hereya-cli 0.89.1 → 0.91.0

package/dist/index.d.ts

@@ -1 +1,4 @@
+export { type GetInfrastructureFn, type GetWorkspaceEnvFn, type MintInstallationTokenFn, type ResolveEnvProviders, resolveEnvValues, type ResolveEnvValuesInput, type ResolveEnvValuesOutput, resolveGithubAppMarkers, type ResolveSimpleEnvFn, } from './executor/resolve-env.js';
+export { InfrastructureType } from './infrastructure/common.js';
+export { awsProviderFactory, getInfrastructure, type GetInfrastructureInput, type GetInfrastructureOutput, type InfrastructureProviderFactory, registerInfrastructureProvider, resetInfrastructureProviders, } from './infrastructure/registry.js';
 export { run } from '@oclif/core';

package/dist/index.js

@@ -1 +1,8 @@
+// Public API for external consumers (e.g. the broker Lambda) that import
+// `hereya-cli` as a published npm dependency. None of these re-exports pull
+// in the `local` infrastructure provider or the rest of the CLI runtime — the
+// Lambda bundle stays slim.
+export { resolveEnvValues, resolveGithubAppMarkers, } from './executor/resolve-env.js';
+export { InfrastructureType } from './infrastructure/common.js';
+export { awsProviderFactory, getInfrastructure, registerInfrastructureProvider, resetInfrastructureProviders, } from './infrastructure/registry.js';
 export { run } from '@oclif/core';

package/dist/infrastructure/index.d.ts

@@ -1,13 +1,19 @@
 import { z } from 'zod';
 import { Logger } from '../lib/log.js';
 import { PackageMetadata } from '../lib/package/index.js';
-import { AwsInfrastructure } from './aws.js';
-import { Infrastructure, InfrastructureType } from './common.js';
-import { LocalInfrastructure } from './local.js';
-export declare const localInfrastructure: LocalInfrastructure;
-export declare const awsInfrastructure: AwsInfrastructure;
+import { Infrastructure } from './common.js';
+import { type InfrastructureProviderFactory } from './registry.js';
+export { awsProviderFactory, getInfrastructure, type GetInfrastructureInput, type GetInfrastructureOutput, type InfrastructureProviderFactory, registerInfrastructureProvider, resetInfrastructureProviders, } from './registry.js';
+/**
+ * Default factory for the local-filesystem provider. Registered eagerly when
+ * this module is imported (the CLI's standard entry point). The broker
+ * Lambda never imports this module, so `LocalInfrastructure` and its
+ * filesystem deps are tree-shaken out of the Lambda bundle.
+ */
+export declare const localProviderFactory: InfrastructureProviderFactory;
+export declare const awsInfrastructure: Infrastructure;
+export declare const localInfrastructure: Infrastructure;
 export declare function resolveEnvValues(env: Record<string, string>): Promise<Record<string, string>>;
-export declare function getInfrastructure(input: GetInfrastructureInput): GetInfrastructureOutput;
 export declare function destroyPackage(input: DestroyPackageInput): Promise<DestroyPackageOutput>;
 export declare function provisionPackage(input: ProvisionPackageInput): Promise<ProvisionPackageOutput>;
 export declare function getProvisioningLogicalId({ app, pkg, project, workspace }: {
@@ -49,14 +55,4 @@ export type ProvisionPackageOutput = {
     reason: string;
     success: false;
 };
-export type GetInfrastructureInput = {
-    type: InfrastructureType;
-};
-export type GetInfrastructureOutput = {
-    infrastructure: Infrastructure;
-    supported: true;
-} | {
-    reason: string;
-    supported: false;
-};
 export type PackageMetadata = z.infer<typeof PackageMetadata>;

