@swovohq/fuel 0.2.2-alpha.9 → 0.2.2-alpha.91

package/dist/infra/azure-keyvault-client.js

@@ -0,0 +1,57 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getSecret = getSecret;
+exports.putSecret = putSecret;
+const identity_1 = require("@azure/identity");
+const keyvault_secrets_1 = require("@azure/keyvault-secrets");
+const YAML = __importStar(require("yaml"));
+function buildClient(credentials, vaultName) {
+    const credential = new identity_1.ClientSecretCredential(credentials.AZURE_TENANT_ID, credentials.AZURE_CLIENT_ID, credentials.AZURE_CLIENT_SECRET);
+    return new keyvault_secrets_1.SecretClient(`https://${vaultName}.vault.azure.net`, credential);
+}
+async function getSecret(credentials, vaultName, secretName) {
+    const client = buildClient(credentials, vaultName);
+    const response = await client.getSecret(secretName);
+    if (!response.value) {
+        throw new Error(`Secret "${secretName}" exists in vault "${vaultName}" but has no value.`);
+    }
+    return YAML.parse(response.value);
+}
+async function putSecret(credentials, vaultName, secretName, value) {
+    const client = buildClient(credentials, vaultName);
+    await client.setSecret(secretName, YAML.stringify(value));
+}
+//# sourceMappingURL=azure-keyvault-client.js.map

package/dist/infra/azure-keyvault-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure-keyvault-client.js","sourceRoot":"","sources":["../../src/infra/azure-keyvault-client.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBA,8BAaC;AAED,8BAQC;AAxCD,8CAAwD;AACxD,8DAAsD;AACtD,2CAA4B;AAG5B,SAAS,WAAW,CAClB,WAAwB,EACxB,SAAiB;IAEjB,MAAM,UAAU,GAAG,IAAI,iCAAsB,CAC3C,WAAW,CAAC,eAAe,EAC3B,WAAW,CAAC,eAAe,EAC3B,WAAW,CAAC,mBAAmB,CAChC,CAAA;IACD,OAAO,IAAI,+BAAY,CAAC,WAAW,SAAS,kBAAkB,EAAE,UAAU,CAAC,CAAA;AAC7E,CAAC;AAEM,KAAK,UAAU,SAAS,CAC7B,WAAwB,EACxB,SAAiB,EACjB,UAAkB;IAElB,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;IAClD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;IACnD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,WAAW,UAAU,sBAAsB,SAAS,qBAAqB,CAC1E,CAAA;IACH,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AACnC,CAAC;AAEM,KAAK,UAAU,SAAS,CAC7B,WAAwB,EACxB,SAAiB,EACjB,UAAkB,EAClB,KAA8B;IAE9B,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;IAClD,MAAM,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;AAC3D,CAAC"}

package/dist/infra/azure-rbac.d.ts

@@ -0,0 +1,11 @@
+import { Credentials } from './types';
+export declare function actionMatches(pattern: string, action: string): boolean;
+/**
+ * The deploy creates role assignments (GitHub OIDC -> ACR push, GitHub OIDC -> RG contributor),
+ * which need `Microsoft.Authorization/roleAssignments/write`. Azure's built-in Contributor role
+ * explicitly excludes that action (it's in Contributor's `notActions`), so a SP with only
+ * Contributor always fails here — regardless of scope. Checked against the resource group
+ * (not the subscription) so it reflects the SP's actual effective permissions at apply time.
+ */
+export declare function ensureRoleAssignmentPermission(credentials: Credentials, resourceGroupName: string): Promise<void>;
+//# sourceMappingURL=azure-rbac.d.ts.map

package/dist/infra/azure-rbac.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure-rbac.d.ts","sourceRoot":"","sources":["../../src/infra/azure-rbac.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAarC,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAMtE;AAaD;;;;;;GAMG;AACH,wBAAsB,8BAA8B,CAClD,WAAW,EAAE,WAAW,EACxB,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,IAAI,CAAC,CA2Bf"}

package/dist/infra/azure-rbac.js

@@ -0,0 +1,49 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.actionMatches = actionMatches;
+exports.ensureRoleAssignmentPermission = ensureRoleAssignmentPermission;
+const chalk_1 = __importDefault(require("chalk"));
+const identity_1 = require("@azure/identity");
+const arm_authorization_1 = require("@azure/arm-authorization");
+const ROLE_ASSIGNMENT_WRITE_ACTION = 'Microsoft.Authorization/roleAssignments/write';
+function credential(credentials) {
+    return new identity_1.ClientSecretCredential(credentials.AZURE_TENANT_ID, credentials.AZURE_CLIENT_ID, credentials.AZURE_CLIENT_SECRET);
+}
+function actionMatches(pattern, action) {
+    const escaped = pattern
+        .replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+        .replace(/\\\*/g, '.*');
+    const regex = new RegExp(`^${escaped}$`, 'i');
+    return regex.test(action);
+}
+function isActionAllowed(permissions, action) {
+    return permissions.some((p) => (p.actions ?? []).some((a) => actionMatches(a, action)) &&
+        !(p.notActions ?? []).some((a) => actionMatches(a, action)));
+}
+/**
+ * The deploy creates role assignments (GitHub OIDC -> ACR push, GitHub OIDC -> RG contributor),
+ * which need `Microsoft.Authorization/roleAssignments/write`. Azure's built-in Contributor role
+ * explicitly excludes that action (it's in Contributor's `notActions`), so a SP with only
+ * Contributor always fails here — regardless of scope. Checked against the resource group
+ * (not the subscription) so it reflects the SP's actual effective permissions at apply time.
+ */
+async function ensureRoleAssignmentPermission(credentials, resourceGroupName) {
+    const client = new arm_authorization_1.AuthorizationManagementClient(credential(credentials), credentials.AZURE_SUBSCRIPTION_ID);
+    const permissions = [];
+    for await (const permission of client.permissions.listForResourceGroup(resourceGroupName)) {
+        permissions.push(permission);
+    }
+    if (isActionAllowed(permissions, ROLE_ASSIGNMENT_WRITE_ACTION)) {
+        console.log(chalk_1.default.green('  ✓ Service principal can create role assignments'));
+        return;
+    }
+    throw new Error(`Service principal ${credentials.AZURE_CLIENT_ID} cannot create role assignments in resource group ` +
+        `"${resourceGroupName}" (missing "${ROLE_ASSIGNMENT_WRITE_ACTION}"). Contributor alone never grants this — ` +
+        `grant "User Access Administrator" too:\n\n` +
+        `  az role assignment create --assignee ${credentials.AZURE_CLIENT_ID} --role "User Access Administrator" ` +
+        `--scope /subscriptions/${credentials.AZURE_SUBSCRIPTION_ID}/resourceGroups/${resourceGroupName}\n`);
+}
+//# sourceMappingURL=azure-rbac.js.map

