@rulebricks/cli 2.1.5 → 2.1.7

package/cluster-setup/azure/main.parameters.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    "clusterName": { "value": "rulebricks-cluster" },
+    "location": { "value": "eastus" },
+    "kubernetesVersion": { "value": "1.34" },
+    "nodeCount": { "value": 4 },
+    "nodeVmSize": { "value": "Standard_D2ps_v5" },
+    "osDiskSizeGB": { "value": 20 },
+    "osDiskType": { "value": "Managed" },
+
+    "rulebricksNamespace": { "value": "rulebricks" },
+    "vectorServiceAccountName": { "value": "vector" },
+    "prometheusServiceAccountName": { "value": "prometheus" },
+    "enableExternalDns": { "value": false },
+    "dnsZoneResourceGroup": { "value": "" },
+    "enableBlobLogging": { "value": false },
+    "loggingStorageAccountName": { "value": "" }
+  }
+}

package/cluster-setup/gcp/README.md

@@ -0,0 +1,172 @@
+# GCP Cluster Setup
+
+Use these commands to create a minimum GKE cluster that can run Rulebricks without using the Rulebricks CLI Terraform flow. GCP does not have an `eksctl`-style cluster YAML or a concise Bicep equivalent; the most familiar native interface is `gcloud`.
+
+## Files
+
+- `check-gke-prereqs.sh` verifies `gcloud` auth, Application Default Credentials, required APIs, selected-region quota, GKE access, `kubectl`, and Helm.
+
+## Core Cluster Parameters
+
+- Cluster name: `rulebricks-cluster` (`Core cluster parameters` block -> `CLUSTER_NAME`)
+- Region / zone: `us-central1` / `us-central1-a` (`Core cluster parameters` block -> `REGION` / `ZONE`)
+- Kubernetes version: `1.34` (`Core cluster parameters` block -> `KUBERNETES_VERSION`)
+- Node count: `4` (`Core cluster parameters` block -> `NODE_COUNT`)
+- Machine type: `c4a-standard-2` (`Core cluster parameters` block -> `MACHINE_TYPE`)
+- Disk size (GB): `20` (`Core cluster parameters` block -> `DISK_SIZE`)
+- Disk type: `hyperdisk-balanced` (`Core cluster parameters` block -> `DISK_TYPE`)
+
+## Check Access
+
+```bash
+gcloud auth login
+gcloud config set project <project-id>
+gcloud auth application-default login
+GCP_REGION=us-central1 bash check-gke-prereqs.sh
+```
+
+If API warnings appear, run the suggested `gcloud services enable` commands and wait for enablement to complete.
+
+## Create The Cluster
+
+Set the core cluster parameters. The default example uses `us-central1-a` because it supports C4A ARM64 nodes.
+
+```bash
+PROJECT_ID="$(gcloud config get-value project)"
+CLUSTER_NAME=rulebricks-cluster
+REGION=us-central1
+ZONE=us-central1-a
+KUBERNETES_VERSION="1.34"
+NODE_COUNT=4
+MACHINE_TYPE=c4a-standard-2
+DISK_SIZE=20
+DISK_TYPE=hyperdisk-balanced
+```
+
+Enable required APIs:
+
+```bash
+gcloud services enable \
+  compute.googleapis.com \
+  container.googleapis.com \
+  iam.googleapis.com \
+  cloudresourcemanager.googleapis.com \
+  --project "$PROJECT_ID"
+```
+
+Create the VPC, subnet, NAT, and internal firewall rule:
+
+```bash
+gcloud compute networks create "${CLUSTER_NAME}-vpc" \
+  --project "$PROJECT_ID" \
+  --subnet-mode custom
+
+gcloud compute networks subnets create "${CLUSTER_NAME}-subnet" \
+  --project "$PROJECT_ID" \
+  --region "$REGION" \
+  --network "${CLUSTER_NAME}-vpc" \
+  --range 10.0.0.0/16 \
+  --secondary-range pods=10.1.0.0/16,services=10.2.0.0/16 \
+  --enable-private-ip-google-access
+
+gcloud compute routers create "${CLUSTER_NAME}-router" \
