hereya-cli 0.89.1 → 0.91.0

package/dist/commands/workspace/executor/install/index.d.ts

@@ -4,7 +4,10 @@ export default class WorkspaceExecutorInstall extends Command {
     static flags: {
         debug: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         force: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        mode: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        parameter: import("@oclif/core/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
+    private parseParameterFlag;
 }

package/dist/commands/workspace/executor/install/index.js

@@ -5,12 +5,27 @@ import { getBackend } from '../../../../backend/index.js';
 import { getExecutor } from '../../../../executor/index.js';
 import { getLogger, getLogPath, isDebug, setDebug } from '../../../../lib/log.js';
 import { delay } from '../../../../lib/shell.js';
-const DEFAULT_EXECUTOR_PACKAGE = 'hereya/remote-executor-aws';
+const ALWAYS_ON_PACKAGE = 'hereya/remote-executor-aws';
+const EPHEMERAL_PACKAGE = 'hereya/aws-executor-broker';
 export default class WorkspaceExecutorInstall extends Command {
-    static description = 'Install a remote executor into a workspace';
+    static description = `Install a remote executor into a workspace.
+
+Two modes are supported:
+  - ephemeral (default): provisions hereya/aws-executor-broker (Lambda + on-demand EC2).
+  - always-on: provisions hereya/remote-executor-aws (legacy always-on EC2).`;
     static flags = {
         debug: Flags.boolean({ default: false, description: 'enable debug mode' }),
         force: Flags.boolean({ char: 'f', default: false, description: 'force reinstall even if executor is already installed' }),
+        mode: Flags.string({
+            default: 'ephemeral',
+            description: 'executor mode: ephemeral (Lambda + on-demand EC2) or always-on (legacy)',
+            options: ['ephemeral', 'always-on'],
+        }),
+        parameter: Flags.string({
+            char: 'p',
+            description: "parameter for the package, in the form of 'key=value'. Can be specified multiple times.",
+            multiple: true,
+        }),
         workspace: Flags.string({
             char: 'w',
             description: 'name of the workspace',
@@ -21,84 +36,184 @@ export default class WorkspaceExecutorInstall extends Command {
         const { flags } = await this.parse(WorkspaceExecutorInstall);
         setDebug(flags.debug);
         const myLogger = new ListrLogger({ useIcons: false });
+        const isEphemeral = flags.mode === 'ephemeral';
+        const executorPackage = isEphemeral ? EPHEMERAL_PACKAGE : ALWAYS_ON_PACKAGE;
+        const userParameters = this.parseParameterFlag(flags.parameter);
+        const reservedKeys = ['workspaceId', 'workspaceName'];
+        for (const reserved of reservedKeys) {
+            if (Object.hasOwn(userParameters, reserved)) {
+                this.error(`--parameter ${reserved}=... is not allowed: this value is auto-inferred from the workspace and overriding it would corrupt the broker registration`);
+            }
+        }
+        const validateTask = {
+            async task(ctx) {
+                const backend = await getBackend();
+                if (!(backend instanceof CloudBackend)) {
+                    throw new TypeError('Remote executor requires cloud backend. Run `hereya login` first.');
+                }
+                const workspace$ = await backend.getWorkspace(flags.workspace);
+                if (!workspace$.found) {
+                    throw new Error(`Workspace ${flags.workspace} not found`);
+                }
+                if (workspace$.hasError) {
+                    throw new Error(workspace$.error);
+                }
+                if (workspace$.workspace.hasExecutor && !flags.force) {
+                    throw new Error(`Workspace ${flags.workspace} already has an executor installed. Use --force to reinstall.`);
+                }
+                ctx.workspaceId = workspace$.workspace.id;
+                await delay(500);
+            },
+            title: 'Validating workspace',
+        };
+        const provisionAlwaysOnTasks = [
+            {
+                async task(ctx) {
+                    const backend = await getBackend();
+                    const tokenResult = await backend.generateExecutorToken({
+                        workspace: flags.workspace,
+                    });
+                    if (!tokenResult.success) {
+                        throw new Error(`Failed to generate executor token: ${tokenResult.reason}`);
+                    }
+                    ctx.executorToken = tokenResult.token;
+                    await delay(500);
+                },
+                title: 'Generating executor token',
+            },
+            {
+                rendererOptions: {
+                    persistentOutput: isDebug(),
+                },
+                async task(ctx, task) {
+                    const executor$ = getExecutor();
+                    if (!executor$.success) {
+                        throw new Error(executor$.reason);
+                    }
+                    const { executor } = executor$;
+                    // Merge precedence (lowest -> highest):
+                    //   1. --parameter key=value (catch-all for any remote-executor-aws inputs)
+                    //   2. auto-inferred (EXECUTOR_TOKEN, WORKSPACE) — cloud-derived, must not be overridden
