@nuvlore/extension-workday-infra-access 0.1.1

package/skills/workday-infra-access/references/access-spc-argo-runbook.md

@@ -0,0 +1,99 @@
+# SPC, Argo, And ComponentRelease Access Runbook
+
+Use for public cloud SPC connection, Argo UI inspection,
+ComponentRelease/HelmRelease drift, and smoke-test dependency namespace checks.
+Private cloud/DC login uses Boundary through `bauth init` instead. Owner:
+`workday-infra-access/SKILL.md`.
+
+## SPC And Argo UI
+
+- Confirm Workday Security Network login/session is active before SPC login.
+- If the user gives a logical environment name instead of an SPC cluster, map it
+  first with `workday_public_cloud_environment_map`. Do not treat logical names
+  like `CP2` as SPC cluster names.
+- Preserve the operator-provided tier and cluster mapping. Current SPC CLI shape
+  is `spc [-d] connect <tier> <cluster>`; `-d` means developer access for
+  DEV/ENG, not the tier argument. Examples:
+  `spc -d connect dev proteusaws00020` and `spc connect cust s0026`.
+- Use `workday_public_cloud_spc_login` for the reusable public-cloud login
+  step. It may update local SPC kubeconfig/session state only after structured
+  HITL approval.
+- The verified public-cloud login sequence is:
+  1. Confirm Workday Security Network is active.
+  2. Refresh the AWS source credential with
+     `sso-cli aws --force --profile sso-cust`.
+  3. Start SPC with `AWS_PROFILE=sso-cust spc connect cust <cluster>`.
+  4. Verify with
+     `AWS_PROFILE=sso-cust kubectl --kubeconfig=$HOME/.kube/spc-config config current-context`,
+     `auth whoami`, and `auth can-i get pods -n <namespace>`.
+  Do not export `AWS_REGION` or `AWS_DEFAULT_REGION` into the `spc connect` or
+  `kubectl` environment. Do not pass `--region` to `sso-cli aws` unless the
+  operator explicitly requests it; forcing a region into SPC caused DynamoDB
+  `ResourceNotFoundException` during live testing.
+- Use macOS Keychain service `eldwin`, account `eldwin.workday_prod_ldap` for
+  public cloud SPC login across tiers. Legacy `wallee` entries are fallback
+  secret sources only. Some entries are JSON; extract only the top-level
+  `token` and pass it through `expect`/stdin.
+- `spc` requires a TTY password prompt. A plain pipe may fail with
+  `inappropriate ioctl for device`; use an `expect` wrapper. If `spc` exits
+  before a password prompt during debugging, a TTY wrapper such as
+  `/usr/bin/script -q /tmp/spc-<cluster>.out spc connect <tier> <cluster>` can
+  establish the session without exposing the secret.
+- Ensure local `PATH` includes `session-manager-plugin`, `sso-cli`, `kubectl`,
+  and `spc`; missing PATH entries can make `spc connect` or kubeconfig exec auth
+  fail even when binaries are installed.
+- On this workstation the verified binary locations are:
+  `/Users/boqiang.liang/bin/sso-cli`,
+  `/usr/local/bin/spc`,
+  `/usr/local/bin/kubectl`, and
+  `/usr/local/bin/session-manager-plugin`. Non-login shells may not include
+  these paths by default, so tools must set the PATH explicitly.
+- `spc list cust --url` is a useful preflight after AWS refresh. SPC cluster
+  names are values such as `s0026` and `s0109`; names like `wd103perf` can be
+  AWS profile aliases or legacy kube contexts and are not necessarily valid SPC
+  cluster names.
+- CP2 examples:
+  - AWS-backed public cloud: refresh AWS with `sso-cli aws --force --profile
+    sso-cust`, then `AWS_PROFILE=sso-cust spc connect cust s0054`, then use
+    bounded `kcsb get pod` or explicit `kubectl --kubeconfig=$HOME/.kube/spc-config`
+    reads.
