@kuckit/cli 0.1.1 → 1.0.0

package/dist/bin.js

@@ -3,10 +3,11 @@ import { i as generateModule, n as loadTryLoadKuckitConfig, r as addModule, t as
 import { program } from "commander";
 import { dirname, join } from "node:path";
 import { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
-import { spawn } from "child_process";
-import { access, constants as constants$1, mkdir, readFile, writeFile } from "fs/promises";
+import { execSync, spawn } from "child_process";
+import { access, constants as constants$1, mkdir, readFile, unlink, writeFile } from "fs/promises";
 import { dirname as dirname$1, join as join$1 } from "path";
 import { homedir } from "node:os";
+import { confirm, input, select } from "@inquirer/prompts";
 
 //#region src/commands/doctor.ts
 const CONFIG_FILES = [
@@ -77,7 +78,7 @@ function checkModuleExports(packageName, cwd) {
 	].some((p) => existsSync(p));
 	return result;
 }
-async function loadConfig$1(configPath) {
+async function loadConfig$9(configPath) {
 	try {
 		if (configPath.endsWith(".ts")) {
 			const { createJiti } = await import("jiti");
@@ -117,7 +118,7 @@ async function doctor(options) {
 	});
 	let configModules = [];
 	if (configPath) {
-		const { success, config, error } = await loadConfig$1(configPath);
+		const { success, config, error } = await loadConfig$9(configPath);
 		if (success && config && typeof config === "object") {
 			const cfg = config;
 			if (Array.isArray(cfg.modules)) {
@@ -345,9 +346,9 @@ async function search(keyword, options) {
 
 //#endregion
 //#region src/commands/db.ts
-const KUCKIT_DIR = ".kuckit";
+const KUCKIT_DIR$9 = ".kuckit";
 const TEMP_CONFIG_NAME = "drizzle.config.ts";
-async function fileExists(path) {
+async function fileExists$9(path) {
 	try {
 		await access(path, constants$1.F_OK);
 		return true;
@@ -355,10 +356,10 @@ async function fileExists(path) {
 		return false;
 	}
 }
-async function findProjectRoot(cwd) {
+async function findProjectRoot$9(cwd) {
 	let dir = cwd;
 	while (dir !== dirname$1(dir)) {
-		if (await fileExists(join$1(dir, "package.json"))) return dir;
+		if (await fileExists$9(join$1(dir, "package.json"))) return dir;
 		dir = dirname$1(dir);
 	}
 	return null;
@@ -371,7 +372,7 @@ async function getDatabaseUrl(cwd, options) {
 		join$1(cwd, "apps", "server", ".env"),
 		join$1(cwd, ".env.local")
 	];
-	for (const envPath of envPaths) if (await fileExists(envPath)) try {
+	for (const envPath of envPaths) if (await fileExists$9(envPath)) try {
 		const match = (await readFile(envPath, "utf-8")).match(/^DATABASE_URL=(.+)$/m);
 		if (match) return match[1].replace(/^["']|["']$/g, "");
 	} catch {}
@@ -387,10 +388,10 @@ async function discoverModuleSchemas(cwd) {
 		let moduleId = null;
 		if (moduleSpec.package) {
 			const workspacePath = join$1(cwd, "packages", moduleSpec.package.replace(/^@[^/]+\//, ""));
-			if (await fileExists(join$1(workspacePath, "package.json"))) packagePath = workspacePath;
+			if (await fileExists$9(join$1(workspacePath, "package.json"))) packagePath = workspacePath;
 			else {
 				const nodeModulesPath = join$1(cwd, "node_modules", moduleSpec.package);
-				if (await fileExists(join$1(nodeModulesPath, "package.json"))) packagePath = nodeModulesPath;
+				if (await fileExists$9(join$1(nodeModulesPath, "package.json"))) packagePath = nodeModulesPath;
 			}
 			if (packagePath) try {
 				moduleId = JSON.parse(await readFile(join$1(packagePath, "package.json"), "utf-8")).kuckit?.id || moduleSpec.package;
@@ -405,7 +406,7 @@ async function discoverModuleSchemas(cwd) {
 			join$1(packagePath, "src", "schema", "index.ts"),
 			join$1(packagePath, "src", "schema.ts")
 		];
-		for (const schemaPath of schemaLocations) if (await fileExists(schemaPath)) {
+		for (const schemaPath of schemaLocations) if (await fileExists$9(schemaPath)) {
 			schemas.push({
 				moduleId: moduleId || "unknown",
 				schemaPath
@@ -414,14 +415,14 @@ async function discoverModuleSchemas(cwd) {
 		}
 	}
 	const centralSchemaPath = join$1(cwd, "packages", "db", "src", "schema");
-	if (await fileExists(centralSchemaPath)) schemas.push({
+	if (await fileExists$9(centralSchemaPath)) schemas.push({
 		moduleId: "core",
 		schemaPath: centralSchemaPath
 	});
 	return schemas;
 }
 async function generateTempDrizzleConfig(cwd, databaseUrl, schemas) {
-	const kuckitDir = join$1(cwd, KUCKIT_DIR);
+	const kuckitDir = join$1(cwd, KUCKIT_DIR$9);
 	await mkdir(kuckitDir, { recursive: true });
 	const configPath = join$1(kuckitDir, TEMP_CONFIG_NAME);
 	const schemaPaths = schemas.map((s) => s.schemaPath);
@@ -473,7 +474,7 @@ function runDrizzleKit(command, configPath, cwd) {
 	});
 }
 async function runDbCommand(command, options) {
-	const projectRoot = await findProjectRoot(process.cwd());
+	const projectRoot = await findProjectRoot$9(process.cwd());
 	if (!projectRoot) {
 		console.error("Error: Could not find project root (no package.json found)");
 		process.exit(1);
@@ -521,7 +522,7 @@ async function dbStudio(options) {
 const DEFAULT_SERVER_URL = "http://localhost:3000";
 const CONFIG_DIR = join(homedir(), ".kuckit");
 const CONFIG_PATH = join(CONFIG_DIR, "config.json");
-function loadConfig() {
+function loadConfig$8() {
 	try {
 		if (!existsSync(CONFIG_PATH)) return null;
 		const content = readFileSync(CONFIG_PATH, "utf-8");
@@ -530,7 +531,7 @@ function loadConfig() {
 		return null;
 	}
 }
-function saveConfig(config) {
+function saveConfig$2(config) {
 	if (!existsSync(CONFIG_DIR)) mkdirSync(CONFIG_DIR, {
 		recursive: true,
 		mode: 448
@@ -574,7 +575,7 @@ function formatExpiryDate(expiresAt) {
 	});
 }
 async function authLogin(options) {
-	const config = loadConfig();
+	const config = loadConfig$8();
 	const serverUrl = getServerUrl(config, options.server);
 	const scopes = options.scopes?.split(",").map((s) => s.trim()) ?? ["cli"];
 	console.log("\nAuthenticating with Kuckit...\n");
@@ -639,14 +640,16 @@ async function authLogin(options) {
 						process.exit(1);
 					}
 					const expiresAt = new Date(Date.now() + pollResult.expiresIn * 1e3).toISOString();
-					saveConfig({
+					saveConfig$2({
 						...config,
 						cliToken: pollResult.token,
 						tokenExpiresAt: expiresAt,
+						permissions: pollResult.permissions,
 						serverUrl
 					});
 					console.log("✓ Successfully authenticated!");
 					console.log(`  Token expires: ${formatExpiryDate(expiresAt)}`);
+					if (pollResult.permissions && pollResult.permissions.length > 0) console.log(`  Permissions: ${pollResult.permissions.join(", ")}`);
 					console.log("");
 					return;
 				}
@@ -670,7 +673,7 @@ async function authLogin(options) {
 	process.exit(1);
 }
 async function authWhoami(options) {
-	const config = loadConfig();
+	const config = loadConfig$8();
 	if (!config?.cliToken) {
 		if (options.json) console.log(JSON.stringify({ authenticated: false }));
 		else console.log("Not logged in. Run 'kuckit auth login' to authenticate.");
@@ -689,7 +692,8 @@ async function authWhoami(options) {
 		userId: config.userId,
 		userName: config.userName,
 		serverUrl: config.serverUrl,
-		tokenExpiresAt: config.tokenExpiresAt
+		tokenExpiresAt: config.tokenExpiresAt,
+		permissions: config.permissions
 	}));
 	else {
 		console.log("\nAuthenticated");
@@ -697,11 +701,12 @@ async function authWhoami(options) {
 		if (config.userId) console.log(`  ID: ${config.userId}`);
 		if (config.serverUrl) console.log(`  Server: ${config.serverUrl}`);
 		if (config.tokenExpiresAt) console.log(`  Token expires: ${formatExpiryDate(config.tokenExpiresAt)}`);
+		if (config.permissions && config.permissions.length > 0) console.log(`  Permissions: ${config.permissions.join(", ")}`);
 		console.log("");
 	}
 }
 async function authLogout() {
-	if (!loadConfig()?.cliToken) {
+	if (!loadConfig$8()?.cliToken) {
 		console.log("Already logged out.");
 		return;
 	}
@@ -728,7 +733,7 @@ function registerAuthCommands(program$1) {
 * Exits the process with an error message if not authenticated.