+  --project "$PROJECT_ID" \
+  --region "$REGION" \
+  --network "${CLUSTER_NAME}-vpc"
+
+gcloud compute routers nats create "${CLUSTER_NAME}-nat" \
+  --project "$PROJECT_ID" \
+  --region "$REGION" \
+  --router "${CLUSTER_NAME}-router" \
+  --auto-allocate-nat-external-ips \
+  --nat-all-subnet-ip-ranges
+
+gcloud compute firewall-rules create "${CLUSTER_NAME}-allow-internal" \
+  --project "$PROJECT_ID" \
+  --network "${CLUSTER_NAME}-vpc" \
+  --allow tcp:0-65535,udp:0-65535,icmp \
+  --source-ranges 10.0.0.0/16,10.1.0.0/16,10.2.0.0/16 \
+  --target-tags "gke-${CLUSTER_NAME}"
+```
+
+Create the GKE cluster:
+
+```bash
+gcloud container clusters create "$CLUSTER_NAME" \
+  --project "$PROJECT_ID" \
+  --region "$REGION" \
+  --node-locations "$ZONE" \
+  --cluster-version "$KUBERNETES_VERSION" \
+  --release-channel regular \
+  --network "${CLUSTER_NAME}-vpc" \
+  --subnetwork "${CLUSTER_NAME}-subnet" \
+  --enable-ip-alias \
+  --cluster-secondary-range-name pods \
+  --services-secondary-range-name services \
+  --enable-private-nodes \
+  --master-ipv4-cidr 172.16.0.0/28 \
+  --enable-master-authorized-networks \
+  --master-authorized-networks 0.0.0.0/0 \
+  --workload-pool "${PROJECT_ID}.svc.id.goog" \
+  --enable-network-policy \
+  --addons HttpLoadBalancing,HorizontalPodAutoscaling,GcePersistentDiskCsiDriver \
+  --node-pool rulebricks-nodes \
+  --machine-type "$MACHINE_TYPE" \
+  --num-nodes "$NODE_COUNT" \
+  --disk-type "$DISK_TYPE" \
+  --disk-size "$DISK_SIZE" \
+  --scopes cloud-platform \
+  --workload-metadata GKE_METADATA \
+  --enable-autorepair \
+  --enable-autoupgrade \
+  --node-labels environment=rulebricks \
+  --tags "gke-${CLUSTER_NAME}"
+```
+
+Configure kubeconfig:
+
+```bash
+gcloud container clusters get-credentials "$CLUSTER_NAME" \
+  --region "$REGION" \
+  --project "$PROJECT_ID"
+```
+
+Use `rulebricks init` with **Use existing Kubernetes cluster** after kubeconfig works.
+
+## Optional Identity Setup
+
+If you use GCS decision-log export, bind the `vector` Kubernetes service account to a Google service account that can write to the bucket:
+
+```bash
+NAMESPACE=rulebricks-demo
+PROJECT_ID="$(gcloud config get-value project)"
+GSA=rulebricks-vector@"$PROJECT_ID".iam.gserviceaccount.com
+
+gcloud iam service-accounts create rulebricks-vector \
+  --project "$PROJECT_ID"
+
+gcloud storage buckets add-iam-policy-binding gs://<bucket-name> \
+  --member "serviceAccount:$GSA" \
+  --role roles/storage.objectCreator
+
+gcloud iam service-accounts add-iam-policy-binding "$GSA" \
+  --project "$PROJECT_ID" \
+  --role roles/iam.workloadIdentityUser \
+  --member "serviceAccount:$PROJECT_ID.svc.id.goog[$NAMESPACE/vector]"
+```
+
+Annotate the service account after the Rulebricks namespace exists:
+
+```bash
+kubectl annotate serviceaccount vector \
+  --namespace "$NAMESPACE" \
+  iam.gke.io/gcp-service-account="$GSA"
+```
+
+Enter the Google service account email when prompted by the CLI.
+
+## Notes
+
+- The example creates four `c4a-standard-2` ARM64 nodes with `hyperdisk-balanced`, matching the minimum CLI Terraform defaults.
+- C4A availability varies by region and zone. If you change `REGION`, choose a `ZONE` where C4A is available.
+- Regional GKE clusters can multiply node counts across node locations. This example pins one node location to keep the minimum cluster shape predictable.