package/dist/infra/azure-rbac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure-rbac.js","sourceRoot":"","sources":["../../src/infra/azure-rbac.ts"],"names":[],"mappings":";;;;;AAgBA,sCAMC;AAoBD,wEA8BC;AAxED,kDAAyB;AACzB,8CAAwD;AACxD,gEAAwE;AAGxE,MAAM,4BAA4B,GAChC,+CAA+C,CAAA;AAEjD,SAAS,UAAU,CAAC,WAAwB;IAC1C,OAAO,IAAI,iCAAsB,CAC/B,WAAW,CAAC,eAAe,EAC3B,WAAW,CAAC,eAAe,EAC3B,WAAW,CAAC,mBAAmB,CAChC,CAAA;AACH,CAAC;AAED,SAAgB,aAAa,CAAC,OAAe,EAAE,MAAc;IAC3D,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC;SACtC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IACzB,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,EAAE,GAAG,CAAC,CAAA;IAC7C,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AAC3B,CAAC;AAED,SAAS,eAAe,CACtB,WAAiE,EACjE,MAAc;IAEd,OAAO,WAAW,CAAC,IAAI,CACrB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAC9D,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,8BAA8B,CAClD,WAAwB,EACxB,iBAAyB;IAEzB,MAAM,MAAM,GAAG,IAAI,iDAA6B,CAC9C,UAAU,CAAC,WAAW,CAAC,EACvB,WAAW,CAAC,qBAAqB,CAClC,CAAA;IAED,MAAM,WAAW,GAAyD,EAAE,CAAA;IAC5E,IAAI,KAAK,EAAE,MAAM,UAAU,IAAI,MAAM,CAAC,WAAW,CAAC,oBAAoB,CACpE,iBAAiB,CAClB,EAAE,CAAC;QACF,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC9B,CAAC;IAED,IAAI,eAAe,CAAC,WAAW,EAAE,4BAA4B,CAAC,EAAE,CAAC;QAC/D,OAAO,CAAC,GAAG,CACT,eAAK,CAAC,KAAK,CAAC,mDAAmD,CAAC,CACjE,CAAA;QACD,OAAM;IACR,CAAC;IAED,MAAM,IAAI,KAAK,CACb,qBAAqB,WAAW,CAAC,eAAe,oDAAoD;QAClG,IAAI,iBAAiB,eAAe,4BAA4B,4CAA4C;QAC5G,4CAA4C;QAC5C,0CAA0C,WAAW,CAAC,eAAe,sCAAsC;QAC3G,0BAA0B,WAAW,CAAC,qBAAqB,mBAAmB,iBAAiB,IAAI,CACtG,CAAA;AACH,CAAC"}

package/dist/infra/azure-state-storage.d.ts

@@ -0,0 +1,20 @@
+import { Credentials } from './types';
+import { deriveSuffix } from './s3-state-bucket';
+export { deriveSuffix };
+export declare function buildResourceGroupName(projectName: string): string;
+export declare function buildStateStorageAccountName(projectName: string, suffix: string): string;
+export declare function buildKeyVaultName(projectName: string, suffix: string): string;
+export declare const STATE_CONTAINER_NAME = "tfstate";
+/**
+ * Polls DNS until `hostname` resolves. A freshly-created Azure PaaS resource (Key Vault,
+ * Storage Account, ...) is reported "Succeeded" by the ARM control plane before its public
+ * DNS record has actually propagated — an immediate follow-up call can fail with ENOTFOUND
+ * even though the resource exists. Only needed right after creating a new resource.
+ */
+export declare function waitForDns(hostname: string, timeoutMs?: number, intervalMs?: number): Promise<void>;
+export declare function ensureResourceGroup(credentials: Credentials, resourceGroupName: string, location: string): Promise<void>;
+/** Ensures the storage account + blob container backing the `azurerm` Tofu state backend exist. */
+export declare function ensureStateStorage(credentials: Credentials, resourceGroupName: string, storageAccountName: string, location: string, containerName?: string): Promise<void>;
+/** Ensures the Key Vault that stores the fuel.yml infrastructure secret exists and grants the CLI's SP access to it. */
+export declare function ensureBootstrapKeyVault(credentials: Credentials, resourceGroupName: string, keyVaultName: string, location: string): Promise<void>;
+//# sourceMappingURL=azure-state-storage.d.ts.map

package/dist/infra/azure-state-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure-state-storage.d.ts","sourceRoot":"","sources":["../../src/infra/azure-state-storage.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEhD,OAAO,EAAE,YAAY,EAAE,CAAA;AAMvB,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GACb,MAAM,CAKR;AAED,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAK7E;AAED,eAAO,MAAM,oBAAoB,YAAY,CAAA;AAc7C;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,MAAM,EAChB,SAAS,SAAS,EAClB,UAAU,SAAQ,GACjB,OAAO,CAAC,IAAI,CAAC,CAWf;AAiCD,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,WAAW,EACxB,iBAAiB,EAAE,MAAM,EACzB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAiBf;AAED,mGAAmG;AACnG,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,WAAW,EACxB,iBAAiB,EAAE,MAAM,EACzB,kBAAkB,EAAE,MAAM,EAC1B,QAAQ,EAAE,MAAM,EAChB,aAAa,GAAE,MAA6B,GAC3C,OAAO,CAAC,IAAI,CAAC,CAyEf;AAED,wHAAwH;AACxH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,WAAW,EACxB,iBAAiB,EAAE,MAAM,EACzB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAuEf"}

