@rulebricks/cli 2.0.5 → 2.1.0

package/dist/lib/cloudCli.js

@@ -128,27 +128,47 @@ export async function listS3Buckets() {
     }
 }
 /**
- * Static fallback for AWS regions
+ * Static fallback for AWS regions (c8g Graviton4 ARM64 available or expected)
  */
 function getStaticAwsRegions() {
     return [
+        // US regions (c8g Graviton4 available)
         "us-east-1",
         "us-east-2",
         "us-west-1",
         "us-west-2",
-        "ap-south-1",
-        "ap-northeast-1",
-        "ap-northeast-2",
-        "ap-northeast-3",
-        "ap-southeast-1",
-        "ap-southeast-2",
+        // Canada
         "ca-central-1",
-        "eu-central-1",
+        "ca-west-1",
+        // Europe (c8g available)
         "eu-west-1",
         "eu-west-2",
         "eu-west-3",
+        "eu-central-1",
+        "eu-central-2",
         "eu-north-1",
+        "eu-south-1",
+        "eu-south-2",
+        // Asia Pacific (c8g available)
+        "ap-northeast-1",
+        "ap-northeast-2",
+        "ap-northeast-3",
+        "ap-southeast-1",
+        "ap-southeast-2",
+        "ap-southeast-3",
+        "ap-southeast-4",
+        "ap-southeast-5",
+        "ap-southeast-7",
+        "ap-south-1",
+        "ap-south-2",
+        "ap-east-1",
+        // South America
         "sa-east-1",
+        // Middle East & Africa
+        "me-south-1",
+        "me-central-1",
+        "af-south-1",
+        "il-central-1",
     ];
 }
 /**
@@ -171,7 +191,12 @@ export async function listEksClusters(region) {
 // GCP CLI (gcloud)
 // ============================================================================
 /**
- * Check if gcloud CLI is installed and authenticated
+ * Check if gcloud CLI is installed and fully authenticated
+ *
+ * For GCP to be considered "authenticated", the user must have:
+ * 1. Logged in with `gcloud auth login`
+ * 2. Set a default project with `gcloud config set project PROJECT_ID`
+ * 3. Configured Application Default Credentials with `gcloud auth application-default login`
  */
 export async function checkGcloudCli() {
     const status = {
@@ -196,16 +221,27 @@ export async function checkGcloudCli() {
             const config = JSON.parse(configResult.stdout);
             const account = config.core?.account;
             const project = config.core?.project;
+            // Step 1: Check if logged in
             if (!account) {
                 status.error = 'Not authenticated - run "gcloud auth login"';
                 return status;
             }
-            status.authenticated = true;
-            status.identity = project ? `Project: ${project}` : `Account: ${account}`;
+            // Step 2: Check if project is set
             if (!project) {
                 status.error =
                     'No default project set - run "gcloud config set project PROJECT_ID"';
+                return status;
             }
+            // Step 3: Check Application Default Credentials
+            const adcResult = await checkGcpApplicationDefaultCredentials();
+            if (!adcResult.configured) {
+                status.error =
+                    'Application Default Credentials not configured - run "gcloud auth application-default login"';
+                return status;
+            }
+            // All checks passed
+            status.authenticated = true;
+            status.identity = `Project: ${project}`;
         }
         catch {
             status.error = "Failed to parse gcloud config";
@@ -229,6 +265,39 @@ export async function getGcpProjectId() {
         return null;
     }
 }
+/**
+ * Check if GCP Application Default Credentials (ADC) are configured
+ * ADC is required for Terraform to authenticate with Google Cloud
+ */
+export async function checkGcpApplicationDefaultCredentials() {
+    try {
+        // Try to get an access token using ADC
+        const result = await execCommand("gcloud auth application-default print-access-token");
+        if (result.stdout && result.stdout.trim().length > 0) {
+            return { configured: true };
+        }
+        return {
+            configured: false,
+            error: "Application Default Credentials not configured",
+        };
+    }
+    catch (error) {
+        const errorMessage = error instanceof Error ? error.message : "Unknown error";
+        // Check if it's specifically an authentication error
+        if (errorMessage.includes("not found") ||
+            errorMessage.includes("not configured") ||
+            errorMessage.includes("Could not automatically determine credentials")) {
+            return {
+                configured: false,
+                error: "Application Default Credentials not configured",
+            };
+        }
+        return {
+            configured: false,
+            error: errorMessage,
+        };
+    }
+}
 /**
  * List available GCP regions
  */