package/dist/infrastructure/index.js

@@ -1,11 +1,26 @@
 import { getBackend } from '../backend/index.js';
 import { stripOrgPrefix } from '../lib/org-utils.js';
 import { resolvePackage } from '../lib/package/index.js';
-import { AwsInfrastructure } from './aws.js';
 import { InfrastructureType } from './common.js';
 import { LocalInfrastructure } from './local.js';
-export const localInfrastructure = new LocalInfrastructure();
-export const awsInfrastructure = new AwsInfrastructure();
+import { getInfrastructure, getOrCreateProvider, registerInfrastructureProvider, } from './registry.js';
+// Re-export the registry surface so existing imports
+// (`from '../infrastructure/index.js'`) keep working.
+export { awsProviderFactory, getInfrastructure, registerInfrastructureProvider, resetInfrastructureProviders, } from './registry.js';
+/**
+ * Default factory for the local-filesystem provider. Registered eagerly when
+ * this module is imported (the CLI's standard entry point). The broker
+ * Lambda never imports this module, so `LocalInfrastructure` and its
+ * filesystem deps are tree-shaken out of the Lambda bundle.
+ */
+export const localProviderFactory = () => new LocalInfrastructure();
+registerInfrastructureProvider(InfrastructureType.local, localProviderFactory);
+// Backwards-compatible singleton exports. These remain stable references
+// (`sinon.stub(awsInfrastructure, 'foo')` continues to work) because the
+// default registrations above run at import time and the cached instances
+// never change identity for the lifetime of the CLI process.
+export const awsInfrastructure = getOrCreateProvider(InfrastructureType.aws);
+export const localInfrastructure = getOrCreateProvider(InfrastructureType.local);
 export async function resolveEnvValues(env) {
     return Object.fromEntries(await Promise.all(Object.entries(env).map(async ([key, value]) => {
         const colonIndex = value.indexOf(':');
@@ -21,28 +36,6 @@ export async function resolveEnvValues(env) {
         return [key, resolvedValue];
     })));
 }
-export function getInfrastructure(input) {
-    switch (input.type) {
-        case InfrastructureType.aws: {
-            return {
-                infrastructure: awsInfrastructure,
-                supported: true,
-            };
-        }
-        case InfrastructureType.local: {
-            return {
-                infrastructure: localInfrastructure,
-                supported: true,
-            };
-        }
-        default: {
-            return {
-                reason: `Invalid infrastructure type: ${input.type}. Valid options are: aws, local`,
-                supported: false,
-            };
-        }
-    }
-}
 /**
  * When `input.app` is set, scope the provisioning row by `app` (workspace-scoped).
  * Otherwise, scope by `project`. Apps and projects are mutually exclusive scopes

package/dist/infrastructure/registry.d.ts

@@ -0,0 +1,38 @@
+import { Infrastructure, InfrastructureType } from './common.js';
+/**
+ * A factory that lazily constructs an `Infrastructure` provider singleton.
+ * Registered factories are invoked at most once per type — the resulting
+ * instance is cached so external consumers (and tests that stub methods on
+ * `awsInfrastructure` / `localInfrastructure`) see the same reference every
+ * time.
+ */
+export type InfrastructureProviderFactory = () => Infrastructure;
+/**
+ * Default factory for the AWS provider. Both the CLI and the broker Lambda
+ * register this; it is the only factory the Lambda bundle pulls in.
+ */
+export declare const awsProviderFactory: InfrastructureProviderFactory;
+/**
+ * Register (or replace) the factory for a given infrastructure type. Resets
+ * any cached instance for that type so the next `getInfrastructure` call
+ * rebuilds it from the new factory.
+ */
+export declare function registerInfrastructureProvider(type: InfrastructureType, factory: InfrastructureProviderFactory): void;
+/**
+ * Clear all registered providers and cached instances. Primarily useful for
+ * tests and for the Lambda bundle that wants to start with a clean slate
+ * before registering only `aws`.
+ */
+export declare function resetInfrastructureProviders(): void;
+export declare function getOrCreateProvider(type: InfrastructureType): Infrastructure;
+export declare function getInfrastructure(input: GetInfrastructureInput): GetInfrastructureOutput;
+export type GetInfrastructureInput = {
+    type: InfrastructureType;
+};
+export type GetInfrastructureOutput = {
+    infrastructure: Infrastructure;
+    supported: true;
+} | {
+    reason: string;
+    supported: false;
+};