+                    const parameters = {
+                        ...userParameters,
+                        EXECUTOR_TOKEN: ctx.executorToken,
+                        WORKSPACE: flags.workspace,
+                    };
+                    const provisionOutput = await executor.provision({
+                        logger: getLogger(task),
+                        package: executorPackage,
+                        parameters,
+                        skipDeploy: true,
+                        workspace: flags.workspace,
+                    });
+                    if (!provisionOutput.success) {
+                        throw new Error(provisionOutput.reason);
+                    }
+                },
+                title: 'Provisioning remote executor infrastructure',
+            },
+            {
+                async task() {
+                    const backend = await getBackend();
+                    await backend.updateWorkspace({
+                        hasExecutor: true,
+                        name: flags.workspace,
+                    });
+                    await delay(500);
+                },
+                title: 'Registering executor on workspace',
+            },
+        ];
+        const provisionEphemeralTasks = [
+            {
+                rendererOptions: {
+                    persistentOutput: isDebug(),
+                },
+                async task(ctx, task) {
+                    const executor$ = getExecutor();
+                    if (!executor$.success) {
+                        throw new Error(executor$.reason);
+                    }
+                    const { executor } = executor$;
+                    const hereyaCloudUrl = process.env.HEREYA_CLOUD_URL || 'https://cloud.hereya.dev';
+                    // Merge precedence (lowest -> highest):
+                    //   1. auto-inferred (hereyaCloudUrl, workspaceId, workspaceName)
+                    //   2. --parameter key=value (can override hereyaCloudUrl; workspaceId/workspaceName are
+                    //      rejected up-front, so we re-pin them here defensively)
+                    const parameters = {
+                        hereyaCloudUrl,
+                        ...userParameters,
+                        workspaceId: ctx.workspaceId,
+                        workspaceName: flags.workspace,
+                    };
+                    const provisionOutput = await executor.provision({
+                        logger: getLogger(task),
+                        package: executorPackage,
+                        parameters,
+                        skipDeploy: true,
+                        workspace: flags.workspace,
+                    });
+                    if (!provisionOutput.success) {
+                        throw new Error(provisionOutput.reason);
+                    }
+                    ctx.brokerOutputs = provisionOutput.env;
+                },
+                title: 'Provisioning ephemeral executor broker infrastructure',
+            },
+            {
+                async task(ctx) {
+                    const outputs = ctx.brokerOutputs ?? {};
+                    const { brokerVersion, brokerWebhookUrl } = outputs;
+                    if (!brokerWebhookUrl) {
+                        throw new Error('Executor broker package did not return brokerWebhookUrl output');
+                    }
+                    if (!brokerVersion) {
+                        throw new Error('Executor broker package did not return brokerVersion output');
+                    }
+                    const metadata = {
+                        awsAccountId: outputs.awsAccountId,
+                        brokerLambdaArn: outputs.brokerLambdaArn,
+                        ec2InstanceId: outputs.ec2InstanceId,
+                        ec2LaunchTemplateId: outputs.ec2LaunchTemplateId,
+                        invokerRoleArn: outputs.invokerRoleArn,
+                        region: outputs.region,
+                    };
+                    const backend = await getBackend();
+                    const result = await backend.registerExecutorBroker({
+                        brokerVersion,
+                        brokerWebhookUrl,
+                        metadata,
+                        provider: 'aws',
+                        workspace: flags.workspace,
+                    });
+                    if (!result.success) {
+                        throw new Error(`Failed to register executor broker: ${result.reason}`);
+                    }
+                    await delay(500);
+                },
+                title: 'Registering executor broker with hereya cloud',
+            },
+            {
+                async task() {
+                    const backend = await getBackend();
+                    await backend.updateWorkspace({
+                        hasExecutor: true,
+                        name: flags.workspace,
+                    });
+                    await delay(500);
+                },
+                title: 'Marking workspace executor-enabled',
+            },
+        ];
+        const subTasks = isEphemeral
+            ? [validateTask, ...provisionEphemeralTasks]
+            : [validateTask, ...provisionAlwaysOnTasks];
         const task = new Listr([
             {
                 async task(_ctx, task) {
-                    return task.newListr([