package/cluster-setup/gcp/check-gke-prereqs.sh

@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+PROJECT_ID="${GOOGLE_CLOUD_PROJECT:-$(gcloud config get-value project 2>/dev/null || true)}"
+REGION="${GCP_REGION:-us-central1}"
+REQUIRED_VCPU=8
+REQUIRED_APIS=(
+  compute.googleapis.com
+  container.googleapis.com
+  iam.googleapis.com
+  cloudresourcemanager.googleapis.com
+)
+
+require_cmd() {
+  command -v "$1" >/dev/null 2>&1 || {
+    echo "Missing required command: $1" >&2
+    exit 1
+  }
+}
+
+check_api() {
+  local api="$1"
+  if gcloud services list \
+    --project "$PROJECT_ID" \
+    --enabled \
+    --filter="name:${api}" \
+    --format="value(name)" | awk -v api="$api" '$0 ~ api { found=1 } END { exit found ? 0 : 1 }'; then
+    echo "OK: $api is enabled"
+  else
+    echo "WARN: $api is not enabled. Run: gcloud services enable $api --project $PROJECT_ID"
+  fi
+}
+
+check_quota() {
+  echo "Checking regional CPU quota in $REGION..."
+  local quota_line
+  quota_line="$(gcloud compute regions describe "$REGION" \
+    --project "$PROJECT_ID" \
+    --format="csv[no-heading](quotas.metric,quotas.limit,quotas.usage)" 2>/dev/null \
+    | awk -F, '$1=="CPUS"{print $2 "," $3; exit}' || true)"
+
+  if [[ -z "$quota_line" ]]; then
+    echo "WARN: Could not read regional CPU quota."
+    return
+  fi
+
+  local limit="${quota_line%,*}"
+  local usage="${quota_line#*,}"
+  local available
+  available="$(awk -v limit="$limit" -v usage="$usage" 'BEGIN { printf "%d", limit - usage }')"
+
+  if (( available < REQUIRED_VCPU )); then
+    echo "WARN: ${available}/${limit} CPUs available; ${REQUIRED_VCPU}+ recommended for the included cluster commands."
+  else
+    echo "OK: ${available}/${limit} CPUs available."
+  fi
+}
+
+require_cmd gcloud
+require_cmd kubectl
+require_cmd helm
+require_cmd awk
+
+if [[ -z "$PROJECT_ID" ]]; then
+  echo "No GCP project configured. Run: gcloud config set project PROJECT_ID" >&2
+  exit 1
+fi
+
+echo "Rulebricks GKE prerequisite checks"
+echo "Project: $PROJECT_ID"
+echo "Region: $REGION"
+echo
+
+echo "Checking gcloud account..."
+gcloud auth list --filter=status:ACTIVE --format="value(account)"
+gcloud auth application-default print-access-token >/dev/null
+echo "OK: gcloud auth and Application Default Credentials are available."
+echo
+
+for api in "${REQUIRED_APIS[@]}"; do
+  check_api "$api"
+done
+
+echo
+gcloud compute regions describe "$REGION" --project "$PROJECT_ID" >/dev/null
+echo "OK: region $REGION is accessible."
+gcloud container clusters list --region "$REGION" --project "$PROJECT_ID" >/dev/null
+echo "OK: GKE cluster list access works."
+check_quota
+
+echo
+echo "Checking local Kubernetes tools..."
+kubectl version --client=true >/dev/null
+helm version >/dev/null
+echo "OK: kubectl and Helm are installed."
+
+echo
+echo "GKE prerequisite checks completed. Warnings may require GCP project-admin review before cluster creation."