package/dist/infrastructure/registry.js

@@ -0,0 +1,61 @@
+/**
+ * Infrastructure provider registry. This module is the slim, Lambda-friendly
+ * entry point: it never imports the local-filesystem provider. The CLI's
+ * `./index.ts` extends this registry with `LocalInfrastructure`; the broker
+ * Lambda imports only this registry (via the `hereya-cli` package root) and
+ * registers `aws` only.
+ */
+import { AwsInfrastructure } from './aws.js';
+import { InfrastructureType } from './common.js';
+/**
+ * Default factory for the AWS provider. Both the CLI and the broker Lambda
+ * register this; it is the only factory the Lambda bundle pulls in.
+ */
+export const awsProviderFactory = () => new AwsInfrastructure();
+const factories = new Map();
+const instances = new Map();
+/**
+ * Register (or replace) the factory for a given infrastructure type. Resets
+ * any cached instance for that type so the next `getInfrastructure` call
+ * rebuilds it from the new factory.
+ */
+export function registerInfrastructureProvider(type, factory) {
+    factories.set(type, factory);
+    instances.delete(type);
+}
+/**
+ * Clear all registered providers and cached instances. Primarily useful for
+ * tests and for the Lambda bundle that wants to start with a clean slate
+ * before registering only `aws`.
+ */
+export function resetInfrastructureProviders() {
+    factories.clear();
+    instances.clear();
+}
+export function getOrCreateProvider(type) {
+    const cached = instances.get(type);
+    if (cached)
+        return cached;
+    const factory = factories.get(type);
+    if (!factory) {
+        throw new Error(`Infrastructure provider not registered: ${type}. Call registerInfrastructureProvider(${type}, factory) first.`);
+    }
+    const instance = factory();
+    instances.set(type, instance);
+    return instance;
+}
+export function getInfrastructure(input) {
+    if (!factories.has(input.type)) {
+        return {
+            reason: `Invalid infrastructure type: ${input.type}. Valid options are: ${[...factories.keys()].join(', ') || '<none registered>'}`,
+            supported: false,
+        };
+    }
+    return {
+        infrastructure: getOrCreateProvider(input.type),
+        supported: true,
+    };
+}
+// Register the AWS provider eagerly. The CLI's `infrastructure/index.ts`
+// additionally registers the `local` provider; the broker Lambda does not.
+registerInfrastructureProvider(InfrastructureType.aws, awsProviderFactory);

package/dist/lib/env/test.setup.d.ts

@@ -0,0 +1,7 @@
+import { EnvManager } from './index.js';
+export interface EnvManagerTestContext {
+    envManager: EnvManager;
+    tempDir: string;
+}
+export declare function setupEnvManagerTest(): Promise<EnvManagerTestContext>;
+export declare function teardownEnvManagerTest(context: EnvManagerTestContext): Promise<void>;

package/dist/lib/env/test.setup.js

@@ -0,0 +1,18 @@
+import { randomUUID } from 'node:crypto';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import * as sinon from 'sinon';
+import { EnvManager } from './index.js';
+export async function setupEnvManagerTest() {
+    const tempDir = path.join(os.tmpdir(), 'hereya-test-env', randomUUID());
+    await fs.mkdir(path.join(tempDir, '.hereya'), { recursive: true });
+    process.env.HEREYA_PROJECT_ROOT_DIR = tempDir;
+    const envManager = new EnvManager();
+    return { envManager, tempDir };
+}
+export async function teardownEnvManagerTest(context) {
+    sinon.restore();
+    await fs.rm(context.tempDir, { force: true, recursive: true });
+    delete process.env.HEREYA_PROJECT_ROOT_DIR;
+}

package/dist/lib/executor-start/auth.d.ts

@@ -0,0 +1,2 @@
+import { CloudBackend } from '../../backend/cloud/cloud-backend.js';
+export declare function createAuthenticatedBackend(hereyaToken: string, cloudUrl: string): Promise<CloudBackend>;

