@swovohq/fuel 0.2.2-alpha.9 → 0.2.2-alpha.91

package/dist/infra/git-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"git-client.js","sourceRoot":"","sources":["../../src/infra/git-client.ts"],"names":[],"mappings":";;AAgCA,sCAWC;AAED,8BAaC;AAED,oCAyCC;AArGD,iDAAqC;AAErC,SAAS,WAAW,CAClB,GAAW,EACX,IAAc,EACd,GAAW;IAEX,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,IAAA,qBAAK,EAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,EAAE;YACvC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAA;QAC9B,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,UAAU,CACjB,GAAW,EACX,IAAc,EACd,GAAW;IAEX,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,IAAA,qBAAK,EAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QACvE,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACvC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAA;QAC5B,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,EAAE;YACvC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QACrD,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAEM,KAAK,UAAU,aAAa,CAAC,UAAkB,EAAE,OAAe;IACrE,6DAA6D;IAC7D,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,CAAA;IAElG,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,CAAA;QAE3F,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,sCAAsC,OAAO,EAAE,CAAC,CAAA;QAClE,CAAC;IACH,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,SAAS,CAAC,UAAkB,EAAE,OAAe;IACjE,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,UAAU,CAAC,CAAA;IAEnD,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,UAAU,CAAC,CAAA;IACvF,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,CAAA;IACpF,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAA;IACjD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAEM,KAAK,UAAU,YAAY,CAChC,UAAkB,EAClB,WAAmB,EACnB,QAAkB,EAClB,SAAmB;IAEnB,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,UAAU,CAC9C,KAAK,EACL,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAC/B,UAAU,CACX,CAAA;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CACjC,qBAAqB,EACrB,0BAA0B,WAAW,cAAc,CACpD,CAAA;IAED,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,CAAA;IAE9E,IAAI,CAAC;QACH,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;YAC9B,8DAA8D;YAC9D,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,CAAA;YAC1F,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBAC3B,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,CAAA;gBAC7E,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;oBAC5B,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,EAAE,CAAC,CAAA;gBAC7D,CAAC;YACH,CAAC;YAED,MAAM,QAAQ,GAAG,SAAS;gBACxB,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC;gBAC7C,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;YACpC,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAA;YACjE,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,EAAE,CAAC,CAAA;YACrD,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,UAAU,CAAC,CAAA;IACpF,CAAC;AACH,CAAC"}
+{"version":3,"file":"git-client.js","sourceRoot":"","sources":["../../src/infra/git-client.ts"],"names":[],"mappings":";;AAgCA,sCAsBC;AAED,8BAwBC;AAED,oCAwCC;AA1HD,iDAAqC;AAErC,SAAS,WAAW,CAClB,GAAW,EACX,IAAc,EACd,GAAW;IAEX,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,IAAA,qBAAK,EAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,EAAE;YACvC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAA;QAC9B,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,UAAU,CACjB,GAAW,EACX,IAAc,EACd,GAAW;IAEX,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,IAAA,qBAAK,EAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QACvE,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACvC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAA;QAC5B,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,EAAE;YACvC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QACrD,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAEM,KAAK,UAAU,aAAa,CACjC,UAAkB,EAClB,OAAe;IAEf,6DAA6D;IAC7D,MAAM,YAAY,GAAG,MAAM,UAAU,CACnC,KAAK,EACL,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,EACxC,UAAU,CACX,CAAA;IAED,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,MAAM,UAAU,CAChC,KAAK,EACL,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,EACpC,UAAU,CACX,CAAA;QAED,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,sCAAsC,OAAO,EAAE,CAAC,CAAA;QAClE,CAAC;IACH,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,SAAS,CAC7B,UAAkB,EAClB,OAAe;IAEf,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,UAAU,CAAC,CAAA;IAEnD,MAAM,UAAU,GAAG,MAAM,UAAU,CACjC,KAAK,EACL,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,EAC/B,UAAU,CACX,CAAA;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,WAAW,CACpC,KAAK,EACL,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,EACzB,UAAU,CACX,CAAA;IACD,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAA;IACjD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAEM,KAAK,UAAU,YAAY,CAChC,UAAkB,EAClB,WAAmB,EACnB,QAAkB,EAClB,SAAmB;IAEnB,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,UAAU,CAC9C,KAAK,EACL,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAC/B,UAAU,CACX,CAAA;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CACjC,qBAAqB,EACrB,0BAA0B,WAAW,cAAc,CACpD,CAAA;IAED,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,CAAA;IAE9E,IAAI,CAAC;QACH,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;YAC9B,sEAAsE;YACtE,yEAAyE;YACzE,yEAAyE;YACzE,qEAAqE;YACrE,MAAM,QAAQ,GAAG,SAAS;gBACxB,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,MAAM,EAAE,CAAC;gBACvD,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,MAAM,EAAE,CAAC,CAAA;YAC9C,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAA;YACjE,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,EAAE,CAAC,CAAA;YACrD,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,WAAW,CACf,KAAK,EACL,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAC,EAC5C,UAAU,CACX,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/infra/github-client.d.ts