package/dist/commands/deploy.js

@@ -8,7 +8,7 @@ import { loadDeploymentConfig, loadDeploymentState, saveDeploymentState, updateD
 import { setupTerraformWorkspace, terraformInit, terraformPlan, terraformApply, terraformDestroy, cleanupOrphanedResources, updateKubeconfig, hasTerraformState, isTerraformInstalled, generateTerraformVars, } from "../lib/terraform.js";
 import { checkGcpApplicationDefaultCredentials, checkAzureResourceProviders, checkAzureVmQuota, AZURE_TIER_CORES, } from "../lib/cloudCli.js";
 import { installOrUpgradeChart, upgradeChart, isHelmInstalled, } from "../lib/helm.js";
-import { isKubectlInstalled, checkClusterAccessible, } from "../lib/kubernetes.js";
+import { isKubectlInstalled, checkClusterAccessible, waitForCertificatesReady, } from "../lib/kubernetes.js";
 import { generateHelmValues, updateHelmValuesForTLS, } from "../lib/helmValues.js";
 import { isSupportedDnsProvider, getNamespace, getReleaseName, } from "../types/index.js";
 function DeployCommandInner({ name, skipInfra, skipDns, version, }) {
@@ -20,11 +20,13 @@ function DeployCommandInner({ name, skipInfra, skipDns, version, }) {
     const [useExternalDns, setUseExternalDns] = useState(false);
     const infraStartedRef = useRef(false); // Track if we started infra provisioning (ref for sync access)
     const [cleanupError, setCleanupError] = useState(null);
+    const [tlsWarning, setTlsWarning] = useState(null);
     const [status, setStatus] = useState({
         preflight: "pending",
         infrastructure: "pending",
         kubeconfig: "pending",
         helmInstall: "pending",
+        certCheck: "pending",
         dnsConfig: "pending",
         helmUpgradeTls: "pending",
     });
@@ -83,7 +85,17 @@ function DeployCommandInner({ name, skipInfra, skipDns, version, }) {
             const releaseName = getReleaseName(config.name);
             // Upgrade the chart with TLS enabled
             await upgradeChart(name, { releaseName, namespace, version, wait: true });
-            setStatus((s) => ({ ...s, helmUpgradeTls: "success" }));
+            setStatus((s) => ({ ...s, helmUpgradeTls: "success", certCheck: "running" }));
+            setStep("cert-check");
+            try {
+                await waitForCertificatesReady(namespace);
+                setStatus((s) => ({ ...s, certCheck: "success" }));
+            }
+            catch (certErr) {
+                setStatus((s) => ({ ...s, certCheck: "error" }));
+                setTlsWarning("TLS certificates are still being issued. " +
+                    "HTTPS may not be available yet.");
+            }
             // Update state
             await updateDeploymentStatus(name, "running", {
                 application: {
@@ -113,6 +125,7 @@ function DeployCommandInner({ name, skipInfra, skipDns, version, }) {
             ...s,
             dnsConfig: "skipped",
             helmUpgradeTls: "skipped",
+            certCheck: "skipped",
         }));
         const namespace = getNamespace(config.name);
         // Mark as running without TLS upgrade
@@ -223,7 +236,18 @@ function DeployCommandInner({ name, skipInfra, skipDns, version, }) {
                     helmInstall: "success",
                     dnsConfig: "skipped", // External DNS handles this
                     helmUpgradeTls: "skipped", // TLS enabled from start
+                    certCheck: "running",
                 }));
+                setStep("cert-check");
+                try {
+                    await waitForCertificatesReady(namespace);
+                    setStatus((s) => ({ ...s, certCheck: "success" }));
+                }
+                catch (certErr) {
+                    setStatus((s) => ({ ...s, certCheck: "error" }));
+                    setTlsWarning("TLS certificates are still being issued. " +
+                        "HTTPS may not be available yet.");
+                }
                 // Update state to running
                 await updateDeploymentStatus(name, "running", {
                     application: {
@@ -254,6 +278,7 @@ function DeployCommandInner({ name, skipInfra, skipDns, version, }) {
                         ...s,
                         dnsConfig: "skipped",
                         helmUpgradeTls: "skipped",
+                        certCheck: "skipped",
                     }));
                     await updateDeploymentStatus(name, "waiting-dns", {
                         application: {
@@ -421,7 +446,7 @@ function DeployCommandInner({ name, skipInfra, skipDns, version, }) {
     // Complete screen
     if (step === "complete") {