 */
 function requireAuth() {
-	const config = loadConfig();
+	const config = loadConfig$8();
 	if (!config?.cliToken) {
 		console.error("\nError: Not logged in. Run 'kuckit auth login' first.\n");
 		process.exit(1);
@@ -740,43 +745,1857 @@ function requireAuth() {
 }
 
 //#endregion
-//#region src/bin.ts
-program.name("kuckit").description("CLI tools for Kuckit SDK module development").version("0.1.0");
-program.command("generate").description("Generate Kuckit resources").command("module <name>").description("Generate a new Kuckit module").option("-o, --org <org>", "Organization scope for package name", "").option("-d, --dir <directory>", "Target directory", "packages").action(async (name, options) => {
-	requireAuth();
-	await generateModule(name, options);
-});
-program.command("add <package>").description("Install and wire a Kuckit module").option("--skip-install", "Skip package installation", false).action(async (packageName, options) => {
-	requireAuth();
-	await addModule(packageName, options);
-});
-program.command("discover").description("Scan node_modules for installed Kuckit modules").option("--json", "Output as JSON (non-interactive)", false).option("--no-interactive", "Disable interactive prompts").action(async (options) => {
-	requireAuth();
-	await discoverModules(options);
-});
-program.command("doctor").description("Check Kuckit setup and validate module configuration").option("--json", "Output as JSON", false).action(async (options) => {
-	await doctor(options);
-});
-program.command("search <keyword>").description("Search npm registry for Kuckit modules").option("--json", "Output as JSON", false).option("-l, --limit <number>", "Maximum results to return", "10").action(async (keyword, options) => {
-	await search(keyword, {
-		json: options.json,
-		limit: parseInt(options.limit, 10)
+//#region src/commands/infra/runner.ts
+/**
+* Run a Pulumi CLI command
+*/
+function runPulumi(args, options) {
+	return new Promise((resolve) => {
+		const proc = spawn("pulumi", args, {
+			cwd: options.cwd,
+			stdio: options.stream ? [
+				"inherit",
+				"pipe",
+				"pipe"
+			] : [
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			shell: true,
+			env: {
+				...process.env,
+				...options.env,
+				PULUMI_SKIP_UPDATE_CHECK: "true"
+			}
+		});
+		let stdout = "";
+		let stderr = "";
+		proc.stdout?.on("data", (data) => {
+			const str = data.toString();
+			stdout += str;
+			if (options.stream) process.stdout.write(data);
+		});
+		proc.stderr?.on("data", (data) => {
+			const str = data.toString();
+			stderr += str;
+			if (options.stream) process.stderr.write(data);
+		});
+		proc.on("close", (code) => {
+			resolve({
+				code: code ?? 1,
+				stdout,
+				stderr
+			});
+		});
 	});
-});
-const db = program.command("db").description("Database schema management for module-owned schemas");
-db.command("push").description("Push all module schemas to database").option("--url <url>", "Database connection URL").action(async (options) => {
-	requireAuth();
-	await dbPush(options);
-});
-db.command("generate").description("Generate migration files for module schemas").option("--url <url>", "Database connection URL").action(async (options) => {
-	requireAuth();
-	await dbGenerate(options);
-});
-db.command("studio").description("Open Drizzle Studio with all module schemas").option("--url <url>", "Database connection URL").action(async (options) => {
-	requireAuth();
-	await dbStudio(options);
-});
-registerAuthCommands(program);
+}
+/**
+* Run pulumi stack output --json and parse the result
+*/
+async function getPulumiOutputs(options) {
+	const result = await runPulumi([
+		"stack",
+		"output",
+		"--json"
+	], options);
+	if (result.code !== 0) return null;
+	try {
+		return JSON.parse(result.stdout);
+	} catch {
+		return null;
+	}
+}
+/**
+* Run pulumi stack --json and parse the result
+*/
+async function getPulumiStackInfo(options) {
+	const result = await runPulumi(["stack", "--json"], options);
+	if (result.code !== 0) return null;
+	try {
+		const data = JSON.parse(result.stdout);
+		return {
+			name: data.name ?? "",
+			current: data.current ?? false,
+			updateInProgress: data.updateInProgress ?? false,
+			resourceCount: data.resourceCount ?? 0,
+			lastUpdate: data.lastUpdate,
+			url: data.url
+		};
+	} catch {
+		return null;
+	}
+}
+/**
+* Run pulumi stack history --json and parse the result
+*/
+async function getPulumiStackHistory(options, limit = 5) {
+	const result = await runPulumi([
+		"stack",
+		"history",
+		"--json",
+		"--show-secrets=false"
+	], options);
+	if (result.code !== 0) return [];
+	try {
+		const data = JSON.parse(result.stdout);
+		if (!Array.isArray(data)) return [];
+		return data.slice(0, limit).map((entry) => ({
+			version: entry.version ?? 0,
+			startTime: entry.startTime ?? "",
+			endTime: entry.endTime ?? "",
+			result: entry.result ?? "failed",
+			resourceChanges: entry.resourceChanges
+		}));
+	} catch {
+		return [];
+	}
+}
+/**
+* Select or create a Pulumi stack
+*/
+async function selectOrCreateStack(stackName, options) {
+	if ((await runPulumi([
+		"stack",
+		"select",
+		stackName
+	], options)).code === 0) return true;
+	return (await runPulumi([
+		"stack",
+		"init",
+		stackName
+	], options)).code === 0;
+}
+/**
+* Set a Pulumi config value
+*/
+async function setPulumiConfig(key, value, options) {
+	return (await runPulumi([
+		"config",
+		"set",
+		key,
+		value
+	], options)).code === 0;
+}
+/**
+* Run pulumi up with optional preview mode
+*/
+async function pulumiUp(options) {
+	return runPulumi(options.preview ? ["preview"] : ["up", "--yes"], {
+		...options,
+		stream: true
+	});
+}
+/**
+* Run pulumi destroy
+*/
+async function pulumiDestroy(options) {
+	return runPulumi(options.force ? [
+		"destroy",
+		"--yes",
+		"-f"
+	] : ["destroy", "--yes"], {
+		...options,
+		stream: true
+	});
+}
+/**
+* Run pulumi cancel to cancel stuck operations
+*/
+async function pulumiCancel(options) {
+	return runPulumi(["cancel", "--yes"], options);
+}
+/**
+* Run pulumi refresh to sync state with cloud provider
+*/
+async function pulumiRefresh(options) {
+	return runPulumi(["refresh", "--yes"], {
+		...options,
+		stream: true
+	});
+}
+/**
+* Export Pulumi stack state to a file
+*/
+async function pulumiStackExport(filePath, options) {
+	return runPulumi([
+		"stack",
+		"export",
+		"--file",
+		filePath
+	], options);
+}
+/**
+* Run a gcloud CLI command
+*/
+function runGcloud(args, options = {}) {
+	return new Promise((resolve) => {
+		const proc = spawn("gcloud", args, {
+			cwd: options.cwd ?? process.cwd(),
+			stdio: options.stream ? [
+				"inherit",
+				"pipe",
+				"pipe"
+			] : [
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			shell: true
+		});
+		let stdout = "";
+		let stderr = "";
+		proc.stdout?.on("data", (data) => {
+			const str = data.toString();
+			stdout += str;
+			if (options.stream) process.stdout.write(data);
+		});
+		proc.stderr?.on("data", (data) => {
+			const str = data.toString();
+			stderr += str;
+			if (options.stream) process.stderr.write(data);
+		});
+		proc.on("close", (code) => {
+			resolve({
+				code: code ?? 1,
+				stdout,
+				stderr
+			});
+		});
+	});
+}
+/**
+* Build and push Docker image using Cloud Build
+* No local Docker daemon required!
+*/
+async function buildAndPushImage(options) {
+	const tag = options.tag ?? process.env.GIT_SHA ?? "latest";
+	const imageUrl = `${options.registryUrl}/kuckit:${tag}`;
+	console.log(`Building image: ${imageUrl}`);
+	const args = [
+		"builds",
+		"submit",
+		"--tag",
+		imageUrl,
+		"--project",
+		options.project
+	];
+	if (options.dockerfile && options.dockerfile !== "Dockerfile") args.push("--config", options.dockerfile);
+	return {
+		code: (await runGcloud(args, {
+			stream: true,
+			cwd: options.cwd
+		})).code,
+		imageUrl
+	};
+}
+/**
+* Get the path to the packages/infra directory
+*/
+function getInfraDir(projectRoot) {
+	return join$1(projectRoot, "packages", "infra");
+}
+/**
+* Check if Pulumi CLI is installed
+*/
+async function checkPulumiInstalled() {
+	try {
+		return (await runPulumi(["version"], { cwd: process.cwd() })).code === 0;
+	} catch {
+		return false;
+	}
+}
+/**
+* Check if gcloud CLI is installed
+*/
+async function checkGcloudInstalled() {
+	try {
+		return (await runGcloud(["version"])).code === 0;
+	} catch {
+		return false;
+	}
+}
+/**
+* List Cloud Run service revisions
+*/
+async function listCloudRunRevisions(serviceName, project, region) {
+	const revisionsResult = await runGcloud([
+		"run",
+		"revisions",
+		"list",
+		"--service",
+		serviceName,
+		"--project",
+		project,
+		"--region",
+		region,
+		"--format",
+		"json"
+	]);
+	if (revisionsResult.code !== 0) return [];
+	const trafficResult = await runGcloud([
+		"run",
+		"services",
+		"describe",
+		serviceName,
+		"--project",
+		project,
+		"--region",
+		region,
+		"--format",
+		"json"
+	]);
+	const trafficMap = {};
+	if (trafficResult.code === 0) try {
+		const traffic = JSON.parse(trafficResult.stdout).status?.traffic ?? [];
+		for (const t of traffic) if (t.revisionName && t.percent) trafficMap[t.revisionName] = t.percent;
+	} catch {}
+	try {
+		return JSON.parse(revisionsResult.stdout).map((rev) => {