package/dist/infra/azure-state-storage.js

@@ -0,0 +1,229 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STATE_CONTAINER_NAME = exports.deriveSuffix = void 0;
+exports.buildResourceGroupName = buildResourceGroupName;
+exports.buildStateStorageAccountName = buildStateStorageAccountName;
+exports.buildKeyVaultName = buildKeyVaultName;
+exports.waitForDns = waitForDns;
+exports.ensureResourceGroup = ensureResourceGroup;
+exports.ensureStateStorage = ensureStateStorage;
+exports.ensureBootstrapKeyVault = ensureBootstrapKeyVault;
+const https = __importStar(require("https"));
+const dns = __importStar(require("dns"));
+const chalk_1 = __importDefault(require("chalk"));
+const identity_1 = require("@azure/identity");
+const arm_resources_1 = require("@azure/arm-resources");
+const arm_storage_1 = require("@azure/arm-storage");
+const arm_keyvault_1 = require("@azure/arm-keyvault");
+const storage_blob_1 = require("@azure/storage-blob");
+const s3_state_bucket_1 = require("./s3-state-bucket");
+Object.defineProperty(exports, "deriveSuffix", { enumerable: true, get: function () { return s3_state_bucket_1.deriveSuffix; } });
+function slugify(name) {
+    return name.replace(/[^a-z0-9]/gi, '').toLowerCase();
+}
+function buildResourceGroupName(projectName) {
+    return `${projectName}-rg`.replace(/[^a-zA-Z0-9-_.()]/g, '-');
+}
+function buildStateStorageAccountName(projectName, suffix) {
+    const safeSuffix = slugify(suffix).slice(-8);
+    const base = slugify(projectName).slice(0, 24 - 2 - safeSuffix.length) || 'app';
+    return `st${base}${safeSuffix}`;
+}
+function buildKeyVaultName(projectName, suffix) {
+    const safeSuffix = slugify(suffix).slice(-8);
+    const base = slugify(projectName).slice(0, 24 - 3 - 1 - safeSuffix.length) || 'app';
+    return `kv-${base}-${safeSuffix}`;
+}
+exports.STATE_CONTAINER_NAME = 'tfstate';
+function credential(credentials) {
+    return new identity_1.ClientSecretCredential(credentials.AZURE_TENANT_ID, credentials.AZURE_CLIENT_ID, credentials.AZURE_CLIENT_SECRET);
+}
+function isNotFound(err) {
+    return err?.statusCode === 404 || err?.code === 'ResourceNotFound';
+}
+/**
+ * Polls DNS until `hostname` resolves. A freshly-created Azure PaaS resource (Key Vault,
+ * Storage Account, ...) is reported "Succeeded" by the ARM control plane before its public
+ * DNS record has actually propagated — an immediate follow-up call can fail with ENOTFOUND
+ * even though the resource exists. Only needed right after creating a new resource.
+ */
+async function waitForDns(hostname, timeoutMs = 60_000, intervalMs = 3_000) {
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+        try {
+            await dns.promises.lookup(hostname);
+            return;
+        }
+        catch {
+            if (Date.now() >= deadline)
+                return; // give up silently — the caller's own request will surface the real error
+            await new Promise((resolve) => setTimeout(resolve, intervalMs));
+        }
+    }
+}
+/** Looks up the AAD object ID for the service principal identified by AZURE_CLIENT_ID, via Microsoft Graph. */
+async function getServicePrincipalObjectId(cred, clientId) {
+    const token = await cred.getToken('https://graph.microsoft.com/.default');
+    const url = `https://graph.microsoft.com/v1.0/servicePrincipals?$filter=appId eq '${clientId}'`;
+    const body = await new Promise((resolve, reject) => {
+        const req = https.get(url, { headers: { Authorization: `Bearer ${token.token}` } }, (res) => {
+            let data = '';
+            res.on('data', (chunk) => (data += chunk));
+            res.on('end', () => resolve(data));
+        });
+        req.on('error', reject);
+    });
+    const parsed = JSON.parse(body);
+    if (!parsed.value || parsed.value.length === 0) {
+        throw new Error(`Could not resolve service principal object ID for AZURE_CLIENT_ID=${clientId}: ${parsed.error?.message ?? 'not found'}`);
+    }
+    return parsed.value[0].id;
+}
+async function ensureResourceGroup(credentials, resourceGroupName, location) {
+    const client = new arm_resources_1.ResourceManagementClient(credential(credentials), credentials.AZURE_SUBSCRIPTION_ID);
+    // checkExistence resolves to { body: boolean }, not a plain boolean — the object itself is always truthy.
+    const { body: exists } = await client.resourceGroups.checkExistence(resourceGroupName);
+    if (exists) {
+        console.log(chalk_1.default.green(`  ✓ Resource group already exists: ${resourceGroupName}`));
+        return;
+    }
+    console.log(chalk_1.default.cyan(`  Creating resource group: ${resourceGroupName}`));
+    await client.resourceGroups.createOrUpdate(resourceGroupName, { location });
+    console.log(chalk_1.default.green('  ✓ Resource group created'));
+}