@@ -266,40 +335,33 @@ export async function listGcsBuckets() {
     }
 }
 /**
- * Static fallback for GCP regions
+ * Static fallback for GCP regions (C4A/Google Axion ARM64 confirmed availability)
+ * Only includes regions with full C4A zone coverage for GKE regional clusters
  */
 function getStaticGcpRegions() {
     return [
-        "us-central1",
-        "us-east1",
-        "us-east4",
-        "us-west1",
-        "us-west2",
-        "us-west3",
-        "us-west4",
-        "northamerica-northeast1",
-        "northamerica-northeast2",
-        "southamerica-east1",
-        "southamerica-west1",
-        "europe-central2",
-        "europe-north1",
-        "europe-west1",
-        "europe-west2",
-        "europe-west3",
-        "europe-west4",
-        "europe-west6",
-        "europe-southwest1",
-        "asia-east1",
-        "asia-east2",
-        "asia-northeast1",
-        "asia-northeast2",
-        "asia-northeast3",
-        "asia-south1",
-        "asia-south2",
-        "asia-southeast1",
-        "asia-southeast2",
-        "australia-southeast1",
-        "australia-southeast2",
+        // Tier 1: Full C4A (Google Axion ARM64) availability - 3+ zones confirmed
+        // US regions
+        "us-central1", // C4A in zones a, b, c, f (best availability)
+        "us-east1", // C4A in zones b, c, d
+        "us-east4", // C4A in zones a, b, c
+        "us-west1", // C4A in zones a, b, c
+        "us-west4", // C4A in zones a, b, c
+        // North America
+        "northamerica-south1", // C4A in zones a, b, c (Mexico)
+        // Europe
+        "europe-west1", // C4A in zones b, c, d
+        "europe-west2", // C4A in zones a, b, c
+        "europe-west3", // C4A in zones a, b, c
+        "europe-west4", // C4A in zones a, b, c
+        "europe-north1", // C4A in zones a, b
+        // Asia Pacific
+        "asia-east1", // C4A in zones a, b, c
+        "asia-northeast1", // C4A in zones b, c
+        "asia-south1", // C4A in zones a, b, c
+        "asia-southeast1", // C4A in zones a, b, c
+        // Australia
+        "australia-southeast2", // C4A in zones a, b, c
     ];
 }
 /**
@@ -324,7 +386,13 @@ export async function listGkeClusters(region) {
 // Azure CLI
 // ============================================================================
 /**
- * Check if Azure CLI is installed and authenticated
+ * Check if Azure CLI is installed and fully authenticated
+ *
+ * For Azure to be considered "authenticated", the user must have:
+ * 1. Logged in with `az login`
+ * 2. An active subscription in "Enabled" state
+ * 3. Required resource providers registered (Microsoft.ContainerService, etc.)
+ * 4. Sufficient vCPU quota for at least the small tier (8 cores)
  */
 export async function checkAzureCli() {
     const status = {
@@ -343,22 +411,47 @@ export async function checkAzureCli() {
         // Extract version (e.g., "azure-cli                         2.51.0")
         const versionMatch = versionResult.stdout.match(/azure-cli\s+([\d.]+)/);
         status.version = versionMatch ? versionMatch[1] : undefined;
-        // Check authentication
+        // Step 1: Check authentication and subscription
         const accountResult = await execCommand("az account show --output json");
         if (accountResult.stderr && accountResult.stderr.includes("Please run")) {
             status.error = 'Not authenticated - run "az login"';
             return status;
         }
+        let subscriptionName;
         try {
             const account = JSON.parse(accountResult.stdout);
-            status.authenticated = true;
-            status.identity = account.name
-                ? `Subscription: ${account.name}`
+            subscriptionName = account.name;
+            // Step 2: Check subscription state is Enabled
+            if (account.state !== "Enabled") {
+                status.error = `Subscription "${account.name}" is not enabled (state: ${account.state})`;
+                return status;
+            }
+            status.identity = subscriptionName
+                ? `Subscription: ${subscriptionName}`
                 : undefined;
         }
         catch {
             status.error = "Failed to parse account info";
+            return status;
+        }
+        // Step 3: Check required resource providers are registered
+        const providerCheck = await checkAzureResourceProviders();
+        if (!providerCheck.allRegistered) {
+            status.error =
+                `Resource providers not registered: ${providerCheck.missing.join(", ")}. ` +
+                    `Run: ${providerCheck.missing.map((p) => `az provider register --namespace ${p}`).join(" && ")}`;
+            return status;
+        }
+        // Step 4: Check minimum vCPU quota (small tier = 8 cores)
+        const quotaCheck = await checkAzureVmQuota(AZURE_DEFAULT_QUOTA_CHECK_REGION, AZURE_TIER_CORES.small);
+        if (!quotaCheck.sufficient) {