+			const name = rev.metadata?.name ?? "";
+			const trafficPercent = trafficMap[name] ?? 0;
+			return {
+				name,
+				createTime: rev.metadata?.creationTimestamp ?? "",
+				active: trafficPercent > 0,
+				trafficPercent
+			};
+		});
+	} catch {
+		return [];
+	}
+}
+/**
+* Update Cloud Run traffic routing to a specific revision
+*/
+async function updateCloudRunTraffic(serviceName, revisionName, project, region) {
+	return runGcloud([
+		"run",
+		"services",
+		"update-traffic",
+		serviceName,
+		"--to-revisions",
+		`${revisionName}=100`,
+		"--project",
+		project,
+		"--region",
+		region
+	], { stream: true });
+}
+/**
+* Extract service name from Cloud Run URL
+* e.g., https://myapp-abc123-uc.a.run.app -> myapp
+*/
+function extractServiceNameFromUrl(url) {
+	try {
+		const hostname = new URL(url).hostname;
+		const match = hostname.match(/^([^-]+(?:-[^-]+)*?)-[a-z0-9]+-[a-z]+\.a\.run\.app$/);
+		if (match) return match[1];
+		const parts = hostname.split("-");
+		if (parts.length >= 3) return parts.slice(0, -2).join("-");
+		return null;
+	} catch {
+		return null;
+	}
+}
+
+//#endregion
+//#region src/commands/infra/errors.ts
+/**
+* Error parsing for Pulumi and infrastructure operations
+*/
+/**
+* Types of errors that can occur during infrastructure operations
+*/
+let PulumiErrorType = /* @__PURE__ */ function(PulumiErrorType$1) {
+	/** Another update is already in progress */
+	PulumiErrorType$1["ConcurrentUpdate"] = "CONCURRENT_UPDATE";
+	/** Resource already exists */
+	PulumiErrorType$1["ResourceConflict"] = "RESOURCE_CONFLICT";
+	/** GCP quota exceeded */
+	PulumiErrorType$1["QuotaExceeded"] = "QUOTA_EXCEEDED";
+	/** Permission denied (IAM issues) */
+	PulumiErrorType$1["PermissionDenied"] = "PERMISSION_DENIED";
+	/** State corruption or pending operations */
+	PulumiErrorType$1["StateCorruption"] = "STATE_CORRUPTION";
+	/** Network or transient failure */
+	PulumiErrorType$1["NetworkError"] = "NETWORK_ERROR";
+	/** Resource not found */
+	PulumiErrorType$1["ResourceNotFound"] = "RESOURCE_NOT_FOUND";
+	/** Invalid configuration */
+	PulumiErrorType$1["InvalidConfig"] = "INVALID_CONFIG";
+	/** Unknown error */
+	PulumiErrorType$1["Unknown"] = "UNKNOWN";
+	return PulumiErrorType$1;
+}({});
+/**
+* Error patterns and their mappings
+*/
+const ERROR_PATTERNS = [
+	{
+		pattern: /conflict.*concurrent.*update|another update is in progress|lock/i,
+		type: PulumiErrorType.ConcurrentUpdate,
+		suggestion: "Run: kuckit infra repair --cancel",
+		retryable: false
+	},
+	{
+		pattern: /already exists|resource.*conflict|duplicate/i,
+		type: PulumiErrorType.ResourceConflict,
+		suggestion: "Run: kuckit infra repair --refresh",
+		retryable: false
+	},
+	{
+		pattern: /quota.*exceeded|limit.*reached|resource exhausted/i,
+		type: PulumiErrorType.QuotaExceeded,
+		suggestion: "Request quota increase in GCP Console: https://console.cloud.google.com/iam-admin/quotas",
+		retryable: false
+	},
+	{
+		pattern: /permission.*denied|access.*denied|forbidden|unauthorized|403/i,
+		type: PulumiErrorType.PermissionDenied,
+		suggestion: "Check IAM permissions in GCP Console. Ensure your account has the required roles.",
+		retryable: false
+	},
+	{
+		pattern: /pending.*operation|state.*corrupt|inconsistent.*state/i,
+		type: PulumiErrorType.StateCorruption,
+		suggestion: "Run: kuckit infra repair --refresh",
+		retryable: false
+	},
+	{
+		pattern: /network.*error|connection.*refused|timeout|ETIMEDOUT|ECONNRESET/i,
+		type: PulumiErrorType.NetworkError,
+		suggestion: "Check your network connection and try again.",
+		retryable: true
+	},
+	{
+		pattern: /not found|does not exist|404/i,
+		type: PulumiErrorType.ResourceNotFound,
+		suggestion: "The resource may have been deleted externally. Run: kuckit infra repair --refresh",
+		retryable: false
+	},
+	{
+		pattern: /invalid.*config|configuration.*error|missing.*required/i,
+		type: PulumiErrorType.InvalidConfig,
+		suggestion: "Check your configuration in .kuckit/infra.json and Pulumi stack config.",
+		retryable: false
+	}
+];
+/**
+* Extract resource name from error output
+*/
+function extractResourceName(error) {
+	const urnMatch = error.match(/urn:pulumi:[^:]+:[^:]+::([^:]+:[^:\s]+)/i);
+	if (urnMatch) return urnMatch[1];
+	const gcpMatch = error.match(/projects\/[^/]+\/(?:locations|regions)\/[^/]+\/([^/\s]+\/[^/\s]+)/i);
+	if (gcpMatch) return gcpMatch[1];
+}
+/**
+* Parse an error output and return a structured ParsedError
+*/
+function parseError(error) {
+	for (const { pattern, type, suggestion, retryable } of ERROR_PATTERNS) if (pattern.test(error)) return {
+		type,
+		message: getErrorMessage(type, error),
+		resource: extractResourceName(error),
+		suggestion,
+		retryable,
+		originalError: error
+	};
+	return {
+		type: PulumiErrorType.Unknown,
+		message: "An unknown error occurred during infrastructure operation.",
+		resource: extractResourceName(error),
+		suggestion: "Check the error output above. If the issue persists, run: kuckit infra repair --refresh",
+		retryable: false,
+		originalError: error
+	};
+}
+/**
+* Get a human-readable error message for an error type
+*/
+function getErrorMessage(type, originalError) {
+	switch (type) {
+		case PulumiErrorType.ConcurrentUpdate: return "Another infrastructure update is already in progress.";
+		case PulumiErrorType.ResourceConflict: return "A resource with this name already exists.";
+		case PulumiErrorType.QuotaExceeded: return "GCP quota limit has been reached.";
+		case PulumiErrorType.PermissionDenied: return "Permission denied. Check your IAM permissions.";
+		case PulumiErrorType.StateCorruption: return "Infrastructure state is inconsistent.";
+		case PulumiErrorType.NetworkError: return "Network error occurred. This may be a transient issue.";
+		case PulumiErrorType.ResourceNotFound: return "A required resource was not found.";
+		case PulumiErrorType.InvalidConfig: return "Invalid configuration detected.";
+		default: return originalError.split("\n").find((line) => line.trim().length > 0)?.slice(0, 200) ?? "An error occurred.";
+	}
+}
+/**
+* Format a ParsedError for console output
+*/
+function formatError(error) {
+	const lines = [`Error: ${error.message}`, ""];
+	if (error.resource) lines.push(`Resource: ${error.resource}`);
+	lines.push(`Suggestion: ${error.suggestion}`);
+	return lines.join("\n");
+}
+
+//#endregion
+//#region src/commands/infra/init.ts
+const KUCKIT_DIR$8 = ".kuckit";
+const CONFIG_FILE$8 = "infra.json";
+async function fileExists$8(path) {
+	try {
+		await access(path, constants$1.F_OK);
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function findProjectRoot$8(cwd) {
+	let dir = cwd;
+	while (dir !== dirname$1(dir)) {
+		if (await fileExists$8(join$1(dir, "package.json"))) return dir;
+		dir = dirname$1(dir);
+	}
+	return null;
+}
+async function loadExistingConfig(projectRoot) {
+	const configPath = join$1(projectRoot, KUCKIT_DIR$8, CONFIG_FILE$8);
+	if (!await fileExists$8(configPath)) return null;
+	try {
+		const content = await readFile(configPath, "utf-8");
+		return JSON.parse(content);
+	} catch {
+		return null;
+	}
+}
+async function saveConfig$1(projectRoot, config) {
+	const kuckitDir = join$1(projectRoot, KUCKIT_DIR$8);
+	await mkdir(kuckitDir, { recursive: true });
+	await writeFile(join$1(kuckitDir, CONFIG_FILE$8), JSON.stringify(config, null, 2), "utf-8");
+}
+async function infraInit(options) {
+	console.log("Initializing kuckit infrastructure...\n");
+	if (!await checkPulumiInstalled()) {
+		console.error("Error: Pulumi CLI is not installed.");
+		console.error("Install it from: https://www.pulumi.com/docs/install/");
+		process.exit(1);
+	}
+	if (!await checkGcloudInstalled()) {
+		console.error("Error: gcloud CLI is not installed.");
+		console.error("Install it from: https://cloud.google.com/sdk/docs/install");
+		process.exit(1);
+	}
+	const projectRoot = await findProjectRoot$8(process.cwd());
+	if (!projectRoot) {
+		console.error("Error: Could not find project root (no package.json found)");
+		process.exit(1);
+	}
+	const infraDir = getInfraDir(projectRoot);
+	if (!await fileExists$8(infraDir)) {
+		console.error("Error: packages/infra not found.");
+		console.error("Make sure you have the @kuckit/infra package in your project.");
+		process.exit(1);
+	}
+	const existingConfig = await loadExistingConfig(projectRoot);
+	const provider = options.provider ?? "gcp";
+	if (provider !== "gcp") {
+		console.error(`Error: Provider '${provider}' is not supported. Only 'gcp' is currently supported.`);
+		process.exit(1);
+	}
+	let gcpProject = options.project ?? existingConfig?.gcpProject;
+	if (!gcpProject) gcpProject = await input({
+		message: "GCP Project ID:",
+		validate: (value) => value.length > 0 ? true : "Project ID is required"
+	});
+	let region = options.region ?? existingConfig?.region ?? "us-central1";
+	if (!options.region && !existingConfig?.region) region = await input({
+		message: "GCP Region:",
+		default: "us-central1"
+	});
+	let env = options.env ?? existingConfig?.env ?? "dev";
+	if (!options.env && !existingConfig?.env) env = await input({
+		message: "Environment (dev/prod):",
+		default: "dev",