+/** Ensures the storage account + blob container backing the `azurerm` Tofu state backend exist. */
+async function ensureStateStorage(credentials, resourceGroupName, storageAccountName, location, containerName = exports.STATE_CONTAINER_NAME) {
+    const cred = credential(credentials);
+    const storageClient = new arm_storage_1.StorageManagementClient(cred, credentials.AZURE_SUBSCRIPTION_ID);
+    let exists = true;
+    try {
+        await storageClient.storageAccounts.getProperties(resourceGroupName, storageAccountName);
+    }
+    catch (err) {
+        if (!isNotFound(err)) {
+            throw new Error(`Failed to check state storage account "${storageAccountName}": ${err.message || err}`);
+        }
+        exists = false;
+    }
+    if (!exists) {
+        console.log(chalk_1.default.cyan(`  Creating state storage account: ${storageAccountName}`));
+        const poller = await storageClient.storageAccounts.beginCreate(resourceGroupName, storageAccountName, {
+            location,
+            sku: { name: 'Standard_LRS' },
+            kind: 'StorageV2',
+            allowBlobPublicAccess: false,
+            minimumTlsVersion: 'TLS1_2'
+        });
+        await poller.pollUntilDone();
+        await waitForDns(`${storageAccountName}.blob.core.windows.net`);
+        console.log(chalk_1.default.green('  ✓ State storage account created'));
+    }
+    else {
+        console.log(chalk_1.default.green(`  ✓ State storage account already exists: ${storageAccountName}`));
+    }
+    const keys = await storageClient.storageAccounts.listKeys(resourceGroupName, storageAccountName);
+    const key = keys.keys?.[0]?.value;
+    if (!key) {
+        throw new Error(`Could not retrieve an access key for storage account "${storageAccountName}"`);
+    }
+    const blobServiceClient = new storage_blob_1.BlobServiceClient(`https://${storageAccountName}.blob.core.windows.net`, new storage_blob_1.StorageSharedKeyCredential(storageAccountName, key));
+    const containerClient = blobServiceClient.getContainerClient(containerName);
+    if (await containerClient.exists()) {
+        console.log(chalk_1.default.green(`  ✓ State container already exists: ${containerName}`));
+    }
+    else {
+        console.log(chalk_1.default.cyan(`  Creating state container: ${containerName}`));
+        await containerClient.create();
+        console.log(chalk_1.default.green('  ✓ State container created'));
+    }
+}
+/** Ensures the Key Vault that stores the fuel.yml infrastructure secret exists and grants the CLI's SP access to it. */
+async function ensureBootstrapKeyVault(credentials, resourceGroupName, keyVaultName, location) {
+    const cred = credential(credentials);
+    const client = new arm_keyvault_1.KeyVaultManagementClient(cred, credentials.AZURE_SUBSCRIPTION_ID);
+    let exists = true;
+    try {
+        await client.vaults.get(resourceGroupName, keyVaultName);
+    }
+    catch (err) {
+        if (!isNotFound(err)) {
+            throw new Error(`Failed to check Key Vault "${keyVaultName}": ${err.message || err}`);
+        }
+        exists = false;
+    }
+    const objectId = await getServicePrincipalObjectId(cred, credentials.AZURE_CLIENT_ID);
+    if (exists) {
+        // A vault created outside this flow (or before this SP existed) may not grant it
+        // secret access yet. "add" merges/replaces just this principal's policy, leaving
+        // every other access policy on the vault untouched.
+        await client.vaults.updateAccessPolicy(resourceGroupName, keyVaultName, 'add', {
+            properties: {
+                accessPolicies: [
+                    {
+                        tenantId: credentials.AZURE_TENANT_ID,
+                        objectId,
+                        permissions: { secrets: ['Get', 'List', 'Set', 'Delete'] }
+                    }
+                ]
+            }
+        });
+        console.log(chalk_1.default.green(`  ✓ Key Vault already exists: ${keyVaultName}`));
+        return;
+    }
+    console.log(chalk_1.default.cyan(`  Creating Key Vault: ${keyVaultName}`));
+    const poller = await client.vaults.beginCreateOrUpdate(resourceGroupName, keyVaultName, {
+        location,
+        properties: {
+            tenantId: credentials.AZURE_TENANT_ID,
+            sku: { family: 'A', name: 'standard' },
+            enableRbacAuthorization: false,
+            accessPolicies: [
+                {
+                    tenantId: credentials.AZURE_TENANT_ID,
+                    objectId,
+                    permissions: { secrets: ['Get', 'List', 'Set', 'Delete'] }
+                }
+            ]
+        }
+    });
+    await poller.pollUntilDone();
+    await waitForDns(`${keyVaultName}.vault.azure.net`);
+    console.log(chalk_1.default.green('  ✓ Key Vault created'));
+}
+//# sourceMappingURL=azure-state-storage.js.map