@@ -1,3 +1,10 @@
+/**
+ * Verifies the GitHub token authenticates and — for classic PATs, which report their
+ * scopes via the `x-oauth-scopes` response header — that it has repo push/admin access.
+ * Fine-grained PATs don't expose scopes this way, so we can only confirm those authenticate.
+ */
+export declare function validateGitHubToken(token: string): Promise<void>;
+export declare function repoExists(token: string, org: string, name: string): Promise<boolean>;
 export declare function createGitHubRepo(token: string, org: string, name: string): Promise<{
     name: string;
     htmlUrl: string;

package/dist/infra/github-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"github-client.d.ts","sourceRoot":"","sources":["../../src/infra/github-client.ts"],"names":[],"mappings":"AAEA,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAY5C;AAED,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAmBf"}
+{"version":3,"file":"github-client.d.ts","sourceRoot":"","sources":["../../src/infra/github-client.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA2BtE;AAED,wBAAsB,UAAU,CAC9B,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,CAAC,CASlB;AAED,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAY5C;AAED,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAgBf"}

package/dist/infra/github-client.js

@@ -1,8 +1,51 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateGitHubToken = validateGitHubToken;
+exports.repoExists = repoExists;
 exports.createGitHubRepo = createGitHubRepo;
 exports.setBranchProtection = setBranchProtection;
 const rest_1 = require("@octokit/rest");
+const REQUIRED_SCOPES = ['repo', 'public_repo'];
+/**
+ * Verifies the GitHub token authenticates and — for classic PATs, which report their
+ * scopes via the `x-oauth-scopes` response header — that it has repo push/admin access.
+ * Fine-grained PATs don't expose scopes this way, so we can only confirm those authenticate.
+ */
+async function validateGitHubToken(token) {
+    const octokit = new rest_1.Octokit({ auth: token });
+    let scopesHeader;
+    try {
+        const response = await octokit.request('GET /user');
+        scopesHeader = response.headers['x-oauth-scopes'];
+    }
+    catch (err) {
+        throw new Error(`GitHub token is invalid or expired: ${err.message || err}`);
+    }
+    if (scopesHeader === undefined) {
+        // Fine-grained PAT — no scopes header to check. Token authenticates; proceed.
+        return;
+    }
+    const scopes = scopesHeader
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean);
+    if (!scopes.some((s) => REQUIRED_SCOPES.includes(s))) {
+        throw new Error(`GitHub token is missing the "repo" scope (found: ${scopes.join(', ') || 'none'}). ` +
+            'Regenerate a classic Personal Access Token with the "repo" scope so the CLI can create the repo, push code, and set branch protections.');
+    }
+}
+async function repoExists(token, org, name) {
+    const octokit = new rest_1.Octokit({ auth: token });
+    try {
+        await octokit.rest.repos.get({ owner: org, repo: name });
+        return true;
+    }
+    catch (err) {
+        if (err?.status === 404)
+            return false;
+        throw err;
+    }
+}
 async function createGitHubRepo(token, org, name) {
     const octokit = new rest_1.Octokit({ auth: token });
     const { data } = await octokit.rest.repos.createInOrg({
@@ -10,7 +53,7 @@ async function createGitHubRepo(token, org, name) {
         name,
         auto_init: false,
         visibility: 'private',
-        description: 'FUEL Monorepo — generated by Fuel CLI',
+        description: 'FUEL Monorepo — generated by Fuel CLI'
     });
     return { name: data.name, htmlUrl: data.html_url };
 }
@@ -23,14 +66,11 @@ async function setBranchProtection(token, owner, repo, branch) {
         enforce_admins: false,
         required_pull_request_reviews: {
             required_approving_review_count: 1,
-            dismiss_stale_reviews: true,
-        },
-        required_status_checks: {
-            strict: true,
-            contexts: ['Title matches Jira Issue'],
+            dismiss_stale_reviews: true
         },
+        required_status_checks: null,
         restrictions: null,
-        allow_deletions: false,
+        allow_deletions: false
     });
 }
 //# sourceMappingURL=github-client.js.map