package/dist/lib/executor-start/auth.js

@@ -0,0 +1,21 @@
+import { CloudBackend } from '../../backend/cloud/cloud-backend.js';
+import { loginWithToken } from '../../backend/cloud/login.js';
+import { saveCloudCredentials } from '../../backend/config.js';
+export async function createAuthenticatedBackend(hereyaToken, cloudUrl) {
+    const loginResult = await loginWithToken(cloudUrl, hereyaToken);
+    if (!loginResult.success) {
+        throw new Error(`Failed to authenticate: ${loginResult.error}`);
+    }
+    await saveCloudCredentials({
+        accessToken: loginResult.accessToken,
+        clientId: loginResult.clientId,
+        refreshToken: loginResult.refreshToken,
+        url: cloudUrl,
+    });
+    return new CloudBackend({
+        accessToken: loginResult.accessToken,
+        clientId: loginResult.clientId,
+        refreshToken: loginResult.refreshToken,
+        url: cloudUrl,
+    });
+}

package/dist/lib/executor-start/execute-app-job.d.ts

@@ -0,0 +1,13 @@
+import { CloudBackend } from '../../backend/cloud/cloud-backend.js';
+import { Logger } from '../../lib/log.js';
+export type AppJobResult = {
+    reason: string;
+    success: false;
+} | {
+    success: true;
+};
+export declare function executeAppJob(job: {
+    id: string;
+    payload: any;
+    type: string;
+}, cloudBackend: CloudBackend, logger: Logger): Promise<AppJobResult>;