-                        {
-                            async task() {
-                                const backend = await getBackend();
-                                if (!(backend instanceof CloudBackend)) {
-                                    throw new TypeError('Remote executor requires cloud backend. Run `hereya login` first.');
-                                }
-                                const workspace$ = await backend.getWorkspace(flags.workspace);
-                                if (!workspace$.found) {
-                                    throw new Error(`Workspace ${flags.workspace} not found`);
-                                }
-                                if (workspace$.hasError) {
-                                    throw new Error(workspace$.error);
-                                }
-                                if (workspace$.workspace.hasExecutor && !flags.force) {
-                                    throw new Error(`Workspace ${flags.workspace} already has an executor installed. Use --force to reinstall.`);
-                                }
-                                await delay(500);
-                            },
-                            title: 'Validating workspace',
-                        },
-                        {
-                            async task(ctx) {
-                                const backend = await getBackend();
-                                const tokenResult = await backend.generateExecutorToken({
-                                    workspace: flags.workspace,
-                                });
-                                if (!tokenResult.success) {
-                                    throw new Error(`Failed to generate executor token: ${tokenResult.reason}`);
-                                }
-                                ctx.executorToken = tokenResult.token;
-                                await delay(500);
-                            },
-                            title: 'Generating executor token',
-                        },
-                        {
-                            rendererOptions: {
-                                persistentOutput: isDebug(),
-                            },
-                            async task(ctx, task) {
-                                const executor$ = getExecutor();
-                                if (!executor$.success) {
-                                    throw new Error(executor$.reason);
-                                }
-                                const { executor } = executor$;
-                                const provisionOutput = await executor.provision({
-                                    logger: getLogger(task),
-                                    package: DEFAULT_EXECUTOR_PACKAGE,
-                                    parameters: {
-                                        EXECUTOR_TOKEN: ctx.executorToken,
-                                        WORKSPACE: flags.workspace,
-                                    },
-                                    skipDeploy: true,
-                                    workspace: flags.workspace,
-                                });
-                                if (!provisionOutput.success) {
-                                    throw new Error(provisionOutput.reason);
-                                }
-                            },
-                            title: 'Provisioning remote executor infrastructure',
-                        },
-                        {
-                            async task() {
-                                const backend = await getBackend();
-                                await backend.updateWorkspace({
-                                    hasExecutor: true,
-                                    name: flags.workspace,
-                                });
-                                await delay(500);
-                            },
-                            title: 'Registering executor on workspace',
-                        },
-                    ], { concurrent: false, rendererOptions: { collapseSubtasks: !isDebug() } });
+                    return task.newListr(subTasks, { concurrent: false, rendererOptions: { collapseSubtasks: !isDebug() } });
                 },
-                title: `Installing executor on workspace ${flags.workspace}`,
+                title: `Installing executor on workspace ${flags.workspace} (mode: ${flags.mode})`,
             },
         ], { concurrent: false });
         try {
@@ -109,4 +224,23 @@ export default class WorkspaceExecutorInstall extends Command {
             this.error(`${error.message}\n\nSee ${getLogPath()} for more details`);
         }
     }
+    parseParameterFlag(values) {
+        const result = {};
+        if (!values || values.length === 0) {
+            return result;
+        }
+        for (const raw of values) {
+            const eqIdx = raw.indexOf('=');
+            if (eqIdx === -1) {
+                this.error(`Invalid --parameter value '${raw}': expected format 'key=value'`);
+            }
+            const key = raw.slice(0, eqIdx);
+            const value = raw.slice(eqIdx + 1);
+            if (key.length === 0) {
+                this.error(`Invalid --parameter value '${raw}': key must not be empty`);
+            }
+            result[key] = value;
+        }
+        return result;
+    }
 }