package/dist/infra/github-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"github-client.js","sourceRoot":"","sources":["../../src/infra/github-client.ts"],"names":[],"mappings":";;AAEA,4CAgBC;AAED,kDAwBC;AA5CD,wCAAuC;AAEhC,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,GAAW,EACX,IAAY;IAEZ,MAAM,OAAO,GAAG,IAAI,cAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAE5C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;QACpD,GAAG;QACH,IAAI;QACJ,SAAS,EAAE,KAAK;QAChB,UAAU,EAAE,SAAS;QACrB,WAAW,EAAE,uCAAuC;KACrD,CAAC,CAAA;IAEF,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAA;AACpD,CAAC;AAEM,KAAK,UAAU,mBAAmB,CACvC,KAAa,EACb,KAAa,EACb,IAAY,EACZ,MAAc;IAEd,MAAM,OAAO,GAAG,IAAI,cAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAE5C,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC;QAC9C,KAAK;QACL,IAAI;QACJ,MAAM;QACN,cAAc,EAAE,KAAK;QACrB,6BAA6B,EAAE;YAC7B,+BAA+B,EAAE,CAAC;YAClC,qBAAqB,EAAE,IAAI;SAC5B;QACD,sBAAsB,EAAE;YACtB,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,CAAC,0BAA0B,CAAC;SACvC;QACD,YAAY,EAAE,IAAI;QAClB,eAAe,EAAE,KAAK;KACvB,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"github-client.js","sourceRoot":"","sources":["../../src/infra/github-client.ts"],"names":[],"mappings":";;AASA,kDA2BC;AAED,gCAaC;AAED,4CAgBC;AAED,kDAqBC;AA5FD,wCAAuC;AAEvC,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;AAE/C;;;;GAIG;AACI,KAAK,UAAU,mBAAmB,CAAC,KAAa;IACrD,MAAM,OAAO,GAAG,IAAI,cAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAE5C,IAAI,YAAgC,CAAA;IACpC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QACnD,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAA;IACzE,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,uCAAuC,GAAG,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC,CAAA;IAC9E,CAAC;IAED,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,8EAA8E;QAC9E,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,YAAY;SACxB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAA;IAElB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,oDAAoD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK;YAClF,yIAAyI,CAC5I,CAAA;IACH,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,UAAU,CAC9B,KAAa,EACb,GAAW,EACX,IAAY;IAEZ,MAAM,OAAO,GAAG,IAAI,cAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC5C,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACxD,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,MAAM,KAAK,GAAG;YAAE,OAAO,KAAK,CAAA;QACrC,MAAM,GAAG,CAAA;IACX,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,GAAW,EACX,IAAY;IAEZ,MAAM,OAAO,GAAG,IAAI,cAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAE5C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;QACpD,GAAG;QACH,IAAI;QACJ,SAAS,EAAE,KAAK;QAChB,UAAU,EAAE,SAAS;QACrB,WAAW,EAAE,uCAAuC;KACrD,CAAC,CAAA;IAEF,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAA;AACpD,CAAC;AAEM,KAAK,UAAU,mBAAmB,CACvC,KAAa,EACb,KAAa,EACb,IAAY,EACZ,MAAc;IAEd,MAAM,OAAO,GAAG,IAAI,cAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAE5C,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC;QAC9C,KAAK;QACL,IAAI;QACJ,MAAM;QACN,cAAc,EAAE,KAAK;QACrB,6BAA6B,EAAE;YAC7B,+BAA+B,EAAE,CAAC;YAClC,qBAAqB,EAAE,IAAI;SAC5B;QACD,sBAAsB,EAAE,IAAI;QAC5B,YAAY,EAAE,IAAI;QAClB,eAAe,EAAE,KAAK;KACvB,CAAC,CAAA;AACJ,CAAC"}

package/dist/infra/github-secrets-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"github-secrets-client.d.ts","sourceRoot":"","sources":["../../src/infra/github-secrets-client.ts"],"names":[],"mappings":"AAGA,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,OAAO,CAAC,IAAI,CAAC,CAIf"}
+{"version":3,"file":"github-secrets-client.d.ts","sourceRoot":"","sources":["../../src/infra/github-secrets-client.ts"],"names":[],"mappings":"AAGA,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CA+Bf;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,OAAO,CAAC,IAAI,CAAC,CAIf"}

package/dist/infra/github-secrets-client.js

@@ -13,7 +13,7 @@ async function setRepoSecret(token, owner, repo, secretName, secretValue) {
     // Fetch the repo's public key for secret encryption
     const { data: keyData } = await octokit.rest.actions.getRepoPublicKey({
         owner,
-        repo,
+        repo
     });
     // Encrypt the secret value using libsodium crypto_box_seal
     const binkey = libsodium_wrappers_1.default.from_base64(keyData.key, libsodium_wrappers_1.default.base64_variants.ORIGINAL);
@@ -26,7 +26,7 @@ async function setRepoSecret(token, owner, repo, secretName, secretValue) {
         repo,
         secret_name: secretName,
         encrypted_value: encryptedValue,
-        key_id: keyData.key_id,
+        key_id: keyData.key_id
     });
 }
 async function setRepoSecrets(token, owner, repo, secrets) {

package/dist/infra/github-secrets-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"github-secrets-client.js","sourceRoot":"","sources":["../../src/infra/github-secrets-client.ts"],"names":[],"mappings":";;;;;AAGA,sCA+BC;AAED,wCASC;AA7CD,wCAAuC;AACvC,4EAAuC;AAEhC,KAAK,UAAU,aAAa,CACjC,KAAa,EACb,KAAa,EACb,IAAY,EACZ,UAAkB,EAClB,WAAmB;IAEnB,MAAM,4BAAM,CAAC,KAAK,CAAA;IAElB,MAAM,OAAO,GAAG,IAAI,cAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAE5C,oDAAoD;IACpD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;QACpE,KAAK;QACL,IAAI;KACL,CAAC,CAAA;IAEF,2DAA2D;IAC3D,MAAM,MAAM,GAAG,4BAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,4BAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAA;IAC/E,MAAM,MAAM,GAAG,4BAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA;IAC9C,MAAM,QAAQ,GAAG,4BAAM,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACvD,MAAM,cAAc,GAAG,4BAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,4BAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAA;IAElF,8BAA8B;IAC9B,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC;QAClD,KAAK;QACL,IAAI;QACJ,WAAW,EAAE,UAAU;QACvB,eAAe,EAAE,cAAc;QAC/B,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAA;AACJ,CAAC;AAEM,KAAK,UAAU,cAAc,CAClC,KAAa,EACb,KAAa,EACb,IAAY,EACZ,OAA+B;IAE/B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;IACtD,CAAC;AACH,CAAC"}
+{"version":3,"file":"github-secrets-client.js","sourceRoot":"","sources":["../../src/infra/github-secrets-client.ts"],"names":[],"mappings":";;;;;AAGA,sCAqCC;AAED,wCASC;AAnDD,wCAAuC;AACvC,4EAAuC;AAEhC,KAAK,UAAU,aAAa,CACjC,KAAa,EACb,KAAa,EACb,IAAY,EACZ,UAAkB,EAClB,WAAmB;IAEnB,MAAM,4BAAM,CAAC,KAAK,CAAA;IAElB,MAAM,OAAO,GAAG,IAAI,cAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAE5C,oDAAoD;IACpD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;QACpE,KAAK;QACL,IAAI;KACL,CAAC,CAAA;IAEF,2DAA2D;IAC3D,MAAM,MAAM,GAAG,4BAAM,CAAC,WAAW,CAC/B,OAAO,CAAC,GAAG,EACX,4BAAM,CAAC,eAAe,CAAC,QAAQ,CAChC,CAAA;IACD,MAAM,MAAM,GAAG,4BAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA;IAC9C,MAAM,QAAQ,GAAG,4BAAM,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACvD,MAAM,cAAc,GAAG,4BAAM,CAAC,SAAS,CACrC,QAAQ,EACR,4BAAM,CAAC,eAAe,CAAC,QAAQ,CAChC,CAAA;IAED,8BAA8B;IAC9B,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC;QAClD,KAAK;QACL,IAAI;QACJ,WAAW,EAAE,UAAU;QACvB,eAAe,EAAE,cAAc;QAC/B,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAA;AACJ,CAAC;AAEM,KAAK,UAAU,cAAc,CAClC,KAAa,EACb,KAAa,EACb,IAAY,EACZ,OAA+B;IAE/B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;IACtD,CAAC;AACH,CAAC"}