+            status.error =
+                `Insufficient vCPU quota (${quotaCheck.available}/${quotaCheck.limit} available in ${AZURE_DEFAULT_QUOTA_CHECK_REGION}). ` +
+                    "Request increase at Azure portal > Subscriptions > Usage + quotas";
+            return status;
         }
+        // All checks passed
+        status.authenticated = true;
     }
     catch (error) {
         status.error = error instanceof Error ? error.message : "Unknown error";
@@ -426,42 +519,61 @@ export async function listAzureBlobContainers(storageAccount) {
     }
 }
 /**
- * Static fallback for Azure regions
+ * Static fallback for Azure regions (Dpsv5 ARM64 available or expected)
  */
 function getStaticAzureRegions() {
     return [
+        // US regions (Dpsv5 ARM64 available)
         "eastus",
         "eastus2",
-        "centralus",
-        "northcentralus",
-        "southcentralus",
         "westus",
         "westus2",
         "westus3",
+        "centralus",
+        "northcentralus",
+        "southcentralus",
+        "westcentralus",
+        // Canada
         "canadacentral",
         "canadaeast",
+        // South America
         "brazilsouth",
+        // Europe (Dpsv5 available)
         "northeurope",
         "westeurope",
         "uksouth",
         "ukwest",
         "francecentral",
+        "francesouth",
         "germanywestcentral",
+        "germanynorth",
         "switzerlandnorth",
+        "switzerlandwest",
         "norwayeast",
+        "norwaywest",
+        "swedencentral",
+        "polandcentral",
+        // Asia Pacific
         "eastasia",
         "southeastasia",
         "japaneast",
         "japanwest",
         "koreacentral",
+        "koreasouth",
+        // Australia
         "australiaeast",
         "australiasoutheast",
         "australiacentral",
+        // India
         "centralindia",
         "southindia",
         "westindia",
+        // Middle East & Africa
         "uaenorth",
+        "uaecentral",
         "southafricanorth",
+        "qatarcentral",
+        "israelcentral",
     ];
 }
 /**
@@ -481,6 +593,104 @@ export async function listAksClusters(resourceGroup) {
         return [];
     }
 }
+/**
+ * Required Azure resource providers for AKS deployment
+ */
+const AZURE_REQUIRED_PROVIDERS = [
+    "Microsoft.ContainerService", // For AKS
+    "Microsoft.Network", // For VNets, NSGs
+    "Microsoft.ManagedIdentity", // For managed identities
+    "Microsoft.Compute", // For VMs
+];
+/**
+ * Azure tier to vCPU core requirements mapping
+ */
+export const AZURE_TIER_CORES = {
+    small: 8, // 4 nodes × 2 vCPU
+    medium: 16, // 4 nodes × 4 vCPU
+    large: 40, // 5 nodes × 8 vCPU
+};
+/**
+ * Default region used for baseline quota checks when region is not yet selected
+ */
+const AZURE_DEFAULT_QUOTA_CHECK_REGION = "eastus";
+/**
+ * Check if required Azure resource providers are registered
+ */
+export async function checkAzureResourceProviders() {
+    const missing = [];
+    try {
+        for (const provider of AZURE_REQUIRED_PROVIDERS) {
+            const result = await execCommand(`az provider show --namespace ${provider} --query "registrationState" --output tsv`);
+            const state = result.stdout.trim();
+            if (state !== "Registered") {
+                missing.push(provider);
+            }
+        }
+        return {
+            allRegistered: missing.length === 0,
+            missing,
+        };
+    }
+    catch {
+        // If we can't check, assume they're not registered
+        return {
+            allRegistered: false,
+            missing: AZURE_REQUIRED_PROVIDERS,
+        };
+    }
+}
+/**
+ * Check Azure VM quota for a specific region
+ *
+ * @param region - Azure region to check quota for
+ * @param requiredCores - Number of vCPUs required
+ * @returns Quota check result with availability info
+ */
+export async function checkAzureVmQuota(region, requiredCores) {
+    try {
+        const result = await execCommand(`az vm list-usage --location ${region} --output json`);
+        if (result.stderr && !result.stdout) {
+            return {
+                sufficient: false,
+                available: 0,
+                limit: 0,
+                used: 0,
+                error: "Failed to check VM quota",
+            };
+        }
+        const usageList = JSON.parse(result.stdout);
+        // Find total regional vCPU quota
+        const regionalQuota = usageList.find((u) => u.name.value === "cores" || u.name.localizedValue === "Total Regional vCPUs");
+        if (!regionalQuota) {
+            return {
+                sufficient: false,
+                available: 0,
+                limit: 0,
+                used: 0,
+                error: "Could not find regional vCPU quota",
+            };
+        }
+        const used = regionalQuota.currentValue;
+        const limit = regionalQuota.limit;
