selecting it on the
+// token creation page means the user never has to know or look up which
+// checkbox to tick.
+const REQUIRED_SCOPES = ['repo'];
+/** Builds a GitHub token-creation URL with the CLI's required scope(s) pre-selected. */
+function buildGitHubTokenUrl(description = 'Fuel CLI') {
+    const params = new URLSearchParams({
+        scopes: REQUIRED_SCOPES.join(','),
+        description,
+    });
+    return `https://github.com/settings/tokens/new?${params.toString()}`;
+}
+function openInBrowser(url) {
+    const cmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'start' : 'xdg-open';
+    try {
+        (0, child_process_1.exec)(`${cmd} "${url}"`);
+    }
+    catch {
+        // Best-effort — the link is already printed for the user to open manually.
+    }
+}
+//# sourceMappingURL=github-token-link.js.map

package/dist/infra/github-token-link.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-token-link.js","sourceRoot":"","sources":["../../src/infra/github-token-link.ts"],"names":[],"mappings":";;AASA,kDAMC;AAED,sCAQC;AAzBD,iDAAoC;AAEpC,+EAA+E;AAC/E,6EAA6E;AAC7E,wEAAwE;AACxE,oBAAoB;AACpB,MAAM,eAAe,GAAG,CAAC,MAAM,CAAC,CAAA;AAEhC,wFAAwF;AACxF,SAAgB,mBAAmB,CAAC,WAAW,GAAG,UAAU;IAC1D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;QACjC,WAAW;KACZ,CAAC,CAAA;IACF,OAAO,0CAA0C,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;AACtE,CAAC;AAED,SAAgB,aAAa,CAAC,GAAW;IACvC,MAAM,GAAG,GACP,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAA;IAC9F,IAAI,CAAC;QACH,IAAA,oBAAI,EAAC,GAAG,GAAG,KAAK,GAAG,GAAG,CAAC,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;IAC7E,CAAC;AACH,CAAC"}

package/dist/infra/orchestrator.d.ts

@@ -6,5 +6,8 @@ export interface OrchestratorOptions {
     forcePush?: boolean;
     skipBranchProtection?: boolean;
 }
-export declare function runInfraOrchestrator(targetRoot: string, _appName: string, config: InfraConfig, credentials: Credentials, options?: OrchestratorOptions): Promise<void>;
+export interface OrchestratorResult {
+    codePushed: boolean;
+}
+export declare function runInfraOrchestrator(targetRoot: string, _appName: string, config: InfraConfig, credentials: Credentials, options?: OrchestratorOptions): Promise<OrchestratorResult | undefined>;
 //# sourceMappingURL=orchestrator.d.ts.map

package/dist/infra/orchestrator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orchestrator.d.ts","sourceRoot":"","sources":["../../src/infra/orchestrator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAqDlD,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,WAAW,EACnB,WAAW,EAAE,WAAW,EACxB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAoKf"}
+{"version":3,"file":"orchestrator.d.ts","sourceRoot":"","sources":["../../src/infra/orchestrator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AA0FlD,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,OAAO,CAAA;CACpB;AAySD,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,WAAW,EACnB,WAAW,EAAE,WAAW,EACxB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAKzC"}