+  - GCS-backed public cloud: refresh AWS with `sso-cli aws --force --profile
+    sso-cust`, then `AWS_PROFILE=sso-cust spc connect cust s0029`, then use
+    bounded `kcsb get pod`; if approved read-only pod shell access is needed,
+    `kcsb exec -it bdm-0 -- bash` may be used only for bounded reads such as
+    `gsutil ls gs://scylla-218441665564-bds-tenant-s0020/data/tenants/`.
+- Use `kcsb` or explicit `kubectl` commands so evidence is copyable, bounded,
+  and auditable.
+- Clean up long-running `spc connect` and port-forward processes when done.
+- After `spc` is connected, Argo UI can be inspected through
+  `kubectl --kubeconfig=$HOME/.kube/spc-config -n argocdapp port-forward svc/argocdapp-server 8080:443`
+  and `https://localhost:8080/`.
+- `spc connect` proves connectivity, not Kubernetes authorization. Before any
+  approved remediation such as `kubectl scale`, `patch`, or `rollout restart`,
+  verify identity with `kubectl auth whoami` and the target verb with
+  `kubectl auth can-i ... -n <namespace>`.
+- Argo UI inspection is read-only only if you avoid state-changing controls:
+  `Sync`, `Hard Refresh`, `Delete`, `Rollback`, `Scale`, `Patch`, and `Restart`.
+- Prefer CLI reads where possible:
+  `kubectl --kubeconfig=$HOME/.kube/spc-config get app -n argocdapp ... -o json`,
+  `kubectl get componentrelease -n <namespace> ...`, and
+  `kubectl get deploy,statefulset,pods -n <namespace> -o wide`.
+- Before claiming a service, pod, or log is absent, check namespace RBAC with
+  `kubectl --kubeconfig=$HOME/.kube/spc-config auth can-i get pods -n <namespace>`,
+  plus equivalent service, endpoints, deployment, and logs checks.
+
+## ComponentRelease And Smoke-Test Dependencies
+
+- For BDS/Proteus ComponentRelease investigations, verify all five layers:
+  scylla `component-config` source of truth, Argo Application sync/health,
+  ComponentRelease desired/deployed status, Flux HelmRelease desired status and
+  `spec.driftDetection`, and live Deployment/StatefulSet/pod replicas.
+- Treat `HelmRelease.spec.driftDetection` as a Flux Helm Controller setting. If
+  it is null/disabled and live workloads drift from non-zero desired replicas,
+  the deeper platform question is whether `isd-component-controller` and the
+  ComponentRelease CRD/default HelmRelease spec expose or set drift detection.
+- When a Bamboo smoke test waits on a dependency selector such as `name=prism`,
+  inspect that dependency namespace directly. Compare ComponentRelease and
+  HelmRelease desired state with live deployments, pods selected by the exact
+  label, and service endpoints; do not assume a successful ComponentRelease
+  means dependency pods are running.

package/src/workday-access-profiles.mjs

@@ -0,0 +1,194 @@
+export const DEFAULT_DC_BOUNDARY_ADDR = "https://dccust.pam.gowday.com";
+export const DEFAULT_BOUNDARY_BINARY_DIR = "/opt/homebrew/bin";
+export const DEFAULT_BOUNDARY_PROXY_JUMP_HOST = "proxy-jump.atl.bnd";
+export const DEFAULT_WORKDAY_LDAP_KEYCHAIN_SERVICE = "eldwin";
+export const DEFAULT_WORKDAY_LDAP_SERVICE_KEY = "workday_prod_ldap";
+export const DEFAULT_WORKDAY_LDAP_PROD_SERVICE_KEY = "workday_prod_ldap";
+export const DEFAULT_WORKDAY_LDAP_CORP_SERVICE_KEY = "workday_corp_ldap";
+export const DEFAULT_WORKDAY_LDAP_KEYCHAIN_ACCOUNT = "eldwin.workday_prod_ldap";
+export const DEFAULT_WORKDAY_LDAP_PROD_KEYCHAIN_ACCOUNT = "eldwin.workday_prod_ldap";
+export const DEFAULT_WORKDAY_LDAP_CORP_KEYCHAIN_ACCOUNT = "eldwin.workday_corp_ldap";