package/dist/infra/github-token-link.d.ts

@@ -0,0 +1,4 @@
+/** Builds a GitHub token-creation URL with the CLI's required scope(s) pre-selected. */
+export declare function buildGitHubTokenUrl(description?: string): string;
+export declare function openInBrowser(url: string): void;
+//# sourceMappingURL=github-token-link.d.ts.map

package/dist/infra/github-token-link.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-token-link.d.ts","sourceRoot":"","sources":["../../src/infra/github-token-link.ts"],"names":[],"mappings":"AAQA,wFAAwF;AACxF,wBAAgB,mBAAmB,CAAC,WAAW,SAAa,GAAG,MAAM,CAMpE;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAY/C"}

package/dist/infra/github-token-link.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildGitHubTokenUrl = buildGitHubTokenUrl;
+exports.openInBrowser = openInBrowser;
+const child_process_1 = require("child_process");
+// The single scope every CLI-driven GitHub operation needs (create repo, push,
+// set branch protection, configure Actions secrets). Pre-selecting it on the
+// token creation page means the user never has to know or look up which
+// checkbox to tick.
+const REQUIRED_SCOPES = ['repo'];
+/** Builds a GitHub token-creation URL with the CLI's required scope(s) pre-selected. */
+function buildGitHubTokenUrl(description = 'Fuel CLI') {
+    const params = new URLSearchParams({
+        scopes: REQUIRED_SCOPES.join(','),
+        description
+    });
+    return `https://github.com/settings/tokens/new?${params.toString()}`;
+}
+function openInBrowser(url) {
+    const cmd = process.platform === 'darwin'
+        ? 'open'
+        : process.platform === 'win32'
+            ? 'start'
+            : 'xdg-open';
+    try {
+        (0, child_process_1.exec)(`${cmd} "${url}"`);
+    }
+    catch {
+        // Best-effort — the link is already printed for the user to open manually.
+    }
+}
+//# sourceMappingURL=github-token-link.js.map

package/dist/infra/github-token-link.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-token-link.js","sourceRoot":"","sources":["../../src/infra/github-token-link.ts"],"names":[],"mappings":";;AASA,kDAMC;AAED,sCAYC;AA7BD,iDAAoC;AAEpC,+EAA+E;AAC/E,6EAA6E;AAC7E,wEAAwE;AACxE,oBAAoB;AACpB,MAAM,eAAe,GAAG,CAAC,MAAM,CAAC,CAAA;AAEhC,wFAAwF;AACxF,SAAgB,mBAAmB,CAAC,WAAW,GAAG,UAAU;IAC1D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;QACjC,WAAW;KACZ,CAAC,CAAA;IACF,OAAO,0CAA0C,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;AACtE,CAAC;AAED,SAAgB,aAAa,CAAC,GAAW;IACvC,MAAM,GAAG,GACP,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAC3B,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC5B,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,UAAU,CAAA;IAClB,IAAI,CAAC;QACH,IAAA,oBAAI,EAAC,GAAG,GAAG,KAAK,GAAG,GAAG,CAAC,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;IAC7E,CAAC;AACH,CAAC"}

package/dist/infra/orchestrator.d.ts

@@ -6,5 +6,8 @@ export interface OrchestratorOptions {
     forcePush?: boolean;
     skipBranchProtection?: boolean;
 }
-export declare function runInfraOrchestrator(targetRoot: string, _appName: string, config: InfraConfig, credentials: Credentials, options?: OrchestratorOptions): Promise<void>;
+export interface OrchestratorResult {
+    codePushed: boolean;
+}
+export declare function runInfraOrchestrator(targetRoot: string, _appName: string, config: InfraConfig, credentials: Credentials, options?: OrchestratorOptions): Promise<OrchestratorResult | undefined>;
 //# sourceMappingURL=orchestrator.d.ts.map