+        const available = limit - used;
+        return {
+            sufficient: available >= requiredCores,
+            available,
+            limit,
+            used,
+        };
+    }
+    catch (error) {
+        return {
+            sufficient: false,
+            available: 0,
+            limit: 0,
+            used: 0,
+            error: error instanceof Error ? error.message : "Failed to check VM quota",
+        };
+    }
+}
 // ============================================================================
 // Aggregated Functions
 // ============================================================================
@@ -567,8 +777,16 @@ export const CLI_INSTALL_URLS = {
  */
 export const CLI_LOGIN_COMMANDS = {
     aws: "aws configure",
-    gcp: "gcloud auth login",
-    azure: "az login",
+    gcp: [
+        "gcloud auth login",
+        "gcloud config set project PROJECT_ID",
+        "gcloud auth application-default login",
+    ],
+    azure: [
+        "az login",
+        "az account set --subscription YOUR_SUBSCRIPTION_ID",
+        "az provider register --namespace Microsoft.ContainerService",
+    ],
 };
 /**
  * Check if Terraform is installed

package/dist/lib/helmValues.js

@@ -208,13 +208,24 @@ export async function generateHelmValues(config, options = {}) {
     // Determine if external-dns should be enabled
     const externalDnsEnabled = config.dns.autoManage && isSupportedDnsProvider(config.dns.provider);
     // Determine storage class based on provider
+    // Note: GCP uses "hyperdisk-balanced" because C4A instances only support Hyperdisk (not Persistent Disk)
     const storageClass = config.infrastructure.provider === "aws"
         ? "gp3"
         : config.infrastructure.provider === "gcp"
-            ? "standard"
+            ? "hyperdisk-balanced"
             : config.infrastructure.provider === "azure"
                 ? "managed-premium"
                 : "gp3";
+    // ARM64 tolerations for GKE C4A nodes (and other ARM64 providers)
+    // GKE automatically taints ARM64 nodes with kubernetes.io/arch=arm64:NoSchedule
+    const arm64Tolerations = [
+        {
+            key: "kubernetes.io/arch",
+            operator: "Equal",
+            value: "arm64",
+            effect: "NoSchedule",
+        },
+    ];
     // Build global.supabase configuration
     const supabaseGlobalConfig = config.database.type === "supabase-cloud"
         ? {
@@ -305,6 +316,7 @@ export async function generateHelmValues(config, options = {}) {
                     : {}),
                 replicaCount: tierConfig.appReplicas,
                 resources: tierConfig.appResources,
+                tolerations: arm64Tolerations,
                 // Logging configuration
                 logging: {
                     enabled: true,
@@ -327,6 +339,7 @@ export async function generateHelmValues(config, options = {}) {
                     : {}),
                 replicas: tierConfig.hpsReplicas,
                 resources: tierConfig.hpsResources,
+                tolerations: arm64Tolerations,
                 // HPS Workers with KEDA autoscaling
                 workers: {
                     enabled: true,
@@ -341,6 +354,7 @@ export async function generateHelmValues(config, options = {}) {
                         cpuThreshold: 25,
                     },
                     resources: tierConfig.hpsWorkerResources,
+                    tolerations: arm64Tolerations,
                 },
             },
             // Ingress configuration
@@ -352,6 +366,7 @@ export async function generateHelmValues(config, options = {}) {
             // Redis configuration
             redis: {
                 resources: tierConfig.redisResources,
+                tolerations: arm64Tolerations,
                 persistence: {
                     enabled: true,
                     size: tierConfig.redisPersistenceSize,
@@ -382,6 +397,7 @@ export async function generateHelmValues(config, options = {}) {
             controller: {
                 replicaCount: tierConfig.kafkaReplication,
                 resources: tierConfig.kafkaResources,
+                tolerations: arm64Tolerations,
                 persistence: {
                     enabled: true,
                     size: tierConfig.kafkaStorage,
@@ -410,6 +426,7 @@ export async function generateHelmValues(config, options = {}) {
             ingressClass: {
                 name: "traefik",
             },
+            tolerations: arm64Tolerations,
             autoscaling: {
                 enabled: true,
                 minReplicas: 1,
@@ -450,6 +467,7 @@ export async function generateHelmValues(config, options = {}) {
         // =============================================================================
         keda: {
             enabled: true,
+            tolerations: arm64Tolerations,
             crds: {
                 install: false, // CRDs managed in parent chart