package/dist/infra/azure-state-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure-state-storage.js","sourceRoot":"","sources":["../../src/infra/azure-state-storage.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoBA,wDAEC;AAED,oEAQC;AAED,8CAKC;AAsBD,gCAeC;AAiCD,kDAqBC;AAGD,gDA+EC;AAGD,0DA4EC;AAnSD,6CAA8B;AAC9B,yCAA0B;AAC1B,kDAAyB;AACzB,8CAAyE;AACzE,wDAA+D;AAC/D,oDAA4D;AAC5D,sDAA8D;AAC9D,sDAG4B;AAE5B,uDAAgD;AAEvC,6FAFA,8BAAY,OAEA;AAErB,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;AACtD,CAAC;AAED,SAAgB,sBAAsB,CAAC,WAAmB;IACxD,OAAO,GAAG,WAAW,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAA;AAC/D,CAAC;AAED,SAAgB,4BAA4B,CAC1C,WAAmB,EACnB,MAAc;IAEd,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5C,MAAM,IAAI,GACR,OAAO,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,CAAA;IACpE,OAAO,KAAK,IAAI,GAAG,UAAU,EAAE,CAAA;AACjC,CAAC;AAED,SAAgB,iBAAiB,CAAC,WAAmB,EAAE,MAAc;IACnE,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5C,MAAM,IAAI,GACR,OAAO,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,CAAA;IACxE,OAAO,MAAM,IAAI,IAAI,UAAU,EAAE,CAAA;AACnC,CAAC;AAEY,QAAA,oBAAoB,GAAG,SAAS,CAAA;AAE7C,SAAS,UAAU,CAAC,WAAwB;IAC1C,OAAO,IAAI,iCAAsB,CAC/B,WAAW,CAAC,eAAe,EAC3B,WAAW,CAAC,eAAe,EAC3B,WAAW,CAAC,mBAAmB,CAChC,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAQ;IAC1B,OAAO,GAAG,EAAE,UAAU,KAAK,GAAG,IAAI,GAAG,EAAE,IAAI,KAAK,kBAAkB,CAAA;AACpE,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,UAAU,CAC9B,QAAgB,EAChB,SAAS,GAAG,MAAM,EAClB,UAAU,GAAG,KAAK;IAElB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAA;IACvC,SAAS,CAAC;QACR,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YACnC,OAAM;QACR,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;gBAAE,OAAM,CAAC,0EAA0E;YAC7G,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAA;QACjE,CAAC;IACH,CAAC;AACH,CAAC;AAED,+GAA+G;AAC/G,KAAK,UAAU,2BAA2B,CACxC,IAAqB,EACrB,QAAgB;IAEhB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,sCAAsC,CAAC,CAAA;IACzE,MAAM,GAAG,GAAG,wEAAwE,QAAQ,GAAG,CAAA;IAC/F,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACzD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CACnB,GAAG,EACH,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAM,CAAC,KAAK,EAAE,EAAE,EAAE,EACxD,CAAC,GAAG,EAAE,EAAE;YACN,IAAI,IAAI,GAAG,EAAE,CAAA;YACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,CAAA;YAC1C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;QACpC,CAAC,CACF,CAAA;QACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAG7B,CAAA;IACD,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,qEAAqE,QAAQ,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,CACzH,CAAA;IACH,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAC3B,CAAC;AAEM,KAAK,UAAU,mBAAmB,CACvC,WAAwB,EACxB,iBAAyB,EACzB,QAAgB;IAEhB,MAAM,MAAM,GAAG,IAAI,wCAAwB,CACzC,UAAU,CAAC,WAAW,CAAC,EACvB,WAAW,CAAC,qBAAqB,CAClC,CAAA;IACD,0GAA0G;IAC1G,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GACpB,MAAM,MAAM,CAAC,cAAc,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAA;IAC/D,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CACT,eAAK,CAAC,KAAK,CAAC,sCAAsC,iBAAiB,EAAE,CAAC,CACvE,CAAA;QACD,OAAM;IACR,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,8BAA8B,iBAAiB,EAAE,CAAC,CAAC,CAAA;IAC1E,MAAM,MAAM,CAAC,cAAc,CAAC,cAAc,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC3E,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAA;AACxD,CAAC;AAED,mGAAmG;AAC5F,KAAK,UAAU,kBAAkB,CACtC,WAAwB,EACxB,iBAAyB,EACzB,kBAA0B,EAC1B,QAAgB,EAChB,gBAAwB,4BAAoB;IAE5C,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,CAAC,CAAA;IACpC,MAAM,aAAa,GAAG,IAAI,qCAAuB,CAC/C,IAAI,EACJ,WAAW,CAAC,qBAAqB,CAClC,CAAA;IAED,IAAI,MAAM,GAAG,IAAI,CAAA;IACjB,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,eAAe,CAAC,aAAa,CAC/C,iBAAiB,EACjB,kBAAkB,CACnB,CAAA;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,0CAA0C,kBAAkB,MAAM,GAAG,CAAC,OAAO,IAAI,GAAG,EAAE,CACvF,CAAA;QACH,CAAC;QACD,MAAM,GAAG,KAAK,CAAA;IAChB,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CACT,eAAK,CAAC,IAAI,CAAC,qCAAqC,kBAAkB,EAAE,CAAC,CACtE,CAAA;QACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,eAAe,CAAC,WAAW,CAC5D,iBAAiB,EACjB,kBAAkB,EAClB;YACE,QAAQ;YACR,GAAG,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE;YAC7B,IAAI,EAAE,WAAW;YACjB,qBAAqB,EAAE,KAAK;YAC5B,iBAAiB,EAAE,QAAQ;SAC5B,CACF,CAAA;QACD,MAAM,MAAM,CAAC,aAAa,EAAE,CAAA;QAC5B,MAAM,UAAU,CAAC,GAAG,kBAAkB,wBAAwB,CAAC,CAAA;QAC/D,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAA;IAC/D,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CACT,eAAK,CAAC,KAAK,CACT,6CAA6C,kBAAkB,EAAE,CAClE,CACF,CAAA;IACH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,eAAe,CAAC,QAAQ,CACvD,iBAAiB,EACjB,kBAAkB,CACnB,CAAA;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAA;IACjC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,yDAAyD,kBAAkB,GAAG,CAC/E,CAAA;IACH,CAAC;IAED,MAAM,iBAAiB,GAAG,IAAI,gCAAiB,CAC7C,WAAW,kBAAkB,wBAAwB,EACrD,IAAI,yCAA0B,CAAC,kBAAkB,EAAE,GAAG,CAAC,CACxD,CAAA;IACD,MAAM,eAAe,GAAG,iBAAiB,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAA;IAC3E,IAAI,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CACT,eAAK,CAAC,KAAK,CAAC,uCAAuC,aAAa,EAAE,CAAC,CACpE,CAAA;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,+BAA+B,aAAa,EAAE,CAAC,CAAC,CAAA;QACvE,MAAM,eAAe,CAAC,MAAM,EAAE,CAAA;QAC9B,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAA;IACzD,CAAC;AACH,CAAC;AAED,wHAAwH;AACjH,KAAK,UAAU,uBAAuB,CAC3C,WAAwB,EACxB,iBAAyB,EACzB,YAAoB,EACpB,QAAgB;IAEhB,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,CAAC,CAAA;IACpC,MAAM,MAAM,GAAG,IAAI,uCAAwB,CACzC,IAAI,EACJ,WAAW,CAAC,qBAAqB,CAClC,CAAA;IAED,IAAI,MAAM,GAAG,IAAI,CAAA;IACjB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAA;IAC1D,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,8BAA8B,YAAY,MAAM,GAAG,CAAC,OAAO,IAAI,GAAG,EAAE,CACrE,CAAA;QACH,CAAC;QACD,MAAM,GAAG,KAAK,CAAA;IAChB,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,IAAI,EACJ,WAAW,CAAC,eAAe,CAC5B,CAAA;IAED,IAAI,MAAM,EAAE,CAAC;QACX,iFAAiF;QACjF,iFAAiF;QACjF,oDAAoD;QACpD,MAAM,MAAM,CAAC,MAAM,CAAC,kBAAkB,CACpC,iBAAiB,EACjB,YAAY,EACZ,KAAK,EACL;YACE,UAAU,EAAE;gBACV,cAAc,EAAE;oBACd;wBACE,QAAQ,EAAE,WAAW,CAAC,eAAe;wBACrC,QAAQ;wBACR,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE;qBAC3D;iBACF;aACF;SACF,CACF,CAAA;QACD,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,iCAAiC,YAAY,EAAE,CAAC,CAAC,CAAA;QACzE,OAAM;IACR,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,yBAAyB,YAAY,EAAE,CAAC,CAAC,CAAA;IAChE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,mBAAmB,CACpD,iBAAiB,EACjB,YAAY,EACZ;QACE,QAAQ;QACR,UAAU,EAAE;YACV,QAAQ,EAAE,WAAW,CAAC,eAAe;YACrC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE;YACtC,uBAAuB,EAAE,KAAK;YAC9B,cAAc,EAAE;gBACd;oBACE,QAAQ,EAAE,WAAW,CAAC,eAAe;oBACrC,QAAQ;oBACR,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE;iBAC3D;aACF;SACF;KACF,CACF,CAAA;IACD,MAAM,MAAM,CAAC,aAAa,EAAE,CAAA;IAC5B,MAAM,UAAU,CAAC,GAAG,YAAY,kBAAkB,CAAC,CAAA;IACnD,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAA;AACnD,CAAC"}