package/dist/infra/orchestrator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orchestrator.d.ts","sourceRoot":"","sources":["../../src/infra/orchestrator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAqDlD,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,WAAW,EACnB,WAAW,EAAE,WAAW,EACxB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,IAAI,CAAC,CA0Jf"}
+{"version":3,"file":"orchestrator.d.ts","sourceRoot":"","sources":["../../src/infra/orchestrator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAgHlD,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,OAAO,CAAA;CACpB;AA4aD,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,WAAW,EACnB,WAAW,EAAE,WAAW,EACxB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAKzC"}

package/dist/infra/orchestrator.js

@@ -41,22 +41,25 @@ const path = __importStar(require("path"));
 const chalk_1 = __importDefault(require("chalk"));
 const tofu_runner_1 = require("./tofu-runner");
 const secrets_manager_client_1 = require("./secrets-manager-client");
+const azure_keyvault_client_1 = require("./azure-keyvault-client");
 const config_writer_1 = require("./config-writer");
 const git_client_1 = require("./git-client");
 const github_client_1 = require("./github-client");
 const github_secrets_client_1 = require("./github-secrets-client");
 const subprocess_1 = require("./subprocess");
 const s3_state_bucket_1 = require("./s3-state-bucket");
+const azure_state_storage_1 = require("./azure-state-storage");
+const azure_rbac_1 = require("./azure-rbac");
 function slugify(name) {
     return name.replace(/[^a-z0-9]/gi, '_').toLowerCase();
 }
-async function runCompensation(infraDir, credentials, tofuVars) {
+async function runAwsCompensation(infraDir, credentials, tofuVars) {
     console.log(chalk_1.default.red('\n--- Cleaning up AWS resources ---'));
-    const args = (0, tofu_runner_1.buildDestroyArgs)(credentials, tofuVars);
+    const args = (0, tofu_runner_1.buildDestroyArgs)(credentials, tofuVars, 'ecs');
     const awsEnv = {
         AWS_ACCESS_KEY_ID: credentials.AWS_ACCESS_KEY_ID,
         AWS_SECRET_ACCESS_KEY: credentials.AWS_SECRET_ACCESS_KEY,
-        AWS_REGION: credentials.AWS_REGION,
+        AWS_REGION: credentials.AWS_REGION
     };
     const { code } = await (0, subprocess_1.spawnStreaming)(args, infraDir, awsEnv);
     if (code !== 0) {
@@ -65,50 +68,112 @@ async function runCompensation(infraDir, credentials, tofuVars) {
     }
     console.log(chalk_1.default.green('AWS resources cleaned up'));
 }
-function printOutputTable(albDns, ecrUrl, githubRepoUrl) {
+async function runAzureCompensation(infraDir, credentials, tofuVars) {
+    console.log(chalk_1.default.red('\n--- Cleaning up Azure resources ---'));
+    const args = (0, tofu_runner_1.buildDestroyArgs)(credentials, tofuVars, 'azure');
+    const azureEnv = {
+        ARM_SUBSCRIPTION_ID: credentials.AZURE_SUBSCRIPTION_ID,
+        ARM_TENANT_ID: credentials.AZURE_TENANT_ID,
+        ARM_CLIENT_ID: credentials.AZURE_CLIENT_ID,
+        ARM_CLIENT_SECRET: credentials.AZURE_CLIENT_SECRET
+    };
+    const { code } = await (0, subprocess_1.spawnStreaming)(args, infraDir, azureEnv);
+    if (code !== 0) {
+        console.error(chalk_1.default.red('Compensation destroy failed. Manually delete Azure resources.'));
+        process.exit(1);
+    }
+    console.log(chalk_1.default.green('Azure resources cleaned up'));
+}
+function printOutputTable(rows, codePushed) {
     const divider = chalk_1.default.gray('─'.repeat(60));
     console.log('\n' + divider);
     console.log(chalk_1.default.bold('  Deployment Complete'));
     console.log(divider);
-    console.log(`  ${chalk_1.default.dim('ALB DNS')}          ${albDns}`);
-    console.log(`  ${chalk_1.default.dim('ECR URL')}          ${ecrUrl}`);
-    console.log(`  ${chalk_1.default.dim('GitHub Repo')}      ${githubRepoUrl}`);
+    for (const [label, value] of rows) {
+        console.log(`  ${chalk_1.default.dim(label.padEnd(18))}${value}`);
+    }
     console.log(divider);
     console.log(chalk_1.default.cyan('\n  Next steps:'));
-    console.log('  Your code has been pushed. Your first deploy will start shortly.\n');
+    if (codePushed) {
+        console.log('  Your code has been pushed. Your first deploy will start shortly.\n');
+    }
+    else {
+        console.log(chalk_1.default.yellow('  Code was NOT pushed automatically — see the push warning above and push manually.\n'));
+    }
 }
-async function runInfraOrchestrator(targetRoot, _appName, config, credentials, options) {
+async function pushCodeAndProtect(targetRoot, config, credentials, repoName, githubRepoUrl, options) {
+    await (0, git_client_1.wireGitRemote)(targetRoot, githubRepoUrl);
+    console.log(chalk_1.default.green('Git remote origin set'));
+    const allBranches = [...new Set(config.apps.map((app) => app.branch))];
+    const branches = options?.targetBranch
+        ? allBranches.filter((b) => b === options.targetBranch)
+        : allBranches;
+    // Phase 1: push the base commit so the branch exists on the remote.
+    try {
+        await (0, git_client_1.pushToRemote)(targetRoot, credentials.GITHUB_TOKEN, branches, options?.forcePush);
+    }
+    catch {
+        console.log(chalk_1.default.yellow(`Warning: base push failed. Push manually: git push -u origin ${branches.join(' ')}`));