+export const LEGACY_WORKDAY_LDAP_KEYCHAIN_SERVICE = ["wal", "lee"].join("");
+export const LEGACY_WORKDAY_LDAP_KEYCHAIN_ACCOUNT = `${LEGACY_WORKDAY_LDAP_KEYCHAIN_SERVICE}.workday_prod_ldap`;
+export const LEGACY_WORKDAY_LDAP_PROD_KEYCHAIN_ACCOUNT = `${LEGACY_WORKDAY_LDAP_KEYCHAIN_SERVICE}.workday_prod_ldap`;
+export const LEGACY_WORKDAY_LDAP_CORP_KEYCHAIN_ACCOUNT = `${LEGACY_WORKDAY_LDAP_KEYCHAIN_SERVICE}.workday_corp_ldap`;
+export const DEFAULT_ADMIN_KUBECONFIG_PATH = "/etc/kubernetes/admin.conf";
+export const DEFAULT_SCYLLA_NAMESPACE = "bds";
+export const DEFAULT_SCYLLA_BDM_POD = "bdm-0";
+
+function normalizeText(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+export function shellQuote(value) {
+  return `'${String(value).replaceAll("'", "'\\''")}'`;
+}
+
+export function extractTokenFromKeychainSecret(rawSecret = "") {
+  const text = normalizeText(rawSecret);
+  if (!text) return "";
+  try {
+    const parsed = JSON.parse(text);
+    return normalizeText(parsed?.token);
+  } catch {
+    return text;
+  }
+}
+
+export function keychainAccountCandidates(account, { canonicalPrefix = "eldwin." } = {}) {
+  const raw = normalizeText(account);
+  if (!raw) return [];
+  const prefixed = raw.startsWith(canonicalPrefix) ? raw : `${canonicalPrefix}${raw}`;
+  return Array.from(new Set([raw, prefixed]));
+}
+
+export function uniqueCredentialCandidates(candidates = []) {
+  return candidates
+    .filter((candidate) => candidate?.service && candidate?.account)
+    .filter((candidate, index, all) =>
+      all.findIndex((item) => item.service === candidate.service && item.account === candidate.account) === index
+    );
+}
+
+export function workdayProdCredentialCandidates() {
+  return uniqueCredentialCandidates([
+    { service: DEFAULT_WORKDAY_LDAP_KEYCHAIN_SERVICE, account: DEFAULT_WORKDAY_LDAP_PROD_KEYCHAIN_ACCOUNT },
+    { service: LEGACY_WORKDAY_LDAP_KEYCHAIN_SERVICE, account: LEGACY_WORKDAY_LDAP_PROD_KEYCHAIN_ACCOUNT }
+  ]);
+}
+
+export class DcLoginProfile {
+  constructor(input = {}) {
+    this.boundaryAddr = input.boundaryAddr ?? DEFAULT_DC_BOUNDARY_ADDR;
+    this.boundaryBinaryDir = input.boundaryBinaryDir ?? DEFAULT_BOUNDARY_BINARY_DIR;
+    this.boundaryProxyJumpHost = input.boundaryProxyJumpHost ?? DEFAULT_BOUNDARY_PROXY_JUMP_HOST;
+    this.useBoundaryBnd = input.useBoundaryBnd ?? false;
+  }
+
+  boundaryHostFor(host) {
+    const value = String(host || "");
+    if (!this.useBoundaryBnd || value.includes("<") || value.endsWith(".bnd")) return value;
+    return `${value}.bnd`;
+  }
+
+  environmentPrefix() {
+    return `BOUNDARY_ADDR=${shellQuote(this.boundaryAddr)} BOUNDARY_SKIP_CACHE_DAEMON=true PATH=${shellQuote(this.boundaryBinaryDir)}:/Users/boqiang.liang/bin:/usr/local/bin:$PATH`;
+  }
+
+  sshCommandFor(host, remoteCommand, { connectTimeout = 20 } = {}) {
+    return `${this.environmentPrefix()} ssh -o BatchMode=yes -o ConnectTimeout=${connectTimeout} -- ${this.boundaryHostFor(host)} ${JSON.stringify(remoteCommand)}`;
+  }
+
+  proxyJumpCommandFor(host, remoteCommand, { connectTimeout = 20 } = {}) {
+    return `${this.environmentPrefix()} ssh -o BatchMode=yes -o ConnectTimeout=${connectTimeout} -J ${shellQuote(this.boundaryProxyJumpHost)} -- ${host} ${JSON.stringify(remoteCommand)}`;
+  }
+
+  toJson() {
+    return {
+      boundaryAddr: this.boundaryAddr,
+      boundaryBinaryDir: this.boundaryBinaryDir,
+      boundaryProxyJumpHost: this.boundaryProxyJumpHost,
+      useBoundaryBnd: this.useBoundaryBnd
+    };
+  }
+}
+