+		validate: (value) => value === "dev" || value === "prod" ? true : "Must be dev or prod"
+	});
+	const stackName = `${gcpProject}-${env}`;
+	console.log("\nConfiguration:");
+	console.log(`  Provider: ${provider}`);
+	console.log(`  GCP Project: ${gcpProject}`);
+	console.log(`  Region: ${region}`);
+	console.log(`  Environment: ${env}`);
+	console.log(`  Stack: ${stackName}`);
+	console.log("");
+	if (!options.yes) {
+		if (!await confirm({
+			message: "Proceed with infrastructure initialization?",
+			default: true
+		})) {
+			console.log("Aborted.");
+			process.exit(0);
+		}
+	}
+	console.log("\nInstalling infrastructure dependencies...");
+	const { spawn: spawn$1 } = await import("child_process");
+	await new Promise((resolve, reject) => {
+		spawn$1("bun", ["install"], {
+			cwd: infraDir,
+			stdio: "inherit",
+			shell: true
+		}).on("close", (code) => {
+			if (code === 0) resolve();
+			else reject(/* @__PURE__ */ new Error(`bun install failed with code ${code}`));
+		});
+	});
+	console.log("\nBuilding infrastructure package...");
+	await new Promise((resolve, reject) => {
+		spawn$1("bun", ["run", "build"], {
+			cwd: infraDir,
+			stdio: "inherit",
+			shell: true
+		}).on("close", (code) => {
+			if (code === 0) resolve();
+			else reject(/* @__PURE__ */ new Error(`Build failed with code ${code}`));
+		});
+	});
+	console.log(`\nSelecting Pulumi stack: ${stackName}`);
+	if (!await selectOrCreateStack(stackName, { cwd: infraDir })) {
+		console.error("Error: Failed to select or create Pulumi stack");
+		process.exit(1);
+	}
+	console.log("Configuring stack...");
+	await setPulumiConfig("gcp:project", gcpProject, { cwd: infraDir });
+	await setPulumiConfig("gcp:region", region, { cwd: infraDir });
+	await setPulumiConfig("env", env, { cwd: infraDir });
+	console.log("\nCreating infrastructure...");
+	console.log("This may take several minutes.\n");
+	const result = await pulumiUp({
+		cwd: infraDir,
+		stream: true
+	});
+	if (result.code !== 0) {
+		const parsed = parseError(result.stderr);
+		console.error("\n" + formatError(parsed));
+		process.exit(1);
+	}
+	console.log("\nRetrieving outputs...");
+	const outputs = await getPulumiOutputs({ cwd: infraDir });
+	await saveConfig$1(projectRoot, {
+		provider: "gcp",
+		gcpProject,
+		region,
+		projectName: "kuckit-infra",
+		stackName,
+		env,
+		outputs: outputs ? {
+			registryUrl: outputs.registryUrl,
+			databaseConnectionName: outputs.databaseConnectionName,
+			redisHost: outputs.redisHost,
+			secretIds: {
+				dbPassword: outputs.dbPasswordSecretId,
+				redisAuth: outputs.redisAuthSecretId ?? ""
+			}
+		} : void 0,
+		createdAt: existingConfig?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+		updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+	});
+	console.log(`\nConfiguration saved to ${KUCKIT_DIR$8}/${CONFIG_FILE$8}`);
+	console.log("\n" + "=".repeat(60));
+	console.log("Infrastructure initialized successfully!");
+	console.log("=".repeat(60));
+	if (outputs) {
+		console.log("\nOutputs:");
+		console.log(`  Registry: ${outputs.registryUrl}`);
+		console.log(`  Database: ${outputs.databaseConnectionName}`);
+		console.log(`  Redis: ${outputs.redisHost}`);
+	}
+	console.log("\nNext steps:");
+	console.log("  1. Ensure you have a Dockerfile in your project root");
+	console.log(`  2. Run: kuckit infra deploy --env ${env}`);
+	console.log("");
+}
+
+//#endregion
+//#region src/commands/infra/deploy.ts
+const KUCKIT_DIR$7 = ".kuckit";
+const CONFIG_FILE$7 = "infra.json";
+async function saveConfig(projectRoot, config) {
+	const kuckitDir = join$1(projectRoot, KUCKIT_DIR$7);
+	await mkdir(kuckitDir, { recursive: true });
+	await writeFile(join$1(kuckitDir, CONFIG_FILE$7), JSON.stringify(config, null, 2), "utf-8");
+}
+/**
+* Get the current git commit short hash
+* Returns null if not in a git repo or git command fails
+*/
+function getGitShortHash() {
+	try {
+		return execSync("git rev-parse --short HEAD", { encoding: "utf-8" }).trim();
+	} catch {
+		return null;
+	}
+}
+async function fileExists$7(path) {
+	try {
+		await access(path, constants$1.F_OK);
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function findProjectRoot$7(cwd) {
+	let dir = cwd;
+	while (dir !== dirname$1(dir)) {
+		if (await fileExists$7(join$1(dir, "package.json"))) return dir;
+		dir = dirname$1(dir);
+	}
+	return null;
+}
+async function loadConfig$7(projectRoot) {
+	const configPath = join$1(projectRoot, KUCKIT_DIR$7, CONFIG_FILE$7);
+	if (!await fileExists$7(configPath)) return null;
+	try {
+		const content = await readFile(configPath, "utf-8");
+		return JSON.parse(content);
+	} catch {
+		return null;
+	}
+}
+async function infraDeploy(options) {
+	console.log("Deploying kuckit application...\n");
+	if (!await checkPulumiInstalled()) {
+		console.error("Error: Pulumi CLI is not installed.");
+		console.error("Install it from: https://www.pulumi.com/docs/install/");
+		process.exit(1);
+	}
+	if (!await checkGcloudInstalled()) {
+		console.error("Error: gcloud CLI is not installed.");
+		console.error("Install it from: https://cloud.google.com/sdk/docs/install");
+		process.exit(1);
+	}
+	const projectRoot = await findProjectRoot$7(process.cwd());
+	if (!projectRoot) {
+		console.error("Error: Could not find project root (no package.json found)");
+		process.exit(1);
+	}
+	const config = await loadConfig$7(projectRoot);
+	if (!config) {
+		console.error("Error: No infrastructure configuration found.");
+		console.error("Run: kuckit infra init");
+		process.exit(1);
+	}
+	const env = options.env ?? config.env;
+	if (env !== "dev" && env !== "prod") {
+		console.error(`Error: Invalid environment '${env}'. Must be 'dev' or 'prod'.`);
+		process.exit(1);
+	}
+	const infraDir = getInfraDir(projectRoot);
+	if (!await fileExists$7(infraDir)) {
+		console.error("Error: packages/infra not found.");
+		process.exit(1);
+	}
+	const dockerfilePath = join$1(projectRoot, "Dockerfile");
+	if (!options.skipBuild && !options.image && !await fileExists$7(dockerfilePath)) {
+		console.error("Error: Dockerfile not found in project root.");
+		console.error("Create a Dockerfile or use --skip-build with an existing image.");
+		process.exit(1);
+	}
+	if (!config.outputs?.registryUrl) {
+		console.error("Error: No registry URL found in configuration.");
+		console.error("Run: kuckit infra init");
+		process.exit(1);
+	}
+	console.log("Configuration:");
+	console.log(`  Project: ${config.gcpProject}`);
+	console.log(`  Region: ${config.region}`);
+	console.log(`  Environment: ${env}`);
+	console.log(`  Registry: ${config.outputs.registryUrl}`);
+	if (options.preview) console.log("  Mode: Preview (no changes will be applied)");
+	console.log("");
+	let imageUrl;
+	if (options.image) {
+		imageUrl = options.image;
+		console.log(`Using provided image: ${imageUrl}\n`);
+	} else if (options.skipBuild) {
+		imageUrl = `${config.outputs.registryUrl}/kuckit:latest`;
+		console.log(`Using existing image: ${imageUrl}\n`);
+	} else {
+		console.log("Building and pushing Docker image...");
+		console.log("(Using Cloud Build - no local Docker required)\n");
+		const buildResult = await buildAndPushImage({
+			project: config.gcpProject,
+			registryUrl: config.outputs.registryUrl,
+			tag: process.env.GIT_SHA ?? process.env.GITHUB_SHA ?? getGitShortHash() ?? "latest",
+			cwd: projectRoot
+		});
+		if (buildResult.code !== 0) {
+			console.error("\nError: Docker build failed.");
+			process.exit(1);
+		}
+		imageUrl = buildResult.imageUrl;
+		console.log(`\nImage built: ${imageUrl}\n`);
+	}
+	if (!options.yes && !options.preview) {
+		if (!await confirm({
+			message: "Proceed with deployment?",
+			default: true
+		})) {
+			console.log("Aborted.");
+			process.exit(0);
+		}
+	}
+	const stackName = config.stackName;
+	console.log(`Selecting Pulumi stack: ${stackName}`);
+	if (!await selectOrCreateStack(stackName, { cwd: infraDir })) {
+		console.error("Error: Failed to select Pulumi stack");
+		process.exit(1);
+	}
+	console.log("Configuring deployment...");
+	await setPulumiConfig("imageUrl", imageUrl, { cwd: infraDir });
+	if (options.preview) console.log("\nPreviewing changes...\n");
+	else console.log("\nDeploying to Cloud Run...\n");
+	const result = await pulumiUp({
+		cwd: infraDir,
+		stream: true,
+		preview: options.preview
+	});
+	if (result.code !== 0) {
+		const parsed = parseError(result.stderr);
+		console.error("\n" + formatError(parsed));
+		process.exit(1);
+	}
+	if (!options.preview) {
+		console.log("\nRetrieving deployment info...");
+		const outputs = await getPulumiOutputs({ cwd: infraDir });
+		if (outputs) {
+			config.outputs = {
+				...config.outputs,
+				...outputs
+			};
+			config.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+			await saveConfig(projectRoot, config);
+		}
+		console.log("\n" + "=".repeat(60));
+		console.log("Deployment successful!");
+		console.log("=".repeat(60));
+		if (outputs?.serviceUrl) console.log(`\nService URL: ${outputs.serviceUrl}`);
+		if (outputs?.migrationJobName) console.log(`Migration Job: ${outputs.migrationJobName}`);
+		console.log("\nUseful commands:");
+		console.log(`  View logs: kuckit infra logs --env ${env}`);
+		console.log(`  Check status: kuckit infra status --env ${env}`);