package/dist/commands/workspace/executor/uninstall/index.d.ts

@@ -3,6 +3,7 @@ export default class WorkspaceExecutorUninstall extends Command {
     static description: string;
     static flags: {
         debug: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        mode: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;

package/dist/commands/workspace/executor/uninstall/index.js

@@ -5,11 +5,19 @@ import { getBackend } from '../../../../backend/index.js';
 import { getExecutor } from '../../../../executor/index.js';
 import { getLogger, getLogPath, isDebug, setDebug } from '../../../../lib/log.js';
 import { delay } from '../../../../lib/shell.js';
-const DEFAULT_EXECUTOR_PACKAGE = 'hereya/remote-executor-aws';
+const ALWAYS_ON_PACKAGE = 'hereya/remote-executor-aws';
+const EPHEMERAL_PACKAGE = 'hereya/aws-executor-broker';
 export default class WorkspaceExecutorUninstall extends Command {
-    static description = 'Uninstall the remote executor from a workspace';
+    static description = `Uninstall the remote executor from a workspace.
+
+The --mode flag must match the mode used at install time (default: ephemeral).`;
     static flags = {
         debug: Flags.boolean({ default: false, description: 'enable debug mode' }),
+        mode: Flags.string({
+            default: 'ephemeral',
+            description: 'executor mode used at install time',
+            options: ['ephemeral', 'always-on'],
+        }),
         workspace: Flags.string({
             char: 'w',
             description: 'name of the workspace',
@@ -20,6 +28,8 @@ export default class WorkspaceExecutorUninstall extends Command {
         const { flags } = await this.parse(WorkspaceExecutorUninstall);
         setDebug(flags.debug);
         const myLogger = new ListrLogger({ useIcons: false });
+        const isEphemeral = flags.mode === 'ephemeral';
+        const executorPackage = isEphemeral ? EPHEMERAL_PACKAGE : ALWAYS_ON_PACKAGE;
         const task = new Listr([
             {
                 async task(_ctx, task) {
@@ -56,7 +66,7 @@ export default class WorkspaceExecutorUninstall extends Command {
                                 const { executor } = executor$;
                                 const destroyOutput = await executor.destroy({
                                     logger: getLogger(task),
-                                    package: DEFAULT_EXECUTOR_PACKAGE,
+                                    package: executorPackage,
                                     skipDeploy: true,
                                     workspace: flags.workspace,
                                 });
@@ -76,6 +86,22 @@ export default class WorkspaceExecutorUninstall extends Command {
                             },
                             title: 'Revoking executor token',
                         },
+                        {
+                            async task() {
+                                const backend = await getBackend();
+                                // Always attempt to unregister the broker. The endpoint
+                                // gracefully no-ops on 404 so this is safe for legacy
+                                // always-on installs that never registered a broker.
+                                const result = await backend.unregisterExecutorBroker({
+                                    workspace: flags.workspace,
+                                });
+                                if (!result.success) {
+                                    throw new Error(`Failed to unregister executor broker: ${result.reason}`);
+                                }
+                                await delay(500);
+                            },
+                            title: 'Unregistering executor broker',
+                        },
                         {
                             async task() {
                                 const backend = await getBackend();
@@ -89,7 +115,7 @@ export default class WorkspaceExecutorUninstall extends Command {
                         },
                     ], { concurrent: false, rendererOptions: { collapseSubtasks: !isDebug() } });
                 },
-                title: `Uninstalling executor from workspace ${flags.workspace}`,
+                title: `Uninstalling executor from workspace ${flags.workspace} (mode: ${flags.mode})`,
             },
         ], { concurrent: false });
         try {