+export class SudoEnvironmentProfile {
+  constructor(input = {}) {
+    this.keychainService = input.keychainService ?? DEFAULT_WORKDAY_LDAP_KEYCHAIN_SERVICE;
+    this.keychainAccount = input.keychainAccount ?? DEFAULT_WORKDAY_LDAP_KEYCHAIN_ACCOUNT;
+    this.fallbackCredentials = input.fallbackCredentials ?? workdayProdCredentialCandidates().slice(1);
+    this.kubeconfigPath = input.kubeconfigPath ?? DEFAULT_ADMIN_KUBECONFIG_PATH;
+  }
+
+  keychainCandidates() {
+    return uniqueCredentialCandidates([
+      { service: this.keychainService, account: this.keychainAccount },
+      ...this.fallbackCredentials
+    ]);
+  }
+
+  keychainReadCommand() {
+    return "Direct PROD password reads are restricted. Use workday_private_cloud_sudo_readonly_command.";
+  }
+
+  stdinSudoRemoteCommand(command) {
+    return `IFS= read -r SUDOPASS || exit 11; printf '%s\\n' "$SUDOPASS" | sudo -S -p '' bash -lc ${JSON.stringify(command)}`;
+  }
+
+  sudoWrapperFor({ dcProfile, host, command }) {
+    const target = dcProfile.boundaryHostFor(host);
+    return `mcp__devops_tool__workday_private_cloud_sudo_readonly_command ${JSON.stringify({
+      action: "run",
+      host: target,
+      command,
+      humanApprovedSudoRead: true,
+      hitlApproval: {
+        approved: true,
+        approvedBy: "<operator>",
+        action: "Run private-cloud sudo read-only command",
+        target,
+        reason: "<why this sudo read is needed>",
+        expectedImpact: "Read-only sudo command; no remote writes.",
+        risk: "Privileged read may expose sensitive host state."
+      }
+    })}`;
+  }
+
+  sudoKubectl(command) {
+    return `sudo -n kubectl --kubeconfig=${this.kubeconfigPath} ${command}`;
+  }
+
+  verificationCommand({ host, dcProfile = new DcLoginProfile() }) {
+    return this.sudoWrapperFor({ dcProfile, host, command: "hostname" });
+  }
+
+  toJson() {
+    return {
+      keychainService: this.keychainService,
+      keychainAccount: this.keychainAccount,
+      keychainCandidates: this.keychainCandidates(),
+      kubeconfigPath: this.kubeconfigPath
+    };
+  }
+}
+
+export class ScyllaAccessProfile {
+  constructor(input = {}) {
+    this.cluster = input.cluster;
+    this.namespace = input.namespace ?? DEFAULT_SCYLLA_NAMESPACE;
+    this.bdmPod = input.bdmPod ?? DEFAULT_SCYLLA_BDM_POD;
+    this.kubeconfigPath = input.kubeconfigPath ?? "$HOME/.kube/spc-config";
+    this.connectionTool = input.connectionTool ?? "kcsb";
+  }
+
+  podExec(command, { container } = {}) {
+    const containerArg = container ? ` -c ${container}` : "";
+    return `${this.connectionTool} exec ${this.bdmPod}${containerArg} -- sh -lc ${shellQuote(command)}`;
+  }
+
+  podLogs({ pod = this.bdmPod, container = "bdm", since = "4h", pattern = "" } = {}) {
+    const grep = pattern ? ` | egrep ${shellQuote(pattern)}` : "";
+    return `${this.connectionTool} logs ${pod} -c ${container} --since=${since}${grep}`;
+  }
+
+  bucketConfigCommand() {
+    return `${this.connectionTool} get cm bucketdetails-config -o yaml`;
+  }
+
+  rbacBoundaryCommand(namespaces = ["sir", "galahad", "ors", "oms", "argocdapp", "bds"]) {
+    return `for ns in ${namespaces.map(shellQuote).join(" ")}; do for r in pods services endpoints deployments.apps; do kubectl --kubeconfig=${this.kubeconfigPath} auth can-i get "$r" -n "$ns"; done; done`;
+  }
+
+  toJson() {
+    return {
+      cluster: this.cluster,
+      namespace: this.namespace,
+      bdmPod: this.bdmPod,
+      kubeconfigPath: this.kubeconfigPath,