package/dist/lib/executor-start/execute-app-job.js

@@ -0,0 +1,146 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import * as appSourceLib from '../../lib/app-source.js';
+import { shellUtils } from '../../lib/shell.js';
+import { sanitizeWorkspaceForFilename } from './format.js';
+export async function executeAppJob(job, cloudBackend, logger) {
+    const isDeploy = job.type === 'app-deploy';
+    const subcommand = isDeploy ? 'deploy' : 'destroy';
+    const payload = job.payload;
+    const { appName, commit, parameters: providedParameters, repository, sha256, version, workspace } = payload;
+    if (!appName || !workspace || !repository) {
+        return {
+            reason: `Missing appName, workspace, or repository in ${job.type} job payload`,
+            success: false,
+        };
+    }
+    let cleanup;
+    try {
+        logger.info(`Downloading app source ${repository}${commit ? `@${commit}` : ''}...`);
+        const downloadResult = await appSourceLib.appSource.download({ commit, logger, repository, sha256 });
+        cleanup = downloadResult.cleanup;
+        const { rootDir } = downloadResult;
+        await cloudBackend.updateAppDeployment({
+            lastJobId: job.id,
+            name: appName,
+            status: isDeploy ? 'deploying' : 'destroying',
+            workspace,
+        });
+        const parameters = providedParameters ?? {};
+        const paramFlags = [];
+        for (const [key, value] of Object.entries(parameters)) {
+            paramFlags.push('-p', `${key}=${value}`);
+        }
+        const versionFlags = isDeploy && version ? ['--version', version] : [];
+        logger.info(`Running hereya app ${subcommand} ${appName} -w ${workspace} --local...`);
+        const runOutcome = await runAppSubcommand({
+            appName,
+            logger,
+            paramFlags,
+            rootDir,
+            subcommand,
+            versionFlags,
+            workspace,
+        });
+        if (!runOutcome.success) {
+            await markAppDeploymentFailed({ appName, jobId: job.id, reason: runOutcome.reason, workspace }, cloudBackend);
+            return { reason: runOutcome.reason, success: false };
+        }
+        const patchResult = await patchAppFinalState({
+            appName,
+            cloudBackend,
+            isDeploy,
+            jobId: job.id,
+            rootDir,
+            workspace,
+        });
+        if (!patchResult.success) {
+            return patchResult;
+        }
+        return { success: true };
+    }
+    catch (error) {
+        try {
+            await markAppDeploymentFailed({ appName, jobId: job.id, reason: error.message, workspace }, cloudBackend);
+        }
+        catch {
+            // best-effort
+        }
+        return { reason: `app-${subcommand} failed: ${error.message}`, success: false };
+    }
+    finally {
+        if (cleanup) {
+            await cleanup();
+        }
+    }
+}
+async function runAppSubcommand(input) {
+    const { appName, logger, paramFlags, rootDir, subcommand, versionFlags, workspace } = input;
+    let runResult;
+    try {
+        runResult = await shellUtils.runShell('hereya', ['app', subcommand, appName, '-w', workspace, ...paramFlags, ...versionFlags, '--local'], {
+            directory: rootDir,
+            env: { ...process.env, HEREYA_LOCAL_EXECUTION: 'true', HEREYA_PROJECT_ROOT_DIR: rootDir },
+            logger,
+        });
+    }
+    catch (error) {
+        return { reason: `hereya app ${subcommand} failed: ${error.message}`, success: false };
+    }
+    if (runResult && runResult.status !== 0) {
+        return { reason: `hereya app ${subcommand} exited with code ${runResult.status}`, success: false };
+    }
+    return { success: true };
+}
+async function markAppDeploymentFailed(input, cloudBackend) {
+    try {
+        await cloudBackend.updateAppDeployment({
+            lastJobId: input.jobId,
+            name: input.appName,
+            status: 'failed',
+            workspace: input.workspace,
+        });
+    }
+    catch {
+        // best-effort; failure of the PATCH must not bubble out
+    }
+}
+async function patchAppFinalState(input) {
+    const { appName, cloudBackend, isDeploy, jobId, rootDir, workspace } = input;
+    if (!isDeploy) {
+        const updateResult = await cloudBackend.updateAppDeployment({
+            env: {},
+            lastJobId: jobId,
+            name: appName,
+            status: 'destroyed',
+            workspace,
+        });
+        if (!updateResult.success) {
+            return { reason: `Destroy succeeded but PATCH to deployment failed: ${updateResult.reason}`, success: false };
+        }
+        return { success: true };
+    }
+    const deployEnvFile = path.join(rootDir, '.hereya', `deploy-env.${sanitizeWorkspaceForFilename(workspace)}.json`);
+    let parsed;
+    try {
+        const content = await fs.readFile(deployEnvFile, 'utf8');
+        parsed = JSON.parse(content);
+    }
+    catch (error) {
+        const reason = `Failed to read deploy env file at ${deployEnvFile}: ${error.message}`;
+        await markAppDeploymentFailed({ appName, jobId, reason, workspace }, cloudBackend);
+        return { reason, success: false };
+    }
+    const updateResult = await cloudBackend.updateAppDeployment({
+        env: parsed.env ?? {},
+        lastJobId: jobId,
+        name: appName,
+        state: parsed.state,
+        status: 'deployed',
+        workspace,
+    });
+    if (!updateResult.success) {
+        return { reason: `Provisioning succeeded but PATCH to deployment failed: ${updateResult.reason}`, success: false };
+    }
+    return { success: true };
+}

package/dist/lib/executor-start/execute-deploy-job.d.ts

@@ -0,0 +1,14 @@
+import { CloudBackend } from '../../backend/cloud/cloud-backend.js';
+import { LocalExecutor } from '../../executor/local.js';
+import { Logger } from '../../lib/log.js';
+export type DeployJobResult = {
+    reason: string;
+    success: false;
+} | {
+    success: true;
+};
+export declare function executeDeployJob(job: {
+    id: string;
+    payload: any;
+    type: string;
+}, executor: LocalExecutor, cloudBackend: CloudBackend, logger: Logger): Promise<DeployJobResult>;