+    }
+    // Phase 2: commit infrastructure and push on top as a fast-forward.
+    const committed = await (0, git_client_1.commitAll)(targetRoot, 'Add infrastructure configuration');
+    if (committed) {
+        console.log(chalk_1.default.green('Infrastructure files committed'));
+    }
+    let codePushed = false;
+    try {
+        await (0, git_client_1.pushToRemote)(targetRoot, credentials.GITHUB_TOKEN, branches, false);
+        console.log(chalk_1.default.green(`Code pushed to: ${branches.join(', ')}`));
+        codePushed = true;
+    }
+    catch {
+        console.log(chalk_1.default.yellow(`Warning: automatic push failed. Push manually: git push origin ${branches.join(' ')}`));
+    }
+    if (!options?.skipBranchProtection) {
+        console.log(chalk_1.default.cyan('--- Applying branch protections ---'));
+        for (const branch of branches) {
+            try {
+                await (0, github_client_1.setBranchProtection)(credentials.GITHUB_TOKEN, credentials.GITHUB_ORGANIZATION, repoName, branch);
+                console.log(chalk_1.default.green(`✓ Branch protection set for: ${branch}`));
+            }
+            catch {
+                console.log(chalk_1.default.yellow(`Warning: could not set branch protection for ${branch}`));
+            }
+        }
+    }
+    else {
+        console.log(chalk_1.default.yellow('--- Skipping branch protections (--skip-branch-protection) ---'));
+    }
+    return { branches, codePushed };
+}
+async function runAwsOrchestrator(targetRoot, config, credentials, options) {
     const infraDir = path.join(targetRoot, 'infra');
-    const repoName = `${config.name}-monorepo`;
-    // Generate TofuVars
+    const repoName = config.github_repo_name ?? `${config.name}-monorepo`;
     const tofuVars = {
         db_username: slugify(config.name),
         db_name: slugify(config.name),
-        github_repo_name: repoName,
+        github_repo_name: repoName
     };
-    // Ensure S3 state bucket exists (before Tofu init)
     console.log(chalk_1.default.cyan('--- Ensuring state bucket exists ---'));
     const suffix = (0, s3_state_bucket_1.deriveSuffix)(config.name);
     const bucketName = (0, s3_state_bucket_1.buildStateBucketName)(config.name, suffix);
     await (0, s3_state_bucket_1.ensureStateBucket)(credentials, bucketName);
-    // Write secret to AWS Secrets Manager (before Tofu — Tofu reads it via data.tf)
     const secretName = `${config.name}-infrastructure-variables`;
     const secretPayload = {
         ...config,
         seed: (0, config_writer_1.generateSeed)(),
         aws_region: credentials.AWS_REGION,
-        github_org: credentials.GITHUB_ORGANIZATION,
+        github_org: credentials.GITHUB_ORGANIZATION
     };
     console.log(chalk_1.default.cyan('--- Writing infrastructure secret ---'));
     await (0, secrets_manager_client_1.putSecret)(credentials, secretName, secretPayload);
     console.log(chalk_1.default.green('Secret written to AWS Secrets Manager'));
-    // SIGINT compensation setup
     const state = { tofuStarted: false };
     const sigintHandler = async () => {
         if (options?.destroyOnFailure) {
             console.log(chalk_1.default.yellow('\nInterrupted — running compensation...'));
             if (state.tofuStarted) {
-                await runCompensation(infraDir, credentials, tofuVars);
+                await runAwsCompensation(infraDir, credentials, tofuVars);
             }
         }
         else {
@@ -119,86 +184,170 @@ async function runInfraOrchestrator(targetRoot, _appName, config, credentials, o
     };
     process.once('SIGINT', sigintHandler);
     try {
-        // Step 1: Create GitHub repo (skip in plan-only mode)
         if (!options?.planOnly) {
             console.log(chalk_1.default.cyan('--- Creating GitHub repository ---'));
-            try {
+            const exists = await (0, github_client_1.repoExists)(credentials.GITHUB_TOKEN, credentials.GITHUB_ORGANIZATION, repoName);
+            if (exists) {
+                console.log(chalk_1.default.yellow(`Repository ${credentials.GITHUB_ORGANIZATION}/${repoName} already exists, skipping creation`));
+            }
+            else {
                 await (0, github_client_1.createGitHubRepo)(credentials.GITHUB_TOKEN, credentials.GITHUB_ORGANIZATION, repoName);
                 console.log(chalk_1.default.green(`✓ Repository created: ${credentials.GITHUB_ORGANIZATION}/${repoName}`));
             }
-            catch (err) {
-                // If repo already exists (422), continue — it may be a re-run
-                if (err?.status === 422) {
-                    console.log(chalk_1.default.yellow(`Repository ${credentials.GITHUB_ORGANIZATION}/${repoName} already exists, continuing...`));
-                }
-                else {
-                    throw err;
-                }
-            }
         }
-        // Step 2: Single Tofu apply (all AWS resources)
         state.tofuStarted = true;
         const result = await (0, tofu_runner_1.runTofuApply)(infraDir, credentials, tofuVars, {
             planOnly: options?.planOnly,
+            deployment: 'ecs'
         });
         if (options?.planOnly) {
             console.log(chalk_1.default.green('\n  Plan complete — no resources were created.\n'));