+      connectionTool: this.connectionTool,
+      bucketConfigCommand: this.bucketConfigCommand(),
+      rbacBoundaryCommand: this.rbacBoundaryCommand()
+    };
+  }
+}

package/tools/aws_cust_federated_readonly_command_pack.mjs

@@ -0,0 +1,234 @@
+export const description = "Create a local-only AWS CUST federated access read-only CLI command pack based on the approved CCOE guide; does not authenticate, read credentials, or call AWS APIs.";
+
+import { z } from "zod";
+import { defineReadOnlyTool, fail, ok } from "@nuvlore/extension-read-only-toolkit/devops-diagnostics";
+
+const AWS_FEDERATED_ACCESS_GUIDE_URL = "https://confluence.workday.com/display/CCOE/AWS+-+Federated+Access+to+CUST+Accounts+-+User+Guide";
+const DEFAULT_REGION = "us-west-2";
+const READ_ONLY_SERVICES = new Set([
+  "account",
+  "cloudformation",
+  "cloudtrail",
+  "cloudwatch",
+  "ec2",
+  "eks",
+  "elb",
+  "iam",
+  "kms",
+  "lambda",
+  "logs",
+  "rds",
+  "route53",
+  "s3",
+  "s3api",
+  "secretsmanager",
+  "sts"
+]);
+
+function normalizeText(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function shellQuote(value) {
+  return `'${String(value).replaceAll("'", "'\\''")}'`;
+}
+
+function normalizeService(value) {
+  const service = normalizeText(value || "sts").toLowerCase();
+  if (!READ_ONLY_SERVICES.has(service)) {
+    throw new Error(`Unsupported AWS read-only service: ${service}. Supported services: ${[...READ_ONLY_SERVICES].sort().join(", ")}.`);
+  }
+  return service;
+}
+
+function normalizeInput(input = {}) {
+  return {
+    accountId: normalizeText(input.accountId),
+    accountAlias: normalizeText(input.accountAlias),
+    roleName: normalizeText(input.roleName),
+    profile: normalizeText(input.profile),
+    region: normalizeText(input.region) || DEFAULT_REGION,
+    service: normalizeService(input.service),
+    resource: normalizeText(input.resource),
+    guideUrl: normalizeText(input.guideUrl) || AWS_FEDERATED_ACCESS_GUIDE_URL
+  };
+}
+
+function baseAws(input) {
+  const profile = input.profile ? ` --profile ${shellQuote(input.profile)}` : "";
+  const region = input.region ? ` --region ${shellQuote(input.region)}` : "";
+  return `aws${profile}${region}`;
+}
+
+function serviceCommands(input) {
+  const aws = baseAws(input);
+  const resource = input.resource;
+  switch (input.service) {
+    case "account":
+      return [
+        `${aws} account get-contact-information`,
+        `${aws} account get-alternate-contact --alternate-contact-type OPERATIONS`,
+        `${aws} account get-region-opt-status --region-name ${shellQuote(input.region)}`
+      ];
+    case "cloudformation":
+      return [
+        `${aws} cloudformation list-stacks --stack-status-filter CREATE_COMPLETE UPDATE_COMPLETE UPDATE_ROLLBACK_COMPLETE ROLLBACK_COMPLETE`,
+        resource ? `${aws} cloudformation describe-stacks --stack-name ${shellQuote(resource)}` : `${aws} cloudformation describe-stacks`
+      ];
+    case "cloudtrail":
+      return [
+        `${aws} cloudtrail describe-trails`,
+        `${aws} cloudtrail get-trail-status --name ${shellQuote(resource || "trail-name")}`
+      ];
+    case "cloudwatch":
+      return [
+        `${aws} cloudwatch describe-alarms`,
+        `${aws} cloudwatch list-metrics`
+      ];
+    case "ec2":
+      return [
+        `${aws} ec2 describe-instances`,
+        `${aws} ec2 describe-security-groups`,
+        `${aws} ec2 describe-subnets`,
+        `${aws} ec2 describe-vpcs`
+      ];
+    case "eks":
+      return [