         const tlsSkipped = status.helmUpgradeTls === "skipped" && !useExternalDns;
-        return (_jsx(BorderBox, { title: "Deployment Complete", children: _jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { color: colors.success, bold: true, children: "\u2713 Rulebricks deployed successfully!" }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsxs(Text, { children: ["URL:", " ", _jsxs(Text, { color: colors.accent, children: ["https://", config?.domain, "/auth/signup"] })] }), useExternalDns && (_jsx(Text, { color: colors.muted, children: "DNS records will be created automatically by external-dns" })), tlsSkipped && (_jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: colors.warning, children: ["\u26A0 TLS not configured. Run `rulebricks deploy ", name, "` again after DNS setup."] }) }))] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Next steps:" }), _jsxs(Text, { color: colors.muted, children: [" ", "\u2022 Visit the URL to complete initial setup"] }), _jsxs(Text, { color: colors.muted, children: [" ", "\u2022 Run `rulebricks status ", name, "` to check deployment health"] }), tlsSkipped && (_jsxs(Text, { color: colors.muted, children: [" ", "\u2022 Configure DNS and re-run deploy for TLS"] }))] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { color: colors.muted, dimColor: true, children: "Tip: If the URL isn't accessible yet, your local DNS may need time to propagate." }), _jsxs(Text, { color: colors.muted, dimColor: true, children: ["Flush DNS cache: ", getDnsFlushCommand()] })] })] }) }));
+        return (_jsx(BorderBox, { title: "Deployment Complete", children: _jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { color: colors.success, bold: true, children: "\u2713 Rulebricks deployed successfully!" }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsxs(Text, { children: ["URL:", " ", _jsxs(Text, { color: colors.accent, children: ["https://", config?.domain, "/auth/signup"] })] }), useExternalDns && (_jsx(Text, { color: colors.muted, children: "DNS records will be created automatically by external-dns" })), tlsSkipped && (_jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: colors.warning, children: ["\u26A0 TLS not configured. Run `rulebricks deploy ", name, "` again after DNS setup."] }) })), tlsWarning && (_jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: colors.warning, children: ["\u26A0 ", tlsWarning] }) }))] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Next steps:" }), _jsxs(Text, { color: colors.muted, children: [" ", "\u2022 Visit the URL to complete initial setup"] }), _jsxs(Text, { color: colors.muted, children: [" ", "\u2022 Run `rulebricks status ", name, "` to check deployment health"] }), tlsSkipped && (_jsxs(Text, { color: colors.muted, children: [" ", "\u2022 Configure DNS and re-run deploy for TLS"] })), tlsWarning && (_jsxs(Text, { color: colors.muted, children: [" ", "\u2022 Run `rulebricks status ", name, "` to check TLS certificate status"] }))] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { color: colors.muted, dimColor: true, children: "Tip: If the URL isn't accessible yet, your local DNS may need time to propagate." }), _jsxs(Text, { color: colors.muted, dimColor: true, children: ["Flush DNS cache: ", getDnsFlushCommand()] })] })] }) }));
     }
     // Progress screen
     const helmInstallLabel = useExternalDns
@@ -435,7 +460,7 @@ function DeployCommandInner({ name, skipInfra, skipDns, version, }) {
                                 ? "Planning changes"
                                 : step === "infra-apply"
                                     ? "Applying infrastructure"
-                                    : undefined }), _jsx(StatusLine, { status: status.kubeconfig, label: "Kubernetes configuration" }), _jsx(StatusLine, { status: status.helmInstall, label: helmInstallLabel }), !useExternalDns && (_jsxs(_Fragment, { children: [_jsx(StatusLine, { status: status.dnsConfig, label: "DNS configuration" }), _jsx(StatusLine, { status: status.helmUpgradeTls, label: "TLS configuration" })] })), step !== "dns-wait" && (_jsx(Box, { marginTop: 1, children: _jsx(Spinner, { label: getStepLabel(step, useExternalDns) }) }))] }) }));
+                                    : undefined }), _jsx(StatusLine, { status: status.kubeconfig, label: "Kubernetes configuration" }), _jsx(StatusLine, { status: status.helmInstall, label: helmInstallLabel }), !useExternalDns && (_jsxs(_Fragment, { children: [_jsx(StatusLine, { status: status.dnsConfig, label: "DNS configuration" }), _jsx(StatusLine, { status: status.helmUpgradeTls, label: "TLS configuration" })] })), _jsx(StatusLine, { status: status.certCheck, label: "TLS certificate verification" }), step !== "dns-wait" && (_jsx(Box, { marginTop: 1, children: _jsx(Spinner, { label: getStepLabel(step, useExternalDns) }) }))] }) }));