+		console.log(`  Run migrations: kuckit infra db:migrate --env ${env}`);
+		console.log("");
+	} else {
+		console.log("\nPreview complete. No changes were applied.");
+		console.log("Run without --preview to apply changes.");
+	}
+}
+
+//#endregion
+//#region src/commands/infra/destroy.ts
+const KUCKIT_DIR$6 = ".kuckit";
+const CONFIG_FILE$6 = "infra.json";
+async function fileExists$6(path) {
+	try {
+		await access(path, constants$1.F_OK);
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function findProjectRoot$6(cwd) {
+	let dir = cwd;
+	while (dir !== dirname$1(dir)) {
+		if (await fileExists$6(join$1(dir, "package.json"))) return dir;
+		dir = dirname$1(dir);
+	}
+	return null;
+}
+async function loadConfig$6(projectRoot) {
+	const configPath = join$1(projectRoot, KUCKIT_DIR$6, CONFIG_FILE$6);
+	if (!await fileExists$6(configPath)) return null;
+	try {
+		const content = await readFile(configPath, "utf-8");
+		return JSON.parse(content);
+	} catch {
+		return null;
+	}
+}
+async function infraDestroy(options) {
+	const isAppOnly = options.appOnly ?? false;
+	if (isAppOnly) console.log("Destroying Cloud Run application (keeping database and Redis)...\n");
+	else console.log("Destroying kuckit infrastructure...\n");
+	if (!await checkPulumiInstalled()) {
+		console.error("Error: Pulumi CLI is not installed.");
+		console.error("Install it from: https://www.pulumi.com/docs/install/");
+		process.exit(1);
+	}
+	const projectRoot = await findProjectRoot$6(process.cwd());
+	if (!projectRoot) {
+		console.error("Error: Could not find project root (no package.json found)");
+		process.exit(1);
+	}
+	const config = await loadConfig$6(projectRoot);
+	if (!config) {
+		console.error("Error: No infrastructure configuration found.");
+		console.error("Nothing to destroy.");
+		process.exit(1);
+	}
+	const env = options.env ?? config.env;
+	if (env !== "dev" && env !== "prod") {
+		console.error(`Error: Invalid environment '${env}'. Must be 'dev' or 'prod'.`);
+		process.exit(1);
+	}
+	const infraDir = getInfraDir(projectRoot);
+	if (!await fileExists$6(infraDir)) {
+		console.error("Error: packages/infra not found.");
+		process.exit(1);
+	}
+	console.log("Configuration:");
+	console.log(`  Project: ${config.gcpProject}`);
+	console.log(`  Region: ${config.region}`);
+	console.log(`  Environment: ${env}`);
+	console.log(`  Stack: ${config.stackName}`);
+	console.log("");
+	if (isAppOnly) {
+		console.log("WARNING: This will destroy the Cloud Run service.");
+		console.log("         Database and Redis will be preserved.\n");
+	} else {
+		console.log("=".repeat(60));
+		console.log("WARNING: DESTRUCTIVE OPERATION");
+		console.log("=".repeat(60));
+		console.log("");
+		console.log("This will PERMANENTLY destroy:");
+		console.log("  - Cloud Run service");
+		console.log("  - Cloud SQL database (ALL DATA WILL BE LOST)");
+		console.log("  - Memorystore Redis instance");
+		console.log("  - Artifact Registry and all container images");
+		console.log("  - All associated secrets");
+		console.log("");
+		console.log("This action CANNOT be undone.");
+		console.log("");
+	}
+	if (!options.force) {
+		if (!await confirm({
+			message: isAppOnly ? "Are you sure you want to destroy the Cloud Run service?" : "Are you ABSOLUTELY sure you want to destroy ALL infrastructure?",
+			default: false
+		})) {
+			console.log("Aborted.");
+			process.exit(0);
+		}
+		if (!isAppOnly) {
+			if (!await confirm({
+				message: "This will delete ALL data. Type \"yes\" to confirm:",
+				default: false
+			})) {
+				console.log("Aborted.");
+				process.exit(0);
+			}
+		}
+	}
+	const stackName = config.stackName;
+	console.log(`\nSelecting Pulumi stack: ${stackName}`);
+	if (!await selectOrCreateStack(stackName, { cwd: infraDir })) {
+		console.error("Error: Failed to select Pulumi stack");
+		process.exit(1);
+	}
+	if (isAppOnly) {
+		console.log("\nRemoving Cloud Run service...");
+		console.log("(Database and Redis will be preserved)\n");
+		await setPulumiConfig("imageUrl", "", { cwd: infraDir });
+		const result = await pulumiUp({
+			cwd: infraDir,
+			stream: true
+		});
+		if (result.code !== 0) {
+			const parsed = parseError(result.stderr);
+			console.error("\n" + formatError(parsed));
+			process.exit(1);
+		}
+		console.log("\n" + "=".repeat(60));
+		console.log("Cloud Run service destroyed successfully!");
+		console.log("=".repeat(60));
+		console.log("\nBase infrastructure preserved:");
+		console.log("  - Cloud SQL database");
+		console.log("  - Memorystore Redis");
+		console.log("  - Artifact Registry");
+		console.log("\nTo redeploy: kuckit infra deploy --env " + env);
+	} else {
+		console.log("\nDestroying all infrastructure...");
+		console.log("This may take several minutes.\n");
+		const result = await pulumiDestroy({
+			cwd: infraDir,
+			force: true
+		});
+		if (result.code !== 0) {
+			const parsed = parseError(result.stderr);
+			console.error("\n" + formatError(parsed));
+			process.exit(1);
+		}
+		const configPath = join$1(projectRoot, KUCKIT_DIR$6, CONFIG_FILE$6);
+		try {
+			await unlink(configPath);
+			console.log(`\nRemoved ${KUCKIT_DIR$6}/${CONFIG_FILE$6}`);
+		} catch {}
+		console.log("\n" + "=".repeat(60));
+		console.log("Infrastructure destroyed successfully!");
+		console.log("=".repeat(60));
+		console.log("\nAll resources have been removed.");
+		console.log("To recreate: kuckit infra init");
+	}
+	console.log("");
+}
+
+//#endregion
+//#region src/commands/infra/repair.ts
+const KUCKIT_DIR$5 = ".kuckit";
+const CONFIG_FILE$5 = "infra.json";
+async function fileExists$5(path) {
+	try {
+		await access(path, constants$1.F_OK);
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function findProjectRoot$5(cwd) {
+	let dir = cwd;
+	while (dir !== dirname$1(dir)) {
+		if (await fileExists$5(join$1(dir, "package.json"))) return dir;
+		dir = dirname$1(dir);
+	}
+	return null;
+}
+async function loadConfig$5(projectRoot) {
+	const configPath = join$1(projectRoot, KUCKIT_DIR$5, CONFIG_FILE$5);
+	if (!await fileExists$5(configPath)) return null;
+	try {
+		const content = await readFile(configPath, "utf-8");
+		return JSON.parse(content);
+	} catch {
+		return null;
+	}
+}
+async function infraRepair(options) {
+	console.log("Repairing kuckit infrastructure state...\n");
+	if (!await checkPulumiInstalled()) {
+		console.error("Error: Pulumi CLI is not installed.");
+		console.error("Install it from: https://www.pulumi.com/docs/install/");
+		process.exit(1);
+	}
+	const projectRoot = await findProjectRoot$5(process.cwd());
+	if (!projectRoot) {
+		console.error("Error: Could not find project root (no package.json found)");
+		process.exit(1);
+	}
+	const config = await loadConfig$5(projectRoot);
+	if (!config) {
+		console.error("Error: No infrastructure configuration found.");
+		console.error("Run: kuckit infra init");
+		process.exit(1);
+	}
+	const env = options.env ?? config.env;
+	if (env !== "dev" && env !== "prod") {
+		console.error(`Error: Invalid environment '${env}'. Must be 'dev' or 'prod'.`);
+		process.exit(1);
+	}
+	const infraDir = getInfraDir(projectRoot);
+	if (!await fileExists$5(infraDir)) {
+		console.error("Error: packages/infra not found.");
+		process.exit(1);
+	}
+	const runCancel = options.cancel || !options.cancel && !options.refresh;
+	const runRefresh = options.refresh || !options.cancel && !options.refresh;
+	console.log(`Repairing stack: ${config.stackName}`);
+	console.log(`  Environment: ${env}`);
+	console.log(`  Operations: ${[runCancel && "cancel", runRefresh && "refresh"].filter(Boolean).join(", ")}`);
+	console.log("");
+	if (!options.force) {
+		if (!await confirm({
+			message: "Proceed with repair?",
+			default: true
+		})) {
+			console.log("Aborted.");
+			process.exit(0);
+		}
+	}
+	console.log(`Selecting Pulumi stack: ${config.stackName}`);
+	if (!await selectOrCreateStack(config.stackName, { cwd: infraDir })) {
+		console.error("Error: Failed to select Pulumi stack");
+		process.exit(1);
+	}
+	console.log("");
+	if (!options.force) {
+		const kuckitDir = join$1(projectRoot, KUCKIT_DIR$5);
+		await mkdir(kuckitDir, { recursive: true });
+		const backupFileName = `state-backup-${env}-${Math.floor(Date.now() / 1e3)}.json`;
+		const backupPath = join$1(kuckitDir, backupFileName);
+		console.log("Backing up state...");
+		if ((await pulumiStackExport(backupPath, { cwd: infraDir })).code === 0) console.log(`State backed up to ${KUCKIT_DIR$5}/${backupFileName}\n`);
+		else console.warn("Warning: Failed to backup state. Continuing anyway...\n");
+	}
+	if (runCancel) {
+		console.log("Cancelling any stuck operations...");
+		const cancelResult = await pulumiCancel({ cwd: infraDir });
+		if (cancelResult.code === 0) if (cancelResult.stdout.includes("no update") || cancelResult.stderr.includes("no update")) console.log("No stuck operation to cancel\n");
+		else console.log("✓ Cancelled stuck operation\n");
+		else if (cancelResult.stderr.includes("no update") || cancelResult.stdout.includes("no update")) console.log("No stuck operation to cancel\n");
+		else {
+			console.error("Warning: Cancel operation failed");
+			console.error(cancelResult.stderr || cancelResult.stdout);
+			console.log("");
+		}