+        `${aws} eks list-clusters`,
+        resource ? `${aws} eks describe-cluster --name ${shellQuote(resource)}` : `${aws} eks describe-cluster --name ${shellQuote("cluster-name")}`
+      ];
+    case "elb":
+      return [
+        `${aws} elbv2 describe-load-balancers`,
+        `${aws} elbv2 describe-target-groups`
+      ];
+    case "iam":
+      return [
+        `${aws} iam get-account-summary`,
+        `${aws} iam list-roles`,
+        resource ? `${aws} iam get-role --role-name ${shellQuote(resource)}` : `${aws} iam list-policies --scope Local`
+      ];
+    case "kms":
+      return [
+        `${aws} kms list-keys`,
+        resource ? `${aws} kms describe-key --key-id ${shellQuote(resource)}` : `${aws} kms list-aliases`
+      ];
+    case "lambda":
+      return [
+        `${aws} lambda list-functions`,
+        resource ? `${aws} lambda get-function-configuration --function-name ${shellQuote(resource)}` : `${aws} lambda list-event-source-mappings`
+      ];
+    case "logs":
+      return [
+        `${aws} logs describe-log-groups`,
+        resource ? `${aws} logs describe-log-streams --log-group-name ${shellQuote(resource)} --max-items 25` : `${aws} logs describe-log-groups --max-items 50`
+      ];
+    case "rds":
+      return [
+        `${aws} rds describe-db-instances`,
+        `${aws} rds describe-db-clusters`
+      ];
+    case "route53":
+      return [
+        `${aws} route53 list-hosted-zones`,
+        resource ? `${aws} route53 list-resource-record-sets --hosted-zone-id ${shellQuote(resource)}` : `${aws} route53 list-health-checks`
+      ];
+    case "s3":
+      return [
+        `${aws} s3 ls${resource ? ` ${shellQuote(resource)}` : ""}`,
+        `${aws} s3 ls${resource ? ` ${shellQuote(resource)}` : " s3://<bucket>"} --recursive --summarize --human-readable`
+      ];
+    case "s3api":
+      return [
+        resource ? `${aws} s3api get-bucket-location --bucket ${shellQuote(resource)}` : `${aws} s3api list-buckets`,
+        resource ? `${aws} s3api get-bucket-encryption --bucket ${shellQuote(resource)}` : `${aws} s3api list-buckets`
+      ];
+    case "secretsmanager":
+      return [
+        `${aws} secretsmanager list-secrets`,
+        resource ? `${aws} secretsmanager describe-secret --secret-id ${shellQuote(resource)}` : `${aws} secretsmanager list-secrets --max-results 50`
+      ];
+    case "sts":
+    default:
+      return [
+        `${aws} sts get-caller-identity`
+      ];
+  }
+}
+
+function awsCustFederatedReadonlyPlan(input) {
+  const normalized = normalizeInput(input);
+  return JSON.stringify({
+    mode: "atomic-helper",
+    platform: "aws",
+    accessPattern: "cust-federated-readonly",
+    sourceGuide: {
+      title: "AWS - Federated Access to CUST Accounts - User Guide",
+      url: normalized.guideUrl,
+      status: "referenced; not executed by this tool"
+    },
+    target: {
+      accountId: normalized.accountId,
+      accountAlias: normalized.accountAlias,
+      roleName: normalized.roleName,
+      profile: normalized.profile,
+      region: normalized.region,
+      service: normalized.service,
+      resource: normalized.resource
+    },
+    credentialBoundary: [
+      "Complete AWS CUST federated access outside this tool using the approved CCOE guide.",
+      "This tool never opens a browser login, never stores SAML/OIDC tokens, and never reads AWS credential files.",
+      "After federation, use an explicit AWS_PROFILE or exported session supplied by the operator."