package/dist/executor/local.d.ts

@@ -7,5 +7,4 @@ export declare class LocalExecutor implements Executor {
     setEnvVar(input: ExecutorSetEnvVarInput): Promise<ExecutorSetEnvVarOutput>;
     unsetEnvVar(input: ExecutorUnsetEnvVarInput): Promise<ExecutorUnsetEnvVarOutput>;
     private getWorkspaceEnv;
-    private resolveGithubAppMarkers;
 }

package/dist/executor/local.js

@@ -2,6 +2,7 @@ import { getBackend } from '../backend/index.js';
 import { destroyPackage, getInfrastructure, getProvisioningLogicalId, provisionPackage, resolveEnvValues as resolveEnvValuesSimple } from '../infrastructure/index.js';
 import { mintInstallationToken } from '../lib/github-app.js';
 import { resolvePackage } from '../lib/package/index.js';
+import { resolveEnvValues as resolveEnvValuesPure } from './resolve-env.js';
 export class LocalExecutor {
     async destroy(input) {
         // For apps, we use `app` as the project-name source for workspace env resolution
@@ -70,28 +71,15 @@ export class LocalExecutor {
         });
     }
     async resolveEnvValues(input) {
-        const resolved = Object.fromEntries(await Promise.all(Object.entries(input.env).map(async ([key, value]) => {
-            // Check if value has infra prefix (contains ':' and first part is valid infra)
-            const colonIndex = value.indexOf(':');
-            if (colonIndex === -1) {
-                // No colon - plain value, return as-is
-                return [key, value];
-            }
-            const infraType = value.slice(0, colonIndex);
-            const infra$ = getInfrastructure({ type: infraType });
-            if (!infra$.supported) {
-                // Unknown infra type - treat as plain value, return as-is
-                return [key, value];
-            }
-            const { infrastructure } = infra$;
-            const valueWithoutInfra = value.slice(colonIndex + 1);
-            const { isSecret, value: resolvedValue } = await infrastructure.resolveEnv({
-                value: valueWithoutInfra,
-            });
-            const finalValue = input.markSecret && isSecret ? `secret://${resolvedValue}` : resolvedValue;
-            return [key, finalValue];
-        })));
-        return this.resolveGithubAppMarkers(resolved, input);
+        return resolveEnvValuesPure(input, {
+            getInfrastructure,
+            async getWorkspaceEnv(args) {
+                const backend = await getBackend();
+                return backend.getWorkspaceEnv(args);
+            },
+            mintInstallationToken,
+            resolveSimpleEnv: resolveEnvValuesSimple,
+        });
     }
     async setEnvVar(input) {
         const backend = await getBackend();
@@ -187,44 +175,4 @@ export class LocalExecutor {
             success: true,
         };
     }
-    async resolveGithubAppMarkers(resolved, input) {
-        const needsToken = Object.values(resolved).some((v) => typeof v === 'string' && v.startsWith('github-app:'));
-        if (!needsToken)
-            return resolved;
-        if (!input.workspace || !input.project)
-            return resolved;
-        const backend = await getBackend();
-        const wsEnv$ = await backend.getWorkspaceEnv({
-            project: input.project,
-            workspace: input.workspace,
-        });
-        if (!wsEnv$.success)
-            return resolved;
-        // Use the simple infrastructure resolver - resolves aws: prefixes only and
-        // does NOT recurse into github-app: markers, so no circularity.
-        const wsResolved = await resolveEnvValuesSimple(wsEnv$.env);
-        const appId = wsResolved.hereyaGithubAppId;
-        const installationIdFromEnv = wsResolved.hereyaGithubAppInstallationId;
-        const privateKey = wsResolved.hereyaGithubAppPrivateKey;
-        if (!appId || !privateKey) {
-            console.warn('hereya: github-app marker present but workspace env missing hereyaGithubAppId / hereyaGithubAppPrivateKey; leaving marker unresolved');
-            return resolved;
-        }
-        const out = { ...resolved };
-        for (const [k, v] of Object.entries(resolved)) {
-            if (typeof v !== 'string' || !v.startsWith('github-app:'))
-                continue;
-            const installationId = v.slice('github-app:'.length) || installationIdFromEnv;
-            if (!installationId)
-                continue;
-            try {
-                // eslint-disable-next-line no-await-in-loop
-                out[k] = await mintInstallationToken({ appId, installationId, privateKey });
-            }
-            catch (error) {
-                console.warn(`hereya: failed to mint github-app installation token: ${error.message}`);
-            }
-        }
-        return out;
-    }
 }