package/dist/lib/executor-start/execute-deploy-job.js

@@ -0,0 +1,64 @@
+import { randomUUID } from 'node:crypto';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { cloneWithCredentialHelper } from '../../lib/git-utils.js';
+import { runShell } from '../../lib/shell.js';
+export async function executeDeployJob(job, executor, cloudBackend, logger) {
+    const { gitBranch, project, workspace } = job.payload;
+    if (!project || !workspace) {
+        return { reason: 'Missing project or workspace in job payload', success: false };
+    }
+    const metadata$ = await cloudBackend.getProjectMetadata({ project });
+    if (!metadata$.found) {
+        return { reason: `No metadata found for project ${project}`, success: false };
+    }
+    const { metadata } = metadata$;
+    if (!metadata.env?.hereyaGitRemoteUrl) {
+        return { reason: 'Project metadata missing hereyaGitRemoteUrl', success: false };
+    }
+    const gitEnvToResolve = {};
+    for (const [key, value] of Object.entries(metadata.env)) {
+        if (key.startsWith('hereyaGit'))
+            gitEnvToResolve[key] = value;
+    }
+    const resolvedGitEnv = await executor.resolveEnvValues({ env: gitEnvToResolve, project, workspace });
+    const tempDir = path.join(os.tmpdir(), `hereya-deploy-${randomUUID()}`);
+    try {
+        const branch = gitBranch || 'main';
+        logger.info(`Cloning ${resolvedGitEnv.hereyaGitRemoteUrl} (branch: ${branch})...`);
+        const cloneResult = await cloneWithCredentialHelper({
+            gitUrl: resolvedGitEnv.hereyaGitRemoteUrl,
+            hereyaBinPath: process.argv[1],
+            password: resolvedGitEnv.hereyaGitPassword,
+            targetDir: tempDir,
+            username: resolvedGitEnv.hereyaGitUsername,
+        });
+        if (!cloneResult.success) {
+            return { reason: `Git clone failed: ${cloneResult.reason}`, success: false };
+        }
+        if (branch !== 'main' && branch !== 'master') {
+            await runShell('git', ['checkout', branch], { directory: tempDir, logger });
+        }
+        const command = job.type === 'deploy' ? 'deploy' : 'undeploy';
+        logger.info(`Running hereya ${command} -w ${workspace} --local...`);
+        const result = await runShell('hereya', [command, '-w', workspace, '--local'], {
+            directory: tempDir,
+            env: { ...process.env, HEREYA_LOCAL_EXECUTION: 'true', HEREYA_PROJECT_ROOT_DIR: tempDir },
+            logger,
+        });
+        logger.info(`hereya ${command} exited with code ${result.status}`);
+        if (result.status !== 0) {
+            return { reason: `hereya ${command} failed (exit code ${result.status})`, success: false };
+        }
+        return { success: true };
+    }
+    finally {
+        try {
+            await fs.rm(tempDir, { force: true, recursive: true });
+        }
+        catch {
+            // ignore cleanup errors
+        }
+    }
+}

package/dist/lib/executor-start/execute-init-job.d.ts

@@ -0,0 +1,14 @@
+import { LocalExecutor } from '../../executor/local.js';
+import { Logger } from '../../lib/log.js';
+export type InitJobResult = {
+    hereyaGitRemoteUrl: string;
+    success: true;
+} | {
+    reason: string;
+    success: false;
+};
+export declare function executeInitJob(job: {
+    id: string;
+    payload: any;
+    type: string;
+}, executor: LocalExecutor, logger: Logger): Promise<InitJobResult>;