+    ],
+    commands: {
+      identity: `${baseAws(normalized)} sts get-caller-identity`,
+      serviceReads: serviceCommands(normalized)
+    },
+    forbiddenActions: [
+      "aws s3 cp",
+      "aws s3 mv",
+      "aws s3 rm",
+      "aws s3 sync",
+      "aws s3api put-object",
+      "aws s3api delete-object",
+      "aws ec2 start-instances",
+      "aws ec2 stop-instances",
+      "aws eks update-*",
+      "aws iam create-*",
+      "aws iam put-*",
+      "aws secretsmanager get-secret-value"
+    ],
+    remoteWrite: "not_executed"
+  }, null, 2);
+}
+
+export default defineReadOnlyTool({
+  name: "aws_cust_federated_readonly_command_pack",
+  description: "Create a local-only AWS CUST federated access read-only CLI command pack based on the approved CCOE guide; does not authenticate, read credentials, or call AWS APIs.",
+  inputSchema: {
+    accountId: z.string().trim().max(64).default(""),
+    accountAlias: z.string().trim().max(256).default(""),
+    roleName: z.string().trim().max(256).default(""),
+    profile: z.string().trim().max(256).default(""),
+    region: z.string().trim().max(64).default(DEFAULT_REGION),
+    service: z.string().trim().max(64).default("sts"),
+    resource: z.string().trim().max(2048).default(""),
+    guideUrl: z.string().trim().url().max(2048).default(AWS_FEDERATED_ACCESS_GUIDE_URL)
+  },
+  async handler(input) {
+    try {
+      return ok(awsCustFederatedReadonlyPlan(input));
+    } catch (error) {
+      return fail(error);
+    }
+  }
+});
+
+export const __test = {
+  AWS_FEDERATED_ACCESS_GUIDE_URL,
+  READ_ONLY_SERVICES,
+  normalizeInput,
+  serviceCommands,
+  awsCustFederatedReadonlyPlan
+};

package/tools/gcp_readonly_command_pack.mjs

@@ -0,0 +1,167 @@
+export const description = "Create a local-only GCP read-only CLI command pack; does not authenticate, read credentials, or call GCP APIs.";
+
+import { z } from "zod";
+import { defineReadOnlyTool, fail, ok } from "@nuvlore/extension-read-only-toolkit/devops-diagnostics";
+
+const DEFAULT_REGION = "us-west1";
+const READ_ONLY_SERVICES = new Set([
+  "billing",
+  "compute",
+  "gke",
+  "iam",
+  "logging",
+  "monitoring",
+  "projects",
+  "storage"
+]);
+
+function normalizeText(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function shellQuote(value) {
+  return `'${String(value).replaceAll("'", "'\\''")}'`;
+}
+
+function normalizeService(value) {
+  const service = normalizeText(value || "projects").toLowerCase();
+  if (!READ_ONLY_SERVICES.has(service)) {
+    throw new Error(`Unsupported GCP read-only service: ${service}. Supported services: ${[...READ_ONLY_SERVICES].sort().join(", ")}.`);
+  }
+  return service;
+}
+
+function normalizeInput(input = {}) {
+  return {
+    projectId: normalizeText(input.projectId),
+    account: normalizeText(input.account),
+    region: normalizeText(input.region) || DEFAULT_REGION,
+    zone: normalizeText(input.zone),
+    service: normalizeService(input.service),
+    resource: normalizeText(input.resource)
+  };
+}
+
+function baseGcloud(input) {
+  const project = input.projectId ? ` --project=${shellQuote(input.projectId)}` : "";
+  const account = input.account ? ` --account=${shellQuote(input.account)}` : "";
+  return `gcloud${project}${account}`;
+}
+
+function serviceCommands(input) {
+  const gcloud = baseGcloud(input);
+  const resource = input.resource;
+  switch (input.service) {
+    case "billing":
+      return [
+        `${gcloud} billing projects describe ${shellQuote(input.projectId || "PROJECT_ID")}`
+      ];
+    case "compute":
+      return [
+        `${gcloud} compute instances list`,
+        resource ? `${gcloud} compute instances describe ${shellQuote(resource)}${input.zone ? ` --zone=${shellQuote(input.zone)}` : ""}` : `${gcloud} compute networks list`,