package/dist/executor/resolve-env.d.ts

@@ -0,0 +1,88 @@
+import type { GetInfrastructureOutput } from '../infrastructure/registry.js';
+/**
+ * Pure-function env-value resolver, factored out of `LocalExecutor.resolveEnvValues`.
+ *
+ * The functions in this module are deliberately free of any class state
+ * (`this`) or hard-coded global lookups so they can be invoked from contexts
+ * that do not include the full CLI runtime — e.g. the broker Lambda that
+ * imports `hereya-cli` as a published npm dependency.
+ *
+ * Dependencies that the resolver needs (the infrastructure-provider lookup,
+ * the workspace-env lookup, and the GitHub-app installation-token minter) are
+ * all injected via the `providers` argument so callers can supply only the
+ * pieces they have available.
+ */
+import { InfrastructureType } from '../infrastructure/common.js';
+export type ResolveEnvValuesInput = {
+    env: {
+        [key: string]: string;
+    };
+    markSecret?: boolean;
+    project?: string;
+    workspace?: string;
+};
+export type ResolveEnvValuesOutput = {
+    [key: string]: string;
+};
+/**
+ * Look up an infrastructure provider by type. The Lambda passes a thin wrapper
+ * over its registered `aws` provider; the CLI passes the full registry.
+ */
+export type GetInfrastructureFn = (input: {
+    type: InfrastructureType;
+}) => GetInfrastructureOutput;
+/**
+ * Fetch a workspace's stored env values (used to find the GitHub-app
+ * configuration when resolving `github-app:` markers).
+ */
+export type GetWorkspaceEnvFn = (input: {
+    project: string;
+    workspace: string;
+}) => Promise<{
+    env: {
+        [key: string]: string;
+    };
+    success: true;
+} | {
+    reason: string;
+    success: false;
+}>;
+/**
+ * Resolve a workspace env map without recursing into github-app markers.
+ * Used to dereference the `aws:` (or other infra) values for the GitHub-app
+ * config keys.
+ */
+export type ResolveSimpleEnvFn = (env: Record<string, string>) => Promise<Record<string, string>>;
+/**
+ * Mint a GitHub-app installation token.
+ */
+export type MintInstallationTokenFn = (input: {
+    appId: string;
+    installationId: string;
+    privateKey: string;
+}) => Promise<string>;
+export interface ResolveEnvProviders {
+    /** Infrastructure-provider lookup — required. */
+    getInfrastructure: GetInfrastructureFn;
+    /**
+     * Optional GitHub-app dependencies. If any of them is missing, `github-app:`
+     * markers are left unresolved (the Lambda path can choose not to wire
+     * GitHub-app support at all).
+     */
+    getWorkspaceEnv?: GetWorkspaceEnvFn;
+    mintInstallationToken?: MintInstallationTokenFn;
+    resolveSimpleEnv?: ResolveSimpleEnvFn;
+}
+/**
+ * Resolve `infra:` prefixes and `github-app:` markers in an env map. Pure
+ * function — no module-level state, no `this`, side effects are limited to
+ * what the injected providers do.
+ */
+export declare function resolveEnvValues(input: ResolveEnvValuesInput, providers: ResolveEnvProviders): Promise<ResolveEnvValuesOutput>;
+/**
+ * Walk the resolved env, replace any `github-app:<installationId?>` marker
+ * with a freshly-minted installation token. Reads the GitHub-app config from
+ * the workspace env (`hereyaGithubAppId`, `hereyaGithubAppPrivateKey`,
+ * optional `hereyaGithubAppInstallationId`).
+ */
+export declare function resolveGithubAppMarkers(resolved: Record<string, string>, input: ResolveEnvValuesInput, providers: ResolveEnvProviders): Promise<Record<string, string>>;