package/dist/infra/config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/infra/config-loader.ts"],"names":[],"mappings":"AAEA,OAAO,EAAqB,WAAW,EAAE,MAAM,SAAS,CAAA;AAExD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,WAAW,CAS1D;AAUD,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAM9E"}
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/infra/config-loader.ts"],"names":[],"mappings":"AAEA,OAAO,EAAqB,WAAW,EAAE,MAAM,SAAS,CAAA;AAExD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,WAAW,CAS1D;AAUD,wBAAsB,eAAe,CACnC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC,CAMtB"}

package/dist/infra/config-loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.js","sourceRoot":"","sources":["../../src/infra/config-loader.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAIA,4CASC;AAUD,0CAMC;AA7BD,6CAA8B;AAC9B,2CAA4B;AAC5B,mCAAwD;AAExD,SAAgB,gBAAgB,CAAC,GAAY;IAC3C,MAAM,MAAM,GAAG,yBAAiB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aACjC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;aAC7D,IAAI,CAAC,IAAI,CAAC,CAAA;QACb,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,EAAE,CAAC,CAAA;IACnD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAA;AACpB,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,UAAkB;IAC9C,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IACtD,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAC5B,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;AAC5B,CAAC;AAEM,KAAK,UAAU,eAAe,CAAC,UAAkB;IACtD,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,0BAA0B,UAAU,EAAE,CAAC,CAAA;IACzD,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,CAAA;IAC5C,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAA;AAC9B,CAAC"}
+{"version":3,"file":"config-loader.js","sourceRoot":"","sources":["../../src/infra/config-loader.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAIA,4CASC;AAUD,0CAQC;AA/BD,6CAA8B;AAC9B,2CAA4B;AAC5B,mCAAwD;AAExD,SAAgB,gBAAgB,CAAC,GAAY;IAC3C,MAAM,MAAM,GAAG,yBAAiB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aACjC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;aAC7D,IAAI,CAAC,IAAI,CAAC,CAAA;QACb,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,EAAE,CAAC,CAAA;IACnD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAA;AACpB,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,UAAkB;IAC9C,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IACtD,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAC5B,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;AAC5B,CAAC;AAEM,KAAK,UAAU,eAAe,CACnC,UAAkB;IAElB,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,0BAA0B,UAAU,EAAE,CAAC,CAAA;IACzD,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,CAAA;IAC5C,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAA;AAC9B,CAAC"}

package/dist/infra/config-writer.js

@@ -45,7 +45,7 @@ function generateSeed() {
 async function writeFuelYml(projectRoot, config, projectName) {
     const output = {
         ...config,
-        ...(projectName ? { name: projectName } : {}),
+        ...(projectName ? { name: projectName } : {})
     };
     await fs.writeFile(path.join(projectRoot, 'fuel.yml'), YAML.stringify(output), 'utf-8');
 }

package/dist/infra/credentials.d.ts

@@ -1,4 +1,4 @@
-import { Credentials, CredentialKey } from './types';
+import { Credentials, CredentialKey, Deployment } from './types';
 /**
  * Resolve credentials by merging sources in priority order:
  * 1. CLI flag overrides (highest)
@@ -7,5 +7,5 @@ import { Credentials, CredentialKey } from './types';
  *
  * Sources are merged per-key — e.g., AWS keys from env + GITHUB_TOKEN from file = valid.
  */
-export declare function resolveCredentials(searchDir?: string, overrides?: Partial<Record<CredentialKey, string>>): Promise<Credentials>;
+export declare function resolveCredentials(searchDir?: string, overrides?: Partial<Record<CredentialKey, string>>, deployment?: Deployment): Promise<Credentials>;
 //# sourceMappingURL=credentials.d.ts.map

package/dist/infra/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/infra/credentials.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAA4B,aAAa,EAAE,MAAM,SAAS,CAAA;AAgB9E;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,GACjD,OAAO,CAAC,WAAW,CAAC,CAkCtB"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/infra/credentials.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,WAAW,EAEX,aAAa,EACb,UAAU,EAEX,MAAM,SAAS,CAAA;AAkBhB;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,EAClD,UAAU,GAAE,UAAkB,GAC7B,OAAO,CAAC,WAAW,CAAC,CAqCtB"}

package/dist/infra/credentials.js

@@ -61,7 +61,8 @@ async function tryReadCredentialsFile(credPath) {
  *
  * Sources are merged per-key — e.g., AWS keys from env + GITHUB_TOKEN from file = valid.
  */
-async function resolveCredentials(searchDir, overrides) {
+async function resolveCredentials(searchDir, overrides, deployment = 'ecs') {
+    const requiredKeys = (0, types_1.requiredCredentialKeysFor)(deployment);
     // Collect file values from searchDir and CWD
     const credPath = searchDir
         ? path.join(searchDir, '.fuel-credentials')
@@ -83,10 +84,13 @@ async function resolveCredentials(searchDir, overrides) {
                 process.env[key] ||
                 undefined;
     }
-    const missing = types_1.REQUIRED_CREDENTIAL_KEYS.filter((k) => !resolved[k]);
+    const missing = requiredKeys.filter((k) => !resolved[k]);
     if (missing.length > 0) {
-        throw new Error(`Missing credentials: ${missing.join(', ')}\n` +
-            `Provide them via CLI flags, .fuel-credentials file, or environment variables.`);
+        const missingGitHubOnly = missing.every((k) => k.startsWith('GITHUB_'));
+        const hint = missingGitHubOnly
+            ? 'Run "fuel auth:init" to set up GitHub credentials interactively (guides you to a token with the right permissions), or provide them via CLI flags, .fuel-credentials, or environment variables.'
+            : 'Provide them via CLI flags, .fuel-credentials file, or environment variables.';
+        throw new Error(`Missing credentials: ${missing.join(', ')}\n${hint}`);
     }
     return resolved;
 }