+        `${gcloud} compute firewall-rules list`
+      ];
+    case "gke":
+      return [
+        `${gcloud} container clusters list`,
+        resource ? `${gcloud} container clusters describe ${shellQuote(resource)}${input.region ? ` --region=${shellQuote(input.region)}` : ""}` : `${gcloud} container clusters list`
+      ];
+    case "iam":
+      return [
+        `${gcloud} projects get-iam-policy ${shellQuote(input.projectId || "PROJECT_ID")}`,
+        `${gcloud} iam service-accounts list`
+      ];
+    case "logging":
+      return [
+        `${gcloud} logging sinks list`,
+        `${gcloud} logging read ${shellQuote(resource || "timestamp >= \"$(date -u -v-1H +%Y-%m-%dT%H:%M:%SZ)\"")} --limit=50`
+      ];
+    case "monitoring":
+      return [
+        `${gcloud} monitoring policies list`,
+        `${gcloud} monitoring uptime list-configs`
+      ];
+    case "storage":
+      return [
+        `gcloud storage buckets list${input.projectId ? ` --project=${shellQuote(input.projectId)}` : ""}`,
+        resource ? `gcloud storage objects list ${shellQuote(resource)}` : "gcloud storage objects list gs://<bucket>"
+      ];
+    case "projects":
+    default:
+      return [
+        `${gcloud} auth list`,
+        `${gcloud} config list`,
+        `${gcloud} projects describe ${shellQuote(input.projectId || "PROJECT_ID")}`
+      ];
+  }
+}
+
+function gcpReadonlyAccessPlan(input) {
+  const normalized = normalizeInput(input);
+  return JSON.stringify({
+    mode: "atomic-helper",
+    platform: "gcp",
+    accessPattern: "readonly-cli",
+    target: {
+      projectId: normalized.projectId,
+      account: normalized.account,
+      region: normalized.region,
+      zone: normalized.zone,
+      service: normalized.service,
+      resource: normalized.resource
+    },
+    credentialBoundary: [
+      "Use an already-approved local gcloud identity; this tool does not run gcloud auth login or read credential files.",
+      "Run auth list/config list first and verify the active account and project match incident evidence.",
+      "Do not change active config, impersonation, IAM policy, project settings, buckets, clusters, instances, or logs."
+    ],
+    commands: {
+      identity: [
+        `${baseGcloud(normalized)} auth list`,
+        `${baseGcloud(normalized)} config list`
+      ],
+      serviceReads: serviceCommands(normalized)
+    },
+    forbiddenActions: [
+      "gcloud auth login",
+      "gcloud config set",
+      "gcloud projects set-iam-policy",
+      "gcloud iam service-accounts keys create",
+      "gcloud compute instances start",
+      "gcloud compute instances stop",
+      "gcloud container clusters update",
+      "gcloud storage cp",
+      "gcloud storage rm",
+      "gcloud storage mv"
+    ],
+    remoteWrite: "not_executed"
+  }, null, 2);
+}
+
+export default defineReadOnlyTool({
+  name: "gcp_readonly_command_pack",
+  description: "Create a local-only GCP read-only CLI command pack; does not authenticate, read credentials, or call GCP APIs.",
+  inputSchema: {
+    projectId: z.string().trim().max(256).default(""),
+    account: z.string().trim().max(256).default(""),
+    region: z.string().trim().max(64).default(DEFAULT_REGION),
+    zone: z.string().trim().max(64).default(""),
+    service: z.string().trim().max(64).default("projects"),
+    resource: z.string().trim().max(2048).default("")
+  },
+  async handler(input) {
+    try {
+      return ok(gcpReadonlyAccessPlan(input));
+    } catch (error) {
+      return fail(error);
+    }
+  }
+});
+
+export const __test = {
+  READ_ONLY_SERVICES,
+  normalizeInput,
+  serviceCommands,
+  gcpReadonlyAccessPlan
+};