 }
 function getDnsFlushCommand() {
     switch (platform()) {
@@ -471,6 +496,8 @@ function getStepLabel(step, useExternalDns) {
             return "Waiting for DNS configuration...";
         case "helm-upgrade-tls":
             return "Enabling TLS certificates...";
+        case "cert-check":
+            return "Verifying TLS certificates...";
         default:
             return "Processing...";
     }

package/dist/commands/init.js

@@ -6,6 +6,7 @@ import { DeploymentModeStep, CloudProviderStep, DomainStep, SMTPStep, DatabaseSt
 import { AppShell, ProgressHeader, ThemeProvider, useTheme, Logo, LOGO_LINES, } from "../components/common/index.js";
 import { saveDeploymentConfig, deploymentExists, loadProfile, updateProfile, extractProfileFromConfig, } from "../lib/config.js";
 import { generateHelmValues } from "../lib/helmValues.js";
+import { inferClusterTier } from "../lib/kubernetes.js";
 const STEP_INFO = {
     mode: { title: "Deployment Mode", description: "Choose how to deploy" },
     cloud: { title: "Cloud Provider", description: "Select your cloud provider" },
@@ -65,7 +66,10 @@ function WizardStepController({ onSaveComplete }) {
         if (state.databaseType === "self-hosted") {
             steps.push("database-creds");
         }
-        steps.push("tier", "features");
+        if (state.infrastructureMode === "provision") {
+            steps.push("tier");
+        }
+        steps.push("features");
         // Feature config only if AI, SSO, monitoring, external logging, or custom emails enabled
         if (state.aiEnabled ||
             state.ssoEnabled ||
@@ -107,7 +111,10 @@ function WizardStepController({ onSaveComplete }) {
         setPendingNav("back");
     }, []);
     const handleSave = useCallback(async () => {
-        const config = toConfig();
+        const inferredTier = state.infrastructureMode === "existing"
+            ? (await inferClusterTier()) || state.tier || "small"
+            : state.tier || undefined;
+        const config = toConfig({ tier: inferredTier });
         if (!config) {
             setError("Invalid configuration - please check all required fields");
             return;

package/dist/components/Wizard/WizardContext.d.ts

@@ -1,5 +1,5 @@
 import React, { ReactNode } from "react";
-import { DeploymentConfig, CloudProvider, DatabaseType, PerformanceTier, SSOProvider, DnsProvider, LoggingSink, EmailSubjects, EmailTemplates, ProfileConfig } from "../../types/index.js";
+import { DeploymentConfig, CloudProvider, DatabaseType, PerformanceTier, SSOProvider, DnsProvider, LoggingSink, CloudLoggingAuthMode, MonitoringDestination, RemoteWriteAuthType, RemoteWriteDestination, EmailSubjects, EmailTemplates, ProfileConfig } from "../../types/index.js";
 export interface WizardState {
     step: number;
     name: string;
@@ -40,10 +40,29 @@ export interface WizardState {
     ssoClientId: string;
     ssoClientSecret: string;
     monitoringEnabled: boolean;
+    prometheusMonitoringDestination: MonitoringDestination | null;
     prometheusRemoteWriteUrl: string;
+    prometheusRemoteWriteDestination: RemoteWriteDestination | null;
+    prometheusRemoteWriteAuthType: RemoteWriteAuthType | null;
+    prometheusRemoteWriteAwsRegion: string;
+    prometheusRemoteWriteAwsRoleArn: string;
+    prometheusRemoteWriteAzureCloud: "AzurePublic" | "AzureChina" | "AzureGovernment";
+    prometheusRemoteWriteClientId: string;
+    prometheusRemoteWriteTenantId: string;
+    prometheusRemoteWriteSecretRef: string;
+    prometheusRemoteWriteUsernameSecretRef: string;
+    prometheusRemoteWritePasswordSecretRef: string;
+    prometheusRemoteWriteBearerTokenSecretRef: string;
     loggingSink: LoggingSink;
     loggingBucket: string;
     loggingRegion: string;
+    loggingCloudAuthMode: CloudLoggingAuthMode;
+    loggingAwsIamRoleArn: string;
+    loggingAzureBlobContainer: string;
+    loggingAzureBlobClientId: string;
+    loggingAzureBlobTenantId: string;
+    loggingAzureBlobConnectionStringSecretRef: string;
+    loggingGcpServiceAccountEmail: string;
     customEmailsEnabled: boolean;
     emailSubjects: EmailSubjects;
     emailTemplates: EmailTemplates;
@@ -127,12 +146,15 @@ type WizardAction = {
 } | {
     type: "SET_PROMETHEUS_REMOTE_WRITE";
     url: string;
+} | {
+    type: "SET_PROMETHEUS_REMOTE_WRITE_CONFIG";