             return;
         }
-        // Step 3: Set GitHub Actions secrets
         console.log(chalk_1.default.cyan('--- Setting GitHub Actions secrets ---'));
         const roleArn = result.outputs['oidc_role_arn'].value;
         const secrets = {
             AWS_REGION: credentials.AWS_REGION,
             AWS_ROLE_ARN: roleArn,
-            PROJECT_NAME: config.name,
+            PROJECT_NAME: config.name
         };
         await (0, github_secrets_client_1.setRepoSecrets)(credentials.GITHUB_TOKEN, credentials.GITHUB_ORGANIZATION, repoName, secrets);
         console.log(chalk_1.default.green('✓ GitHub Actions secrets configured'));
-        // Step 4: Push code
         const githubRepoUrl = result.outputs['github_http_repo_url'].value;
-        await (0, git_client_1.wireGitRemote)(targetRoot, githubRepoUrl);
-        console.log(chalk_1.default.green('Git remote origin set'));
-        const committed = await (0, git_client_1.commitAll)(targetRoot, 'Add infrastructure configuration');
-        if (committed) {
-            console.log(chalk_1.default.green('Infrastructure files committed'));
+        const { codePushed } = await pushCodeAndProtect(targetRoot, config, credentials, repoName, githubRepoUrl, options);
+        printOutputTable([
+            ['ALB DNS', result.outputs['alb_dns'].value],
+            ['ECR URL', result.outputs['ecr_url'].value],
+            ['GitHub Repo', githubRepoUrl]
+        ], codePushed);
+        return { codePushed };
+    }
+    catch (err) {
+        if (err instanceof tofu_runner_1.TofuApplyError) {
+            if (options?.destroyOnFailure) {
+                await runAwsCompensation(infraDir, credentials, tofuVars);
+            }
+            else {
+                console.log(chalk_1.default.yellow('\n  Partial resources preserved. Fix the issue and re-run:'));
+                console.log(chalk_1.default.yellow('    fuel infra:deploy\n'));
+            }
+            process.exit(1);
         }
-        const allBranches = [...new Set(config.apps.map(app => app.branch))];
-        const branches = options?.targetBranch
-            ? allBranches.filter(b => b === options.targetBranch)
-            : allBranches;
-        try {
-            await (0, git_client_1.pushToRemote)(targetRoot, credentials.GITHUB_TOKEN, branches, options?.forcePush);
-            console.log(chalk_1.default.green(`Code pushed to: ${branches.join(', ')}`));
+        throw err;
+    }
+    finally {
+        process.removeListener('SIGINT', sigintHandler);
+    }
+}
+async function runAzureOrchestrator(targetRoot, config, credentials, options) {
+    const infraDir = path.join(targetRoot, 'infra');
+    const repoName = config.github_repo_name ?? `${config.name}-monorepo`;
+    const tofuVars = {
+        db_username: slugify(config.name),
+        db_name: slugify(config.name),
+        github_repo_name: repoName
+    };
+    console.log(chalk_1.default.cyan('--- Ensuring resource group, state storage and Key Vault exist ---'));
+    const suffix = (0, s3_state_bucket_1.deriveSuffix)(config.name);
+    const resourceGroupName = (0, azure_state_storage_1.buildResourceGroupName)(config.name);
+    const storageAccountName = (0, azure_state_storage_1.buildStateStorageAccountName)(config.name, suffix);
+    const keyVaultName = (0, azure_state_storage_1.buildKeyVaultName)(config.name, suffix);
+    await (0, azure_state_storage_1.ensureResourceGroup)(credentials, resourceGroupName, config.location);
+    await (0, azure_state_storage_1.ensureStateStorage)(credentials, resourceGroupName, storageAccountName, config.location);
+    await (0, azure_state_storage_1.ensureBootstrapKeyVault)(credentials, resourceGroupName, keyVaultName, config.location);
+    await (0, azure_rbac_1.ensureRoleAssignmentPermission)(credentials, resourceGroupName);
+    const secretName = 'infrastructure-variables';
+    const secretPayload = {
+        ...config,
+        seed: (0, config_writer_1.generateSeed)(),
+        github_org: credentials.GITHUB_ORGANIZATION
+    };
+    console.log(chalk_1.default.cyan('--- Writing infrastructure secret ---'));
+    await (0, azure_keyvault_client_1.putSecret)(credentials, keyVaultName, secretName, secretPayload);
+    console.log(chalk_1.default.green('Secret written to Azure Key Vault'));
+    const state = { tofuStarted: false };
+    const sigintHandler = async () => {
+        if (options?.destroyOnFailure) {
+            console.log(chalk_1.default.yellow('\nInterrupted — running compensation...'));
+            if (state.tofuStarted) {
+                await runAzureCompensation(infraDir, credentials, tofuVars);
+            }
         }
-        catch {
-            console.log(chalk_1.default.yellow(`Warning: automatic push failed. Push manually: git push -u origin ${branches.join(' ')}`));
+        else {
+            console.log(chalk_1.default.yellow('\nInterrupted — partial resources preserved.'));
+            console.log(chalk_1.default.yellow('Re-run "fuel infra:deploy" to resume.\n'));
         }
-        // Step 5: Branch protections
-        if (!options?.skipBranchProtection) {
-            console.log(chalk_1.default.cyan('--- Applying branch protections ---'));
-            for (const branch of branches) {
-                try {