+	}
+	if (runRefresh) {
+		console.log("Refreshing state from cloud provider...");
+		const refreshResult = await pulumiRefresh({ cwd: infraDir });
+		if (refreshResult.code === 0) console.log("✓ State refreshed successfully\n");
+		else {
+			console.error("\nError: Refresh operation failed");
+			console.error(refreshResult.stderr);
+			process.exit(1);
+		}
+	}
+	console.log("✓ Infrastructure state repair complete");
+}
+
+//#endregion
+//#region src/commands/infra/db.ts
+const KUCKIT_DIR$4 = ".kuckit";
+const CONFIG_FILE$4 = "infra.json";
+async function fileExists$4(path) {
+	try {
+		await access(path, constants$1.F_OK);
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function findProjectRoot$4(cwd) {
+	let dir = cwd;
+	while (dir !== dirname$1(dir)) {
+		if (await fileExists$4(join$1(dir, "package.json"))) return dir;
+		dir = dirname$1(dir);
+	}
+	return null;
+}
+async function loadConfig$4(projectRoot) {
+	const configPath = join$1(projectRoot, KUCKIT_DIR$4, CONFIG_FILE$4);
+	if (!await fileExists$4(configPath)) return null;
+	try {
+		const content = await readFile(configPath, "utf-8");
+		return JSON.parse(content);
+	} catch {
+		return null;
+	}
+}
+async function getJobContext(options) {
+	if (!await checkGcloudInstalled()) {
+		console.error("Error: gcloud CLI is not installed.");
+		console.error("Install it from: https://cloud.google.com/sdk/docs/install");
+		process.exit(1);
+	}
+	const projectRoot = await findProjectRoot$4(process.cwd());
+	if (!projectRoot) {
+		console.error("Error: Could not find project root (no package.json found)");
+		process.exit(1);
+	}
+	const config = await loadConfig$4(projectRoot);
+	if (!config) {
+		console.error("Error: No infrastructure configuration found.");
+		console.error("Run: kuckit infra init");
+		process.exit(1);
+	}
+	const env = options.env ?? config.env;
+	if (env !== "dev" && env !== "prod") {
+		console.error(`Error: Invalid environment '${env}'. Must be 'dev' or 'prod'.`);
+		process.exit(1);
+	}
+	const jobName = config.outputs?.migrationJobName;
+	if (!jobName) {
+		console.error("Error: No migration job found in configuration.");
+		console.error("Make sure you have deployed the infrastructure with an image:");
+		console.error("  kuckit infra deploy");
+		process.exit(1);
+	}
+	return {
+		config,
+		projectRoot,
+		env,
+		jobName
+	};
+}
+async function executeCloudRunJob(project, region, jobName, commandOverride) {
+	const args = [
+		"run",
+		"jobs",
+		"execute",
+		jobName,
+		"--region",
+		region,
+		"--project",
+		project,
+		"--wait"
+	];
+	if (commandOverride && commandOverride.length > 0) {
+		const escapedArgs = commandOverride.map((arg) => arg.replace(/'/g, "'\\''")).join(",");
+		args.push(`--args='${escapedArgs}'`);
+	}
+	console.log(`Executing Cloud Run Job: ${jobName}`);
+	console.log(`  Project: ${project}`);
+	console.log(`  Region: ${region}`);
+	console.log("");
+	return (await runGcloud(args, { stream: true })).code === 0;
+}
+async function getLatestJobExecution(project, region, jobName) {
+	const listResult = await runGcloud([
+		"run",
+		"jobs",
+		"executions",
+		"list",
+		"--job",
+		jobName,
+		"--region",
+		region,
+		"--project",
+		project,
+		"--limit",
+		"1",
+		"--format",
+		"json"
+	], { stream: false });
+	if (listResult.code !== 0 || !listResult.stdout.trim()) return null;
+	try {
+		const executions = JSON.parse(listResult.stdout);
+		if (executions.length === 0) return null;
+		const execution = executions[0];
+		const executionName = execution.metadata?.name;
+		if (executionName) {
+			const logsResult = await runGcloud([
+				"logging",
+				"read",
+				`resource.type="cloud_run_job" AND resource.labels.job_name="${jobName}" AND labels."run.googleapis.com/execution_name"="${executionName}"`,
+				"--project",
+				project,
+				"--limit",
+				"50",
+				"--format",
+				"value(textPayload)"
+			], { stream: false });
+			return {
+				status: execution.status?.conditions?.[0]?.type ?? "Unknown",
+				logs: logsResult.stdout
+			};
+		}
+		return { status: execution.status?.conditions?.[0]?.type ?? "Unknown" };
+	} catch {
+		return null;
+	}
+}
+async function infraDbPush(options) {
+	console.log("Running database schema push via Cloud Run Job...\n");
+	const ctx = await getJobContext(options);
+	console.log("Configuration:");
+	console.log(`  Project: ${ctx.config.gcpProject}`);
+	console.log(`  Environment: ${ctx.env}`);
+	console.log(`  Job: ${ctx.jobName}`);
+	console.log("");
+	const commandOverride = [`export NODE_PATH=/app/node_modules && cd /app && node /app/node_modules/drizzle-kit/bin.cjs push --config=packages/db/drizzle.config.ts${options.force ? " --force" : ""}`];
+	if (!await executeCloudRunJob(ctx.config.gcpProject, ctx.config.region, ctx.jobName, commandOverride)) {
+		console.error("\nError: Schema push failed.");
+		console.error("Check the Cloud Run Job logs for details:");
+		console.error(`  gcloud run jobs executions list --job ${ctx.jobName} --region ${ctx.config.region}`);
+		process.exit(1);
+	}
+	const execution = await getLatestJobExecution(ctx.config.gcpProject, ctx.config.region, ctx.jobName);
+	if (execution?.logs) {
+		console.log("\nJob output:");
+		console.log(execution.logs);
+	}
+	console.log("\n✓ Schema push complete");
+}
+async function infraDbMigrate(options) {
+	console.log("Running database migrations via Cloud Run Job...\n");
+	if (options.dryRun) {
+		console.log("Note: Dry run mode is not supported for Cloud Run Jobs.");
+		console.log("The job will execute actual migrations.\n");
+	}
+	if (options.rollback) {
+		console.error("Error: Rollback is not supported via Cloud Run Jobs.");
+		console.error("Use local drizzle-kit for rollback operations.");
+		process.exit(1);
+	}
+	const ctx = await getJobContext(options);
+	console.log("Configuration:");
+	console.log(`  Project: ${ctx.config.gcpProject}`);
+	console.log(`  Environment: ${ctx.env}`);
+	console.log(`  Job: ${ctx.jobName}`);
+	console.log("");
+	if (!await executeCloudRunJob(ctx.config.gcpProject, ctx.config.region, ctx.jobName)) {
+		console.error("\nError: Migration failed.");
+		console.error("Check the Cloud Run Job logs for details:");
+		console.error(`  gcloud run jobs executions list --job ${ctx.jobName} --region ${ctx.config.region}`);
+		process.exit(1);
+	}
+	const execution = await getLatestJobExecution(ctx.config.gcpProject, ctx.config.region, ctx.jobName);
+	if (execution?.logs) {
+		console.log("\nJob output:");
+		console.log(execution.logs);
+	}
+	console.log("\n✓ Migrations complete");
+}
+
+//#endregion
+//#region src/commands/infra/rollback.ts
+const KUCKIT_DIR$3 = ".kuckit";
+const CONFIG_FILE$3 = "infra.json";
+async function fileExists$3(path) {
+	try {
+		await access(path, constants$1.F_OK);
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function findProjectRoot$3(cwd) {
+	let dir = cwd;
+	while (dir !== dirname$1(dir)) {
+		if (await fileExists$3(join$1(dir, "package.json"))) return dir;
+		dir = dirname$1(dir);
+	}
+	return null;
+}
+async function loadConfig$3(projectRoot) {
+	const configPath = join$1(projectRoot, KUCKIT_DIR$3, CONFIG_FILE$3);
+	if (!await fileExists$3(configPath)) return null;
+	try {
+		const content = await readFile(configPath, "utf-8");
+		return JSON.parse(content);
+	} catch {
+		return null;
+	}
+}
+function formatRevisionDate(isoDate) {
+	try {
+		return new Date(isoDate).toLocaleString("en-US", {
+			year: "numeric",
+			month: "2-digit",
+			day: "2-digit",
+			hour: "2-digit",
+			minute: "2-digit"
+		});
+	} catch {
+		return isoDate;
+	}
+}
+function displayRevisions(revisions) {
+	console.log("Available revisions:");
+	for (const rev of revisions) {
+		const marker = rev.active ? " (current)" : "";
+		const traffic = rev.trafficPercent > 0 ? ` [${rev.trafficPercent}%]` : "";
+		console.log(`  ${rev.name}${marker}${traffic} - ${formatRevisionDate(rev.createTime)}`);
+	}
+	console.log("");
+}
+async function infraRollback(options) {
+	console.log("Rolling back Cloud Run service...\n");
+	if (!await checkGcloudInstalled()) {
+		console.error("Error: gcloud CLI is not installed.");
+		console.error("Install it from: https://cloud.google.com/sdk/docs/install");
+		process.exit(1);
+	}
+	const projectRoot = await findProjectRoot$3(process.cwd());
+	if (!projectRoot) {
+		console.error("Error: Could not find project root (no package.json found)");
+		process.exit(1);
+	}
+	const config = await loadConfig$3(projectRoot);
+	if (!config) {
+		console.error("Error: No infrastructure configuration found.");
+		console.error("Run: kuckit infra init");
+		process.exit(1);
+	}
+	const env = options.env ?? config.env;
+	if (env !== "dev" && env !== "prod") {
+		console.error(`Error: Invalid environment '${env}'. Must be 'dev' or 'prod'.`);
+		process.exit(1);
+	}
+	const serviceUrl = config.outputs?.serviceUrl;
+	if (!serviceUrl) {
+		console.error("Error: No Cloud Run service deployed yet.");
+		console.error("Run: kuckit infra deploy");
+		process.exit(1);
+	}
+	const serviceName = extractServiceNameFromUrl(serviceUrl);
+	if (!serviceName) {
+		console.error("Error: Could not determine service name from URL:", serviceUrl);
+		process.exit(1);
+	}
+	console.log(`Service: ${serviceName}`);