package/dist/infra/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/infra/credentials.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,gDAqCC;AA/DD,2CAA4B;AAC5B,6CAA8B;AAC9B,mCAA8E;AAE9E,KAAK,UAAU,sBAAsB,CAAC,QAAgB;IACpD,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,EAAE,CAAA;IAC/C,IAAI,CAAC;QACH,MAAM,IAAI,GAA2B,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAChE,MAAM,MAAM,GAA2C,EAAE,CAAA;QACzD,KAAK,MAAM,GAAG,IAAI,gCAAwB,EAAE,CAAC;YAC3C,IAAI,IAAI,CAAC,GAAG,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAA;QACxC,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,kBAAkB,CACtC,SAAkB,EAClB,SAAkD;IAElD,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,SAAS;QACxB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC;QAC3C,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAA;IACrC,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAA;IAEzD,wDAAwD;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;IACzB,IAAI,SAAS,GAA2C,EAAE,CAAA;IAC1D,IAAI,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,GAAG,EAAE,CAAC;QACjD,SAAS,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAA;IAC7E,CAAC;IAED,iEAAiE;IACjE,MAAM,QAAQ,GAA2C,EAAE,CAAA;IAC3D,KAAK,MAAM,GAAG,IAAI,gCAAwB,EAAE,CAAC;QAC3C,QAAQ,CAAC,GAAG,CAAC;YACX,SAAS,EAAE,CAAC,GAAG,CAAC;gBAChB,UAAU,CAAC,GAAG,CAAC;gBACf,SAAS,CAAC,GAAG,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;gBAChB,SAAS,CAAA;IACb,CAAC;IAED,MAAM,OAAO,GAAG,gCAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IACpE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,wBAAwB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC5C,+EAA+E,CAClF,CAAA;IACH,CAAC;IAED,OAAO,QAAuB,CAAA;AAChC,CAAC"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/infra/credentials.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCA,gDAyCC;AA3ED,2CAA4B;AAC5B,6CAA8B;AAC9B,mCAMgB;AAEhB,KAAK,UAAU,sBAAsB,CACnC,QAAgB;IAEhB,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,EAAE,CAAA;IAC/C,IAAI,CAAC;QACH,MAAM,IAAI,GAA2B,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAChE,MAAM,MAAM,GAA2C,EAAE,CAAA;QACzD,KAAK,MAAM,GAAG,IAAI,gCAAwB,EAAE,CAAC;YAC3C,IAAI,IAAI,CAAC,GAAG,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAA;QACxC,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,kBAAkB,CACtC,SAAkB,EAClB,SAAkD,EAClD,aAAyB,KAAK;IAE9B,MAAM,YAAY,GAAG,IAAA,iCAAyB,EAAC,UAAU,CAAC,CAAA;IAE1D,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,SAAS;QACxB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC;QAC3C,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAA;IACrC,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAA;IAEzD,wDAAwD;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;IACzB,IAAI,SAAS,GAA2C,EAAE,CAAA;IAC1D,IAAI,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,GAAG,EAAE,CAAC;QACjD,SAAS,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAA;IAC7E,CAAC;IAED,iEAAiE;IACjE,MAAM,QAAQ,GAA2C,EAAE,CAAA;IAC3D,KAAK,MAAM,GAAG,IAAI,gCAAwB,EAAE,CAAC;QAC3C,QAAQ,CAAC,GAAG,CAAC;YACX,SAAS,EAAE,CAAC,GAAG,CAAC;gBAChB,UAAU,CAAC,GAAG,CAAC;gBACf,SAAS,CAAC,GAAG,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;gBAChB,SAAS,CAAA;IACb,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IACxD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,iBAAiB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;QACvE,MAAM,IAAI,GAAG,iBAAiB;YAC5B,CAAC,CAAC,iMAAiM;YACnM,CAAC,CAAC,+EAA+E,CAAA;QACnF,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,OAAO,QAAuB,CAAA;AAChC,CAAC"}

package/dist/infra/dependency-checker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dependency-checker.d.ts","sourceRoot":"","sources":["../../src/infra/dependency-checker.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,gBAAgB,CAAA;AAEhE,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,cAAc,CAAA;CAC/B;AAaD,eAAO,MAAM,oBAAoB,QAAO,cAMvC,CAAA;AAED,eAAO,MAAM,wBAAwB,QAAO,IAM3C,CAAA;AAED,eAAO,MAAM,yBAAyB,QAAO,IAM5C,CAAA;AAED,eAAO,MAAM,wBAAwB,QAAO,sBAK3C,CAAA"}
+{"version":3,"file":"dependency-checker.d.ts","sourceRoot":"","sources":["../../src/infra/dependency-checker.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,gBAAgB,CAAA;AAEhE,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,cAAc,CAAA;CAC/B;AAeD,eAAO,MAAM,oBAAoB,QAAO,cAMvC,CAAA;AAED,eAAO,MAAM,wBAAwB,QAAO,IAM3C,CAAA;AAED,eAAO,MAAM,yBAAyB,QAAO,IAM5C,CAAA;AAED,eAAO,MAAM,wBAAwB,QAAO,sBAK3C,CAAA"}

package/dist/infra/dependency-checker.js.map

@@ -1 +1 @@
-{"version":3,"file":"dependency-checker.js","sourceRoot":"","sources":["../../src/infra/dependency-checker.ts"],"names":[],"mappings":";;;AAAA,iDAAwC;AAQxC,MAAM,GAAG,GAAG,CAAC,OAAe,EAAU,EAAE,CACtC,IAAA,wBAAQ,EAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;AAE7E,MAAM,MAAM,GAAG,CAAC,OAAe,EAAgD,EAAE;IAC/E,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAA;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAA;IACtB,CAAC;AACH,CAAC,CAAA;AAEM,MAAM,oBAAoB,GAAG,GAAmB,EAAE;IACvD,IAAI,MAAM,CAAC,wBAAwB,CAAC,CAAC,EAAE;QAAE,OAAO,gBAAgB,CAAA;IAChE,IAAI,MAAM,CAAC,0BAA0B,CAAC,CAAC,EAAE;QAAE,OAAO,gBAAgB,CAAA;IAClE,MAAM,IAAI,KAAK,CACb,4HAA4H,CAC7H,CAAA;AACH,CAAC,CAAA;AANY,QAAA,oBAAoB,wBAMhC;AAEM,MAAM,wBAAwB,GAAG,GAAS,EAAE;IACjD,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAA;IACH,CAAC;AACH,CAAC,CAAA;AANY,QAAA,wBAAwB,4BAMpC;AAEM,MAAM,yBAAyB,GAAG,GAAS,EAAE;IAClD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,4FAA4F,CAC7F,CAAA;IACH,CAAC;AACH,CAAC,CAAA;AANY,QAAA,yBAAyB,6BAMrC;AAEM,MAAM,wBAAwB,GAAG,GAA2B,EAAE;IACnE,IAAA,gCAAwB,GAAE,CAAA;IAC1B,IAAA,iCAAyB,GAAE,CAAA;IAC3B,MAAM,cAAc,GAAG,IAAA,4BAAoB,GAAE,CAAA;IAC7C,OAAO,EAAE,cAAc,EAAE,CAAA;AAC3B,CAAC,CAAA;AALY,QAAA,wBAAwB,4BAKpC"}
+{"version":3,"file":"dependency-checker.js","sourceRoot":"","sources":["../../src/infra/dependency-checker.ts"],"names":[],"mappings":";;;AAAA,iDAAwC;AAQxC,MAAM,GAAG,GAAG,CAAC,OAAe,EAAU,EAAE,CACtC,IAAA,wBAAQ,EAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;AAE7E,MAAM,MAAM,GAAG,CACb,OAAe,EAC+B,EAAE;IAChD,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAA;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAA;IACtB,CAAC;AACH,CAAC,CAAA;AAEM,MAAM,oBAAoB,GAAG,GAAmB,EAAE;IACvD,IAAI,MAAM,CAAC,wBAAwB,CAAC,CAAC,EAAE;QAAE,OAAO,gBAAgB,CAAA;IAChE,IAAI,MAAM,CAAC,0BAA0B,CAAC,CAAC,EAAE;QAAE,OAAO,gBAAgB,CAAA;IAClE,MAAM,IAAI,KAAK,CACb,4HAA4H,CAC7H,CAAA;AACH,CAAC,CAAA;AANY,QAAA,oBAAoB,wBAMhC;AAEM,MAAM,wBAAwB,GAAG,GAAS,EAAE;IACjD,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAA;IACH,CAAC;AACH,CAAC,CAAA;AANY,QAAA,wBAAwB,4BAMpC;AAEM,MAAM,yBAAyB,GAAG,GAAS,EAAE;IAClD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,4FAA4F,CAC7F,CAAA;IACH,CAAC;AACH,CAAC,CAAA;AANY,QAAA,yBAAyB,6BAMrC;AAEM,MAAM,wBAAwB,GAAG,GAA2B,EAAE;IACnE,IAAA,gCAAwB,GAAE,CAAA;IAC1B,IAAA,iCAAyB,GAAE,CAAA;IAC3B,MAAM,cAAc,GAAG,IAAA,4BAAoB,GAAE,CAAA;IAC7C,OAAO,EAAE,cAAc,EAAE,CAAA;AAC3B,CAAC,CAAA;AALY,QAAA,wBAAwB,4BAKpC"}