-                    await (0, github_client_1.setBranchProtection)(credentials.GITHUB_TOKEN, credentials.GITHUB_ORGANIZATION, repoName, branch);
-                    console.log(chalk_1.default.green(`✓ Branch protection set for: ${branch}`));
-                }
-                catch {
-                    console.log(chalk_1.default.yellow(`Warning: could not set branch protection for ${branch}`));
-                }
+        process.exit(1);
+    };
+    process.once('SIGINT', sigintHandler);
+    try {
+        if (!options?.planOnly) {
+            console.log(chalk_1.default.cyan('--- Creating GitHub repository ---'));
+            const exists = await (0, github_client_1.repoExists)(credentials.GITHUB_TOKEN, credentials.GITHUB_ORGANIZATION, repoName);
+            if (exists) {
+                console.log(chalk_1.default.yellow(`Repository ${credentials.GITHUB_ORGANIZATION}/${repoName} already exists, skipping creation`));
             }
+            else {
+                await (0, github_client_1.createGitHubRepo)(credentials.GITHUB_TOKEN, credentials.GITHUB_ORGANIZATION, repoName);
+                console.log(chalk_1.default.green(`✓ Repository created: ${credentials.GITHUB_ORGANIZATION}/${repoName}`));
+            }
+        }
+        state.tofuStarted = true;
+        const result = await (0, tofu_runner_1.runTofuApply)(infraDir, credentials, tofuVars, {
+            planOnly: options?.planOnly,
+            deployment: 'azure'
+        });
+        if (options?.planOnly) {
+            console.log(chalk_1.default.green('\n  Plan complete — no resources were created.\n'));
+            return;
+        }
+        console.log(chalk_1.default.cyan('--- Setting GitHub Actions secrets ---'));
+        const oidcClientId = result.outputs['github_oidc_client_id']?.value;
+        const secrets = {
+            AZURE_TENANT_ID: credentials.AZURE_TENANT_ID,
+            AZURE_SUBSCRIPTION_ID: credentials.AZURE_SUBSCRIPTION_ID,
+            PROJECT_NAME: config.name,
+            ACR_LOGIN_SERVER: result.outputs['acr_login_server'].value,
+            RESOURCE_GROUP: resourceGroupName
+        };
+        if (oidcClientId) {
+            secrets.AZURE_CLIENT_ID = oidcClientId;
         }
         else {
-            console.log(chalk_1.default.yellow('--- Skipping branch protections (--skip-branch-protection) ---'));
+            console.log(chalk_1.default.yellow('  github_oidc disabled — skipping AZURE_CLIENT_ID secret (CI push/deploy will not work until it is set up)'));
         }
-        // Print output table
-        const albDns = result.outputs['alb_dns'].value;
-        const ecrUrl = result.outputs['ecr_url'].value;
-        printOutputTable(albDns, ecrUrl, githubRepoUrl);
+        await (0, github_secrets_client_1.setRepoSecrets)(credentials.GITHUB_TOKEN, credentials.GITHUB_ORGANIZATION, repoName, secrets);
+        console.log(chalk_1.default.green('✓ GitHub Actions secrets configured'));
+        const githubRepoUrl = result.outputs['github_http_repo_url'].value;
+        const { codePushed } = await pushCodeAndProtect(targetRoot, config, credentials, repoName, githubRepoUrl, options);
+        printOutputTable([
+            [
+                'Front Door',
+                result.outputs['front_door_endpoint_hostname']?.value ??
+                    '(not created)'
+            ],
+            ['ACR', result.outputs['acr_login_server'].value],
+            ['Resource Group', resourceGroupName],
+            ['GitHub Repo', githubRepoUrl]
+        ], codePushed);
+        const domainValidation = (result.outputs['custom_domain_validation']
+            ?.value ?? {});
+        const domains = Object.entries(domainValidation);
+        if (domains.length > 0) {
+            console.log(chalk_1.default.cyan('\n--- Custom domain DNS records needed ---'));
+            console.log(chalk_1.default.yellow("  Add these at the domain's own DNS provider so Azure can validate ownership and issue the managed TLS certificate:\n"));
+            for (const [hostName, record] of domains) {
+                console.log(chalk_1.default.white(`  ${hostName}`));
+                console.log(`    TXT   ${record.txt_record_name}  →  ${record.txt_record_value}`);
+                console.log(`    CNAME ${hostName}  →  ${record.cname_target}\n`);
+            }
+        }
+        return { codePushed };
     }
     catch (err) {
         if (err instanceof tofu_runner_1.TofuApplyError) {
             if (options?.destroyOnFailure) {
-                await runCompensation(infraDir, credentials, tofuVars);
+                await runAzureCompensation(infraDir, credentials, tofuVars);
             }
             else {
                 console.log(chalk_1.default.yellow('\n  Partial resources preserved. Fix the issue and re-run:'));
@@ -212,4 +361,10 @@ async function runInfraOrchestrator(targetRoot, _appName, config, credentials, o
         process.removeListener('SIGINT', sigintHandler);
     }
 }
+async function runInfraOrchestrator(targetRoot, _appName, config, credentials, options) {
+    if (config.deployment === 'azure') {
+        return runAzureOrchestrator(targetRoot, config, credentials, options);
+    }
+    return runAwsOrchestrator(targetRoot, config, credentials, options);
+}
 //# sourceMappingURL=orchestrator.js.map