             },
@@ -460,6 +478,13 @@ export async function generateHelmValues(config, options = {}) {
         "cert-manager": {
             enabled: tlsEnabled,
             installCRDs: false, // CRDs managed in parent chart
+            tolerations: arm64Tolerations,
+            webhook: {
+                tolerations: arm64Tolerations,
+            },
+            cainjector: {
+                tolerations: arm64Tolerations,
+            },
         },
         // Cluster Issuer for Let's Encrypt
         clusterIssuer: {
@@ -475,6 +500,7 @@ export async function generateHelmValues(config, options = {}) {
             role: "Stateless-Aggregator",
             replicas: tierConfig.vectorReplicas,
             resources: tierConfig.vectorResources,
+            tolerations: arm64Tolerations,
             service: {
                 enabled: true,
                 ports: [{ name: "api", port: 8686, protocol: "TCP", targetPort: 8686 }],
@@ -527,19 +553,36 @@ export async function generateHelmValues(config, options = {}) {
                     },
                     db: {
                         resources: tierConfig.dbResources,
+                        tolerations: arm64Tolerations,
                         persistence: {
                             enabled: true,
                             size: tierConfig.dbPersistenceSize,
                             storageClassName: storageClass,
                         },
                     },
+                    auth: {
+                        tolerations: arm64Tolerations,
+                    },
+                    rest: {
+                        tolerations: arm64Tolerations,
+                    },
+                    realtime: {
+                        tolerations: arm64Tolerations,
+                    },
+                    meta: {
+                        tolerations: arm64Tolerations,
+                    },
                     kong: {
+                        tolerations: arm64Tolerations,
                         ingress: {
                             enabled: true,
                             className: "traefik",
                             annotations: {},
                         },
                     },
+                    studio: {
+                        tolerations: arm64Tolerations,
+                    },
                 }
                 : {}),
         },
@@ -597,13 +640,14 @@ export async function generateHelmValues(config, options = {}) {
                     : config.infrastructure.provider === "azure"
                         ? "disk.csi.azure.com"
                         : "ebs.csi.aws.com",
-            type: config.infrastructure.provider === "aws"
-                ? "gp3"
+            // Parameters for the StorageClass - must include type for disk provisioning
+            parameters: config.infrastructure.provider === "aws"
+                ? { type: "gp3" }
                 : config.infrastructure.provider === "gcp"
-                    ? "pd-ssd"
+                    ? { type: "hyperdisk-balanced" }
                     : config.infrastructure.provider === "azure"
-                        ? "Premium_LRS"
-                        : "gp3",
+                        ? { skuName: "Premium_LRS" }
+                        : { type: "gp3" },
             fsType: "ext4",
             reclaimPolicy: "Delete",
             volumeBindingMode: "WaitForFirstConsumer",

package/dist/lib/terraform.d.ts

@@ -1,4 +1,4 @@
-import { CloudProvider } from '../types/index.js';
+import { CloudProvider, DeploymentConfig } from '../types/index.js';
 /**
  * Checks if Terraform is installed
  */
@@ -24,7 +24,8 @@ export declare function terraformPlan(deploymentName: string): Promise<void>;
  */
 export declare function terraformApply(deploymentName: string): Promise<void>;
 /**
- * Destroys Terraform infrastructure
+ * Destroys Terraform infrastructure.
+ * Runs init first to ensure .terraform folder exists (handles partial deployments).
  */
 export declare function terraformDestroy(deploymentName: string): Promise<void>;
 /**
@@ -32,9 +33,15 @@ export declare function terraformDestroy(deploymentName: string): Promise<void>;
  */
 export declare function getTerraformOutputs(deploymentName: string): Promise<Record<string, string>>;
 /**
- * Checks if Terraform state exists for a deployment
+ * Checks if Terraform files/state exist for a deployment.
+ * Returns true if the terraform directory contains any terraform files,
+ * not just the state file. This allows destroy to work on partial infrastructure.
  */
 export declare function hasTerraformState(deploymentName: string): Promise<boolean>;
+/**
+ * Generates Terraform variables from deployment configuration
+ */
+export declare function generateTerraformVars(config: DeploymentConfig): Record<string, unknown>;
 /**
  * Updates kubeconfig for the provisioned cluster
  */