package/dist/infra/deployment-detect.d.ts

@@ -0,0 +1,9 @@
+import { Deployment } from './types';
+/**
+ * Infers the deployment provider from an already-generated /infra folder,
+ * for flows that need it before fuel.yml/the remote secret has been read
+ * (e.g. `--tofu-only`, `infra:pull`). Based on which provider block
+ * providers.tf declares.
+ */
+export declare function detectDeploymentFromInfraDir(infraDir: string): Promise<Deployment>;
+//# sourceMappingURL=deployment-detect.d.ts.map

package/dist/infra/deployment-detect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-detect.d.ts","sourceRoot":"","sources":["../../src/infra/deployment-detect.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAEpC;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAChD,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC,CAOrB"}

package/dist/infra/deployment-detect.js

@@ -0,0 +1,53 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectDeploymentFromInfraDir = detectDeploymentFromInfraDir;
+const path = __importStar(require("path"));
+const fs = __importStar(require("fs-extra"));
+/**
+ * Infers the deployment provider from an already-generated /infra folder,
+ * for flows that need it before fuel.yml/the remote secret has been read
+ * (e.g. `--tofu-only`, `infra:pull`). Based on which provider block
+ * providers.tf declares.
+ */
+async function detectDeploymentFromInfraDir(infraDir) {
+    const providersPath = path.join(infraDir, 'providers.tf');
+    if (!(await fs.pathExists(providersPath))) {
+        return 'ecs';
+    }
+    const content = await fs.readFile(providersPath, 'utf-8');
+    return content.includes('azurerm') ? 'azure' : 'ecs';
+}
+//# sourceMappingURL=deployment-detect.js.map

package/dist/infra/deployment-detect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-detect.js","sourceRoot":"","sources":["../../src/infra/deployment-detect.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUA,oEASC;AAnBD,2CAA4B;AAC5B,6CAA8B;AAG9B;;;;;GAKG;AACI,KAAK,UAAU,4BAA4B,CAChD,QAAgB;IAEhB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;IACzD,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IACzD,OAAO,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAA;AACtD,CAAC"}

package/dist/infra/git-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git-client.d.ts","sourceRoot":"","sources":["../../src/infra/git-client.ts"],"names":[],"mappings":"AAgCA,wBAAsB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWtF;AAED,wBAAsB,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAarF;AAED,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAAE,EAClB,SAAS,CAAC,EAAE,OAAO,GAClB,OAAO,CAAC,IAAI,CAAC,CAoCf"}
+{"version":3,"file":"git-client.d.ts","sourceRoot":"","sources":["../../src/infra/git-client.ts"],"names":[],"mappings":"AAgCA,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAmBf;AAED,wBAAsB,SAAS,CAC7B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC,CAqBlB;AAED,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAAE,EAClB,SAAS,CAAC,EAAE,OAAO,GAClB,OAAO,CAAC,IAAI,CAAC,CAmCf"}

package/dist/infra/git-client.js

@@ -52,17 +52,13 @@ async function pushToRemote(projectDir, githubToken, branches, forcePush) {
     await spawnSimple('git', ['remote', 'set-url', 'origin', authUrl], projectDir);
     try {
         for (const branch of branches) {
-            // Create local branch if it doesn't exist (non-main branches)
-            const branchCheck = await spawnQuiet('git', ['rev-parse', '--verify', branch], projectDir);
-            if (branchCheck.code !== 0) {
-                const createResult = await spawnSimple('git', ['branch', branch], projectDir);
-                if (createResult.code !== 0) {
-                    throw new Error(`Failed to create local branch: ${branch}`);
-                }
-            }
+            // Push the current HEAD directly to the remote branch via an explicit
+            // refspec (HEAD:<branch>). This avoids depending on a local branch ref —
+            // which would not advance between successive pushes — so the second push
+            // of a two-phase deploy lands as a clean fast-forward on the remote.
             const pushArgs = forcePush
-                ? ['push', '--force', '-u', 'origin', branch]
-                : ['push', '-u', 'origin', branch];
+                ? ['push', '--force', '-u', 'origin', `HEAD:${branch}`]
+                : ['push', '-u', 'origin', `HEAD:${branch}`];
             const pushResult = await spawnSimple('git', pushArgs, projectDir);
             if (pushResult.code !== 0) {
                 throw new Error(`Failed to push branch: ${branch}`);