+	console.log(`Project: ${config.gcpProject}`);
+	console.log(`Region: ${config.region}`);
+	console.log("");
+	console.log("Fetching revisions...");
+	const revisions = await listCloudRunRevisions(serviceName, config.gcpProject, config.region);
+	if (revisions.length === 0) {
+		console.error("Error: No revisions found for service:", serviceName);
+		process.exit(1);
+	}
+	revisions.sort((a, b) => new Date(b.createTime).getTime() - new Date(a.createTime).getTime());
+	displayRevisions(revisions);
+	let targetRevision;
+	if (options.revision) {
+		if (!revisions.find((r) => r.name === options.revision)) {
+			console.error(`Error: Revision '${options.revision}' not found.`);
+			console.error("Available revisions:", revisions.map((r) => r.name).join(", "));
+			process.exit(1);
+		}
+		targetRevision = options.revision;
+	} else if (options.previous) {
+		if (revisions.length < 2) {
+			console.error("Error: No previous revision available.");
+			console.error("Only one revision exists:", revisions[0]?.name);
+			process.exit(1);
+		}
+		const previousRev = revisions.find((r) => !r.active);
+		if (!previousRev) targetRevision = revisions[1]?.name;
+		else targetRevision = previousRev.name;
+	} else {
+		const choices = revisions.filter((r) => !r.active || r.trafficPercent < 100).map((r) => ({
+			name: `${r.name} - ${formatRevisionDate(r.createTime)}${r.active ? " (partial traffic)" : ""}`,
+			value: r.name
+		}));
+		if (choices.length === 0) {
+			console.log("No other revisions available to rollback to.");
+			process.exit(0);
+		}
+		targetRevision = await select({
+			message: "Select revision to rollback to:",
+			choices
+		});
+	}
+	if (!targetRevision) {
+		console.error("Error: Could not determine target revision.");
+		process.exit(1);
+	}
+	if (revisions.find((r) => r.name === targetRevision)?.trafficPercent === 100) {
+		console.log(`Already routing 100% traffic to ${targetRevision}`);
+		process.exit(0);
+	}
+	console.log(`Rolling back to ${targetRevision}...`);
+	const result = await updateCloudRunTraffic(serviceName, targetRevision, config.gcpProject, config.region);
+	if (result.code !== 0) {
+		console.error("\nError: Failed to update traffic routing");
+		console.error(result.stderr);
+		process.exit(1);
+	}
+	console.log(`\n✓ Traffic routed to ${targetRevision}`);
+}
+
+//#endregion
+//#region src/commands/infra/logs.ts
+const KUCKIT_DIR$2 = ".kuckit";
+const CONFIG_FILE$2 = "infra.json";
+async function fileExists$2(path) {
+	try {
+		await access(path, constants$1.F_OK);
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function findProjectRoot$2(cwd) {
+	let dir = cwd;
+	while (dir !== dirname$1(dir)) {
+		if (await fileExists$2(join$1(dir, "package.json"))) return dir;
+		dir = dirname$1(dir);
+	}
+	return null;
+}
+async function loadConfig$2(projectRoot) {
+	const configPath = join$1(projectRoot, KUCKIT_DIR$2, CONFIG_FILE$2);
+	if (!await fileExists$2(configPath)) return null;
+	try {
+		const content = await readFile(configPath, "utf-8");
+		return JSON.parse(content);
+	} catch {
+		return null;
+	}
+}
+function runGcloudStreaming(args) {
+	return new Promise((resolve) => {
+		spawn("gcloud", args, {
+			stdio: "inherit",
+			shell: true
+		}).on("close", (code) => {
+			resolve(code ?? 1);
+		});
+	});
+}
+async function infraLogs(options) {
+	if (!await checkGcloudInstalled()) {
+		console.error("Error: gcloud CLI is not installed.");
+		console.error("Install it from: https://cloud.google.com/sdk/docs/install");
+		process.exit(1);
+	}
+	const projectRoot = await findProjectRoot$2(process.cwd());
+	if (!projectRoot) {
+		console.error("Error: Could not find project root (no package.json found)");
+		process.exit(1);
+	}
+	const config = await loadConfig$2(projectRoot);
+	if (!config) {
+		console.error("Error: No infrastructure configuration found.");
+		console.error("Run: kuckit infra init");
+		process.exit(1);
+	}
+	const env = options.env ?? config.env;
+	if (env !== "dev" && env !== "prod") {
+		console.error(`Error: Invalid environment '${env}'. Must be 'dev' or 'prod'.`);
+		process.exit(1);
+	}
+	const serviceUrl = config.outputs?.serviceUrl;
+	if (!serviceUrl) {
+		console.error("Error: No Cloud Run service URL found.");
+		console.error("The service may not be deployed yet. Run: kuckit infra deploy");
+		process.exit(1);
+	}
+	const serviceName = extractServiceNameFromUrl(serviceUrl);
+	if (!serviceName) {
+		console.error("Error: Could not extract service name from URL.");
+		console.error(`Service URL: ${serviceUrl}`);
+		process.exit(1);
+	}
+	const since = options.since ?? "1h";
+	console.log(`Fetching logs for service: ${serviceName}`);
+	console.log(`  Project: ${config.gcpProject}`);
+	console.log(`  Region: ${config.region}`);
+	if (options.follow) console.log("  Mode: Following (Ctrl+C to stop)");
+	else console.log(`  Since: ${since}`);
+	if (options.severity) console.log(`  Severity: >= ${options.severity}`);
+	console.log("");
+	const args = [
+		"run",
+		"services",
+		"logs"
+	];
+	if (options.follow) args.push("tail");
+	else args.push("read");
+	args.push(serviceName);
+	args.push("--project", config.gcpProject);
+	args.push("--region", config.region);
+	if (!options.follow) {
+		args.push("--limit", "100");
+		args.push("--freshness", since);
+	}
+	if (options.severity) {
+		const severity = options.severity.toUpperCase();
+		const validSeverities = [
+			"DEBUG",
+			"INFO",
+			"WARNING",
+			"ERROR",
+			"CRITICAL"
+		];
+		if (!validSeverities.includes(severity)) {
+			console.error(`Error: Invalid severity '${severity}'.`);
+			console.error(`Valid values: ${validSeverities.join(", ")}`);
+			process.exit(1);
+		}
+		args.push("--log-filter", `severity>=${severity}`);
+	}
+	if (await runGcloudStreaming(args) !== 0) {
+		console.error("\nError: Failed to fetch logs.");
+		process.exit(1);
+	}
+}
+
+//#endregion
+//#region src/commands/infra/status.ts
+const KUCKIT_DIR$1 = ".kuckit";
+const CONFIG_FILE$1 = "infra.json";
+async function fileExists$1(path) {
+	try {
+		await access(path, constants$1.F_OK);
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function findProjectRoot$1(cwd) {
+	let dir = cwd;
+	while (dir !== dirname$1(dir)) {
+		if (await fileExists$1(join$1(dir, "package.json"))) return dir;
+		dir = dirname$1(dir);
+	}
+	return null;
+}
+async function loadConfig$1(projectRoot) {
+	const configPath = join$1(projectRoot, KUCKIT_DIR$1, CONFIG_FILE$1);
+	if (!await fileExists$1(configPath)) return null;
+	try {
+		const content = await readFile(configPath, "utf-8");
+		return JSON.parse(content);
+	} catch {
+		return null;
+	}
+}
+function formatDate(dateStr) {
+	try {
+		return new Date(dateStr).toLocaleString();
+	} catch {
+		return dateStr;
+	}
+}
+async function infraStatus(options) {
+	const projectRoot = await findProjectRoot$1(process.cwd());
+	if (!projectRoot) {
+		console.error("Error: Could not find project root (no package.json found)");
+		process.exit(1);
+	}
+	const config = await loadConfig$1(projectRoot);
+	if (!config) {
+		console.error("Error: No infrastructure configuration found.");
+		console.error("Run: kuckit infra init");
+		process.exit(1);
+	}
+	const env = options.env ?? config.env ?? "dev";
+	const stackName = `${config.gcpProject}-${env}`;
+	const infraDir = getInfraDir(projectRoot);
+	if (!await fileExists$1(infraDir)) {
+		console.error("Error: packages/infra not found.");
+		process.exit(1);
+	}
+	if (!await selectOrCreateStack(stackName, { cwd: infraDir })) {
+		console.error(`Error: Could not select stack '${stackName}'`);
+		process.exit(1);
+	}
+	const stackInfo = await getPulumiStackInfo({ cwd: infraDir });
+	const history = await getPulumiStackHistory({ cwd: infraDir }, 1);
+	const outputs = await getPulumiOutputs({ cwd: infraDir });
+	let status = "unknown";
+	if (stackInfo?.updateInProgress) status = "updating";
+	else if (stackInfo) status = "active";
+	const resources = [];
+	if (outputs) {
+		if (outputs.registryUrl) resources.push({
+			name: "Artifact Registry",
+			healthy: true
+		});
+		if (outputs.databaseConnectionName) resources.push({
+			name: "Cloud SQL",
+			healthy: true
+		});
+		if (outputs.redisHost) resources.push({
+			name: "Memorystore Redis",
+			healthy: true
+		});
+		if (outputs.serviceUrl) resources.push({
+			name: "Cloud Run Service",
+			healthy: true
+		});
+	}
+	const lastUpdate = history[0]?.endTime ?? stackInfo?.lastUpdate ?? null;
+	const result = {
+		stack: stackName,
+		status,
+		lastUpdate,
+		resourceCount: stackInfo?.resourceCount ?? 0,
+		resources,
+		outputs
+	};
+	if (options.json) {
+		console.log(JSON.stringify(result, null, 2));
+		return;
+	}
+	console.log("");
+	console.log(`Stack: ${result.stack}`);
+	console.log(`Status: ${result.status}`);
+	if (result.lastUpdate) console.log(`Last updated: ${formatDate(result.lastUpdate)}`);
+	console.log(`Resources: ${result.resourceCount}`);
+	console.log("");
+	if (resources.length > 0) {
+		console.log("Infrastructure:");
+		for (const resource of resources) {
+			const icon = resource.healthy ? "✓" : "✗";
+			console.log(`  ${icon} ${resource.name}`);
+		}
+		console.log("");
+	} else {
+		console.log("No resources deployed yet.");