+    config: Partial<Pick<WizardState, "prometheusMonitoringDestination" | "prometheusRemoteWriteDestination" | "prometheusRemoteWriteAuthType" | "prometheusRemoteWriteAwsRegion" | "prometheusRemoteWriteAwsRoleArn" | "prometheusRemoteWriteAzureCloud" | "prometheusRemoteWriteClientId" | "prometheusRemoteWriteTenantId" | "prometheusRemoteWriteSecretRef" | "prometheusRemoteWriteUsernameSecretRef" | "prometheusRemoteWritePasswordSecretRef" | "prometheusRemoteWriteBearerTokenSecretRef">>;
 } | {
     type: "SET_LOGGING_SINK";
     sink: LoggingSink;
 } | {
     type: "SET_LOGGING_CONFIG";
-    config: Partial<Pick<WizardState, "loggingBucket" | "loggingRegion">>;
+    config: Partial<Pick<WizardState, "loggingBucket" | "loggingRegion" | "loggingCloudAuthMode" | "loggingAwsIamRoleArn" | "loggingAzureBlobContainer" | "loggingAzureBlobClientId" | "loggingAzureBlobTenantId" | "loggingAzureBlobConnectionStringSecretRef" | "loggingGcpServiceAccountEmail">>;
 } | {
     type: "SET_CUSTOM_EMAILS_ENABLED";
     enabled: boolean;
@@ -160,7 +182,9 @@ type WizardAction = {
 interface WizardContextValue {
     state: WizardState;
     dispatch: React.Dispatch<WizardAction>;
-    toConfig: () => DeploymentConfig | null;
+    toConfig: (options?: {
+        tier?: PerformanceTier;
+    }) => DeploymentConfig | null;
     skipToStep: (stepId: string) => void;
     profile: ProfileConfig | null;
     /** Suggests a domain based on the profile's domain suffix and deployment name */

package/dist/components/Wizard/WizardContext.js

@@ -55,11 +55,30 @@ function getInitialState(profile) {
         ssoClientSecret: profile?.ssoClientSecret ?? "",
         // Features - Monitoring
         monitoringEnabled: false,
+        prometheusMonitoringDestination: null,
         prometheusRemoteWriteUrl: "",
+        prometheusRemoteWriteDestination: null,
+        prometheusRemoteWriteAuthType: null,
+        prometheusRemoteWriteAwsRegion: "",
+        prometheusRemoteWriteAwsRoleArn: "",
+        prometheusRemoteWriteAzureCloud: "AzurePublic",
+        prometheusRemoteWriteClientId: "",
+        prometheusRemoteWriteTenantId: "",
+        prometheusRemoteWriteSecretRef: "",
+        prometheusRemoteWriteUsernameSecretRef: "",
+        prometheusRemoteWritePasswordSecretRef: "",
+        prometheusRemoteWriteBearerTokenSecretRef: "",
         // Features - Logging
         loggingSink: "console", // Default to console only
         loggingBucket: "",
         loggingRegion: "",
+        loggingCloudAuthMode: "workload-identity",
+        loggingAwsIamRoleArn: "",
+        loggingAzureBlobContainer: "rulebricks-logs",
+        loggingAzureBlobClientId: "",
+        loggingAzureBlobTenantId: "",
+        loggingAzureBlobConnectionStringSecretRef: "",
+        loggingGcpServiceAccountEmail: "",
         // Features - Custom Email Templates
         customEmailsEnabled: false,
         emailSubjects: { ...DEFAULT_EMAIL_SUBJECTS },
@@ -79,6 +98,12 @@ function getInitialState(profile) {
 }
 // Default initial state (for backwards compatibility)
 const initialState = getInitialState();
+function parseSecretKeyRef(value) {
+    const [name, key] = value.split(":").map((part) => part.trim());
+    if (!name || !key)
+        return undefined;
+    return { name, key };
+}
 function wizardReducer(state, action) {
     switch (action.type) {
         case "SET_STEP":
@@ -136,6 +161,8 @@ function wizardReducer(state, action) {
             return { ...state, monitoringEnabled: action.enabled };
         case "SET_PROMETHEUS_REMOTE_WRITE":
             return { ...state, prometheusRemoteWriteUrl: action.url };
+        case "SET_PROMETHEUS_REMOTE_WRITE_CONFIG":
+            return { ...state, ...action.config };
         case "SET_LOGGING_SINK":
             // Reset bucket/region if switching to console
             return {
@@ -183,7 +210,7 @@ export function WizardProvider({ children, initialName, profile, }) {
         ...getInitialState(profile),
         name: initialName || "",
     });
-    const toConfig = () => {
+    const toConfig = (options = {}) => {
         // Validate required fields
         if (!state.name ||
             !state.domain ||
@@ -216,6 +243,45 @@ export function WizardProvider({ children, initialName, profile, }) {
         if (state.loggingSink !== "console" && !state.loggingBucket) {
             return null;
         }
+        if (state.loggingSink === "azure-blob" &&
+            (!state.loggingAzureBlobContainer ||
+                (state.loggingCloudAuthMode === "workload-identity" &&
+                    (!state.loggingAzureBlobClientId || !state.loggingAzureBlobTenantId)) ||
+                (state.loggingCloudAuthMode === "secret" &&