package/dist/executor/resolve-env.js

@@ -0,0 +1,77 @@
+/**
+ * Resolve `infra:` prefixes and `github-app:` markers in an env map. Pure
+ * function — no module-level state, no `this`, side effects are limited to
+ * what the injected providers do.
+ */
+export async function resolveEnvValues(input, providers) {
+    const resolved = Object.fromEntries(await Promise.all(Object.entries(input.env).map(async ([key, value]) => {
+        // Check if value has infra prefix (contains ':' and first part is valid infra)
+        const colonIndex = value.indexOf(':');
+        if (colonIndex === -1) {
+            // No colon - plain value, return as-is
+            return [key, value];
+        }
+        const infraType = value.slice(0, colonIndex);
+        const infra$ = providers.getInfrastructure({ type: infraType });
+        if (!infra$.supported) {
+            // Unknown infra type - treat as plain value, return as-is
+            return [key, value];
+        }
+        const { infrastructure } = infra$;
+        const valueWithoutInfra = value.slice(colonIndex + 1);
+        const { isSecret, value: resolvedValue } = await infrastructure.resolveEnv({
+            value: valueWithoutInfra,
+        });
+        const finalValue = input.markSecret && isSecret ? `secret://${resolvedValue}` : resolvedValue;
+        return [key, finalValue];
+    })));
+    return resolveGithubAppMarkers(resolved, input, providers);
+}
+/**
+ * Walk the resolved env, replace any `github-app:<installationId?>` marker
+ * with a freshly-minted installation token. Reads the GitHub-app config from
+ * the workspace env (`hereyaGithubAppId`, `hereyaGithubAppPrivateKey`,
+ * optional `hereyaGithubAppInstallationId`).
+ */
+export async function resolveGithubAppMarkers(resolved, input, providers) {
+    const needsToken = Object.values(resolved).some((v) => typeof v === 'string' && v.startsWith('github-app:'));
+    if (!needsToken)
+        return resolved;
+    if (!input.workspace || !input.project)
+        return resolved;
+    const { getWorkspaceEnv, mintInstallationToken, resolveSimpleEnv } = providers;
+    if (!getWorkspaceEnv || !mintInstallationToken || !resolveSimpleEnv)
+        return resolved;
+    const wsEnv$ = await getWorkspaceEnv({
+        project: input.project,
+        workspace: input.workspace,
+    });
+    if (!wsEnv$.success)
+        return resolved;
+    // Use the simple infrastructure resolver - resolves aws: prefixes only and
+    // does NOT recurse into github-app: markers, so no circularity.
+    const wsResolved = await resolveSimpleEnv(wsEnv$.env);
+    const appId = wsResolved.hereyaGithubAppId;
+    const installationIdFromEnv = wsResolved.hereyaGithubAppInstallationId;
+    const privateKey = wsResolved.hereyaGithubAppPrivateKey;
+    if (!appId || !privateKey) {
+        console.warn('hereya: github-app marker present but workspace env missing hereyaGithubAppId / hereyaGithubAppPrivateKey; leaving marker unresolved');
+        return resolved;
+    }
+    const out = { ...resolved };
+    for (const [k, v] of Object.entries(resolved)) {
+        if (typeof v !== 'string' || !v.startsWith('github-app:'))
+            continue;
+        const installationId = v.slice('github-app:'.length) || installationIdFromEnv;
+        if (!installationId)
+            continue;
+        try {
+            // eslint-disable-next-line no-await-in-loop
+            out[k] = await mintInstallationToken({ appId, installationId, privateKey });
+        }
+        catch (error) {
+            console.warn(`hereya: failed to mint github-app installation token: ${error.message}`);
+        }
+    }
+    return out;
+}