+		console.log("Run: kuckit infra deploy");
+		console.log("");
+	}
+}
+
+//#endregion
+//#region src/commands/infra/outputs.ts
+const KUCKIT_DIR = ".kuckit";
+const CONFIG_FILE = "infra.json";
+async function fileExists(path) {
+	try {
+		await access(path, constants$1.F_OK);
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function findProjectRoot(cwd) {
+	let dir = cwd;
+	while (dir !== dirname$1(dir)) {
+		if (await fileExists(join$1(dir, "package.json"))) return dir;
+		dir = dirname$1(dir);
+	}
+	return null;
+}
+async function loadConfig(projectRoot) {
+	const configPath = join$1(projectRoot, KUCKIT_DIR, CONFIG_FILE);
+	if (!await fileExists(configPath)) return null;
+	try {
+		const content = await readFile(configPath, "utf-8");
+		return JSON.parse(content);
+	} catch {
+		return null;
+	}
+}
+async function infraOutputs(options) {
+	const projectRoot = await findProjectRoot(process.cwd());
+	if (!projectRoot) {
+		console.error("Error: Could not find project root (no package.json found)");
+		process.exit(1);
+	}
+	const config = await loadConfig(projectRoot);
+	if (!config) {
+		console.error("Error: No infrastructure configuration found.");
+		console.error("Run: kuckit infra init");
+		process.exit(1);
+	}
+	const env = options.env ?? config.env ?? "dev";
+	const stackName = `${config.gcpProject}-${env}`;
+	const infraDir = getInfraDir(projectRoot);
+	if (!await fileExists(infraDir)) {
+		console.error("Error: packages/infra not found.");
+		process.exit(1);
+	}
+	if (!await selectOrCreateStack(stackName, { cwd: infraDir })) {
+		console.error(`Error: Could not select stack '${stackName}'`);
+		process.exit(1);
+	}
+	const outputs = await getPulumiOutputs({ cwd: infraDir });
+	if (!outputs) {
+		console.error("Error: Could not retrieve stack outputs.");
+		console.error("The stack may not have been deployed yet.");
+		console.error("Run: kuckit infra deploy");
+		process.exit(1);
+	}
+	if (options.json) {
+		console.log(JSON.stringify(outputs, null, 2));
+		return;
+	}
+	console.log("");
+	console.log(`Environment: ${env}`);
+	console.log("");
+	if (outputs.serviceUrl) console.log(`Service URL:    ${outputs.serviceUrl}`);
+	if (outputs.registryUrl) console.log(`Registry URL:   ${outputs.registryUrl}`);
+	if (outputs.databaseConnectionName) console.log(`Database:       ${outputs.databaseConnectionName}`);
+	if (outputs.redisHost) console.log(`Redis Host:     ${outputs.redisHost}`);
+	const knownKeys = [
+		"serviceUrl",
+		"registryUrl",
+		"databaseConnectionName",
+		"redisHost"
+	];
+	const additionalKeys = Object.keys(outputs).filter((k) => !knownKeys.includes(k));
+	if (additionalKeys.length > 0) {
+		console.log("");
+		console.log("Additional outputs:");
+		for (const key of additionalKeys) {
+			const value = outputs[key];
+			if (typeof value === "object") console.log(`  ${key}: ${JSON.stringify(value)}`);
+			else console.log(`  ${key}: ${value}`);
+		}
+	}
+	console.log("");
+}
+
+//#endregion
+//#region src/bin.ts
+program.name("kuckit").description("CLI tools for Kuckit SDK module development").version("0.1.0");
+program.command("generate").description("Generate Kuckit resources").command("module <name>").description("Generate a new Kuckit module").option("-o, --org <org>", "Organization scope for package name", "").option("-d, --dir <directory>", "Target directory", "packages").action(async (name, options) => {
+	requireAuth();
+	await generateModule(name, options);
+});
+program.command("add <package>").description("Install and wire a Kuckit module").option("--skip-install", "Skip package installation", false).action(async (packageName, options) => {
+	requireAuth();
+	await addModule(packageName, options);
+});
+program.command("discover").description("Scan node_modules for installed Kuckit modules").option("--json", "Output as JSON (non-interactive)", false).option("--no-interactive", "Disable interactive prompts").action(async (options) => {
+	requireAuth();
+	await discoverModules(options);
+});
+program.command("doctor").description("Check Kuckit setup and validate module configuration").option("--json", "Output as JSON", false).action(async (options) => {
+	await doctor(options);
+});
+program.command("search <keyword>").description("Search npm registry for Kuckit modules").option("--json", "Output as JSON", false).option("-l, --limit <number>", "Maximum results to return", "10").action(async (keyword, options) => {
+	await search(keyword, {
+		json: options.json,
+		limit: parseInt(options.limit, 10)
+	});
+});
+const db = program.command("db").description("Database schema management for module-owned schemas");
+db.command("push").description("Push all module schemas to database").option("--url <url>", "Database connection URL").action(async (options) => {
+	requireAuth();
+	await dbPush(options);
+});
+db.command("generate").description("Generate migration files for module schemas").option("--url <url>", "Database connection URL").action(async (options) => {
+	requireAuth();
+	await dbGenerate(options);
+});
+db.command("studio").description("Open Drizzle Studio with all module schemas").option("--url <url>", "Database connection URL").action(async (options) => {
+	requireAuth();
+	await dbStudio(options);
+});
+registerAuthCommands(program);
+const infra = program.command("infra").description("Infrastructure deployment and management");
+infra.command("init").description("Initialize base infrastructure (no Docker required)").option("-p, --provider <provider>", "Cloud provider (gcp)", "gcp").option("--project <id>", "GCP project ID").option("--region <region>", "Deployment region", "us-central1").option("-e, --env <env>", "Environment (dev, prod)", "dev").option("-y, --yes", "Skip confirmation prompts", false).action(async (options) => {
+	requireAuth();
+	await infraInit(options);
+});
+infra.command("deploy").description("Build and deploy application to Cloud Run").option("-e, --env <env>", "Environment (dev, prod)", "dev").option("--preview", "Preview changes without applying", false).option("--skip-build", "Use existing image (skip Docker build)", false).option("--image <url>", "Use specific image URL").option("-y, --yes", "Skip confirmation prompts", false).action(async (options) => {
+	requireAuth();
+	await infraDeploy(options);
+});
+infra.command("destroy").description("Destroy infrastructure resources").option("-e, --env <env>", "Environment (dev, prod)", "dev").option("--app-only", "Only destroy Cloud Run, keep DB/Redis", false).option("--force", "Skip confirmation prompt", false).action(async (options) => {
+	requireAuth();
+	await infraDestroy(options);
+});
+infra.command("repair").description("Repair infrastructure state issues").option("-e, --env <env>", "Environment (dev, prod)", "dev").option("--refresh", "Refresh state from cloud provider", false).option("--cancel", "Cancel any stuck operations", false).option("--force", "Force repair without confirmation", false).action(async (options) => {
+	requireAuth();
+	await infraRepair(options);
+});
+infra.command("db:push").description("Push schema directly to Cloud SQL (dev/fresh databases)").option("-e, --env <env>", "Environment (dev, prod)", "dev").option("--force", "Skip confirmation for destructive changes", false).option("--public-ip", "Use public IP (default: private IP, requires VPC access)", false).action(async (options) => {
+	requireAuth();
+	await infraDbPush(options);
+});
+infra.command("db:migrate").description("Run database migrations via Cloud SQL Auth Proxy").option("-e, --env <env>", "Environment (dev, prod)", "dev").option("--dry-run", "Show migrations without applying", false).option("--rollback", "Rollback the last migration", false).option("--public-ip", "Use public IP (default: private IP, requires VPC access)", false).action(async (options) => {
+	requireAuth();
+	await infraDbMigrate(options);
+});
+infra.command("rollback").description("Rollback Cloud Run service to a previous revision").option("-e, --env <env>", "Environment (dev, prod)", "dev").option("--revision <name>", "Specific revision name to rollback to").option("--previous", "Rollback to the previous revision", false).action(async (options) => {
+	requireAuth();
+	await infraRollback(options);
+});
+infra.command("logs").description("View Cloud Run service logs").option("-e, --env <env>", "Environment (dev, prod)", "dev").option("-f, --follow", "Stream logs in real-time", false).option("--since <duration>", "Show logs since duration (e.g., 1h, 30m)", "1h").option("--severity <level>", "Filter by severity (DEBUG, INFO, WARNING, ERROR)").action(async (options) => {
+	requireAuth();
+	await infraLogs(options);
+});
+infra.command("status").description("Show current infrastructure state").option("-e, --env <env>", "Environment (dev, prod)", "dev").option("--json", "Output as JSON", false).action(async (options) => {
+	requireAuth();
+	await infraStatus(options);
+});
+infra.command("outputs").description("Display infrastructure outputs (URLs, connection strings)").option("-e, --env <env>", "Environment (dev, prod)", "dev").option("--json", "Output as JSON", false).action(async (options) => {
+	requireAuth();
+	await infraOutputs(options);
+});
 program.parse();
 
 //#endregion