+                    !parseSecretKeyRef(state.loggingAzureBlobConnectionStringSecretRef)))) {
+            return null;
+        }
+        if (state.loggingSink === "s3" && !state.loggingAwsIamRoleArn) {
+            return null;
+        }
+        if (state.loggingSink === "gcs" && !state.loggingGcpServiceAccountEmail) {
+            return null;
+        }
+        const remoteWrite = state.monitoringEnabled &&
+            state.prometheusMonitoringDestination !== "local-grafana" &&
+            state.prometheusRemoteWriteDestination &&
+            state.prometheusRemoteWriteUrl
+            ? {
+                destination: state.prometheusRemoteWriteDestination,
+                url: state.prometheusRemoteWriteUrl,
+                authType: state.prometheusRemoteWriteAuthType || undefined,
+                awsRegion: state.prometheusRemoteWriteDestination === "aws-amp"
+                    ? state.prometheusRemoteWriteAwsRegion ||
+                        state.region ||
+                        undefined
+                    : undefined,
+                awsRoleArn: state.prometheusRemoteWriteDestination === "aws-amp"
+                    ? state.prometheusRemoteWriteAwsRoleArn || undefined
+                    : undefined,
+                azureCloud: state.prometheusRemoteWriteAzureCloud,
+                clientId: state.prometheusRemoteWriteClientId || undefined,
+                tenantId: state.prometheusRemoteWriteTenantId || undefined,
+                clientSecretRef: parseSecretKeyRef(state.prometheusRemoteWriteSecretRef),
+                usernameSecretRef: parseSecretKeyRef(state.prometheusRemoteWriteUsernameSecretRef),
+                passwordSecretRef: parseSecretKeyRef(state.prometheusRemoteWritePasswordSecretRef),
+                bearerTokenSecretRef: parseSecretKeyRef(state.prometheusRemoteWriteBearerTokenSecretRef),
+            }
+            : undefined;
         return {
             name: state.name,
             infrastructure: {
@@ -254,7 +320,7 @@ export function WizardProvider({ children, initialName, profile, }) {
                 supabaseDashboardUser: state.supabaseDashboardUser || undefined,
                 supabaseDashboardPass: state.supabaseDashboardPass || undefined,
             },
-            tier: state.tier || "small",
+            tier: options.tier || state.tier || "small",
             features: {
                 ai: {
                     enabled: state.aiEnabled,
@@ -269,12 +335,39 @@ export function WizardProvider({ children, initialName, profile, }) {
                 },
                 monitoring: {
                     enabled: state.monitoringEnabled,
+                    destination: state.prometheusMonitoringDestination ||
+                        remoteWrite?.destination ||
+                        undefined,
                     remoteWriteUrl: state.prometheusRemoteWriteUrl || undefined,
+                    remoteWrite,
                 },
                 logging: {
                     sink: state.loggingSink,
                     bucket: state.loggingBucket || undefined,
                     region: state.loggingRegion || undefined,
+                    cloudAuthMode: state.loggingSink === "s3" ||
+                        state.loggingSink === "azure-blob" ||
+                        state.loggingSink === "gcs"
+                        ? state.loggingCloudAuthMode
+                        : undefined,
+                    awsIamRoleArn: state.loggingSink === "s3"
+                        ? state.loggingAwsIamRoleArn || undefined
+                        : undefined,
+                    azureBlobContainer: state.loggingSink === "azure-blob"
+                        ? state.loggingAzureBlobContainer || undefined
+                        : undefined,
+                    azureBlobClientId: state.loggingSink === "azure-blob"
+                        ? state.loggingAzureBlobClientId || undefined
+                        : undefined,
+                    azureBlobTenantId: state.loggingSink === "azure-blob"
+                        ? state.loggingAzureBlobTenantId || undefined
+                        : undefined,
+                    azureBlobConnectionStringSecretRef: state.loggingSink === "azure-blob"
+                        ? parseSecretKeyRef(state.loggingAzureBlobConnectionStringSecretRef)
+                        : undefined,
+                    gcpServiceAccountEmail: state.loggingSink === "gcs"
+                        ? state.loggingGcpServiceAccountEmail || undefined
+                        : undefined,
                 },
                 customEmails: state.customEmailsEnabled
                     ? {