package/dist/lib/executor-start/execute-init-job.js

@@ -0,0 +1,135 @@
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { SimpleConfigManager } from '../../lib/config/simple.js';
+import { gitUtils } from '../../lib/git-utils.js';
+import { shellUtils } from '../../lib/shell.js';
+import { redactCredentials } from './format.js';
+export async function executeInitJob(job, executor, logger) {
+    const payload = job.payload;
+    const { deployWorkspace, parameters, projectName, template, workspace } = payload;
+    if (!projectName || !workspace || !template || !deployWorkspace) {
+        return {
+            reason: 'Missing projectName, workspace, template, or deployWorkspace in job payload',
+            success: false,
+        };
+    }
+    let password;
+    const redactingLogger = {
+        debug(msg) {
+            logger.debug(redactCredentials(msg, password));
+        },
+        error(msg) {
+            logger.error(redactCredentials(msg, password));
+        },
+        info(msg) {
+            logger.info(redactCredentials(msg, password));
+        },
+    };
+    const scratchDir = await fs.mkdtemp(path.join(os.tmpdir(), 'hereya-init-'));
+    try {
+        redactingLogger.info(`Provisioning template ${template}...`);
+        const provisionResult = await executor.provision({
+            logger: redactingLogger,
+            package: template,
+            parameters: {
+                ...parameters,
+                deployWorkspace,
+                projectName,
+                workspace,
+            },
+            project: projectName,
+            workspace,
+        });
+        if (!provisionResult.success) {
+            return { reason: `Template provisioning failed: ${provisionResult.reason}`, success: false };
+        }
+        const cloneResult = await provisionAndClone(provisionResult, scratchDir, redactingLogger, (pwd) => {
+            password = pwd;
+        });
+        if (!cloneResult.success) {
+            return cloneResult;
+        }
+        const { hereyaGitPassword, hereyaGitRemoteUrl, hereyaGitUsername, repoDir } = cloneResult;
+        redactingLogger.info('Writing hereya.yaml...');
+        const config = {
+            project: projectName,
+            workspace,
+        };
+        await new SimpleConfigManager().saveConfig({ config, projectRootDir: repoDir });
+        redactingLogger.info('Committing and pushing initial project config...');
+        const commitResult = await commitAndPush(repoDir, hereyaGitUsername, hereyaGitPassword, redactingLogger);
+        if (!commitResult.success) {
+            return {
+                reason: `Git commit/push failed: ${redactCredentials(commitResult.reason, password)}`,
+                success: false,
+            };
+        }
+        return { hereyaGitRemoteUrl, success: true };
+    }
+    catch (error) {
+        return {
+            reason: `Init failed: ${redactCredentials(error.message ?? String(error), password)}`,
+            success: false,
+        };
+    }
+    finally {
+        try {
+            await fs.rm(scratchDir, { force: true, recursive: true });
+        }
+        catch {
+            // ignore cleanup errors
+        }
+    }
+}
+async function provisionAndClone(provisionResult, scratchDir, logger, setPassword) {
+    const { env } = provisionResult;
+    const { hereyaGitPassword, hereyaGitRemoteUrl, hereyaGitUsername } = env;
+    setPassword(hereyaGitPassword);
+    if (!hereyaGitRemoteUrl) {
+        return { reason: 'Template did not export hereyaGitRemoteUrl', success: false };
+    }
+    logger.info(`Cloning ${hereyaGitRemoteUrl}...`);
+    const repoDir = path.join(scratchDir, 'repo');
+    const cloneResult = await gitUtils.cloneWithCredentialHelper({
+        gitUrl: hereyaGitRemoteUrl,
+        hereyaBinPath: process.argv[1],
+        password: hereyaGitPassword,
+        targetDir: repoDir,
+        username: hereyaGitUsername,
+    });
+    if (!cloneResult.success) {
+        return { reason: `Git clone failed: ${cloneResult.reason}`, success: false };
+    }
+    return { hereyaGitPassword, hereyaGitRemoteUrl, hereyaGitUsername, repoDir, success: true };
+}
+async function commitAndPush(repoDir, hereyaGitUsername, hereyaGitPassword, logger) {
+    const gitEnv = {
+        ...process.env,
+        GIT_AUTHOR_EMAIL: 'executor@hereya.dev',
+        GIT_AUTHOR_NAME: 'hereya-executor',
+        GIT_COMMITTER_EMAIL: 'executor@hereya.dev',
+        GIT_COMMITTER_NAME: 'hereya-executor',
+    };
+    if (hereyaGitUsername)
+        gitEnv.hereyaGitUsername = hereyaGitUsername;
+    if (hereyaGitPassword)
+        gitEnv.hereyaGitPassword = hereyaGitPassword;
+    try {
+        await shellUtils.runShell('git', ['add', '.'], { directory: repoDir, env: gitEnv, logger });
+        await shellUtils.runShell('git', ['commit', '-m', '"chore: hereya init"'], {
+            directory: repoDir,
+            env: gitEnv,
+            logger,
+        });
+        await shellUtils.runShell('git', ['push', 'origin', 'HEAD'], {
+            directory: repoDir,
+            env: gitEnv,
+            logger,
+        });
+        return { success: true };
+    }
+    catch (error) {
+        return { reason: error.message ?? String(error), success: false };
+    }
+}