@rulebricks/cli 2.1.6 → 2.3.1

package/dist/lib/cloudCli.js

@@ -2,11 +2,12 @@
  * Cloud CLI detection and dynamic resource listing
  *
  * Detects installed cloud CLIs (AWS, GCP, Azure), checks authentication status,
- * and provides functions to list regions and buckets dynamically.
+ * and provides functions to list regions, clusters, and storage dynamically.
  */
 import { exec } from "child_process";
 import { promisify } from "util";
 import { CLOUD_REGIONS } from "../types/index.js";
+import { approveCloudCommandOrThrow } from "./commandApproval.js";
 const execAsync = promisify(exec);
 // Timeout for CLI commands (in ms)
 const CLI_TIMEOUT = 15000;
@@ -23,11 +24,17 @@ function sortRegionsByPriority(regions, provider) {
     const otherRegions = regions.filter((r) => !prioritySet.has(r)).sort();
     return [...priorityRegions, ...otherRegions];
 }
-/**
- * Execute a CLI command with timeout
- */
-async function execCommand(command, timeout = CLI_TIMEOUT) {
+async function execCommand(command, options = {}) {
+    const opts = typeof options === "number" ? { timeout: options } : options;
+    const timeout = opts.timeout ?? CLI_TIMEOUT;
     try {
+        await approveCloudCommandOrThrow({
+            intent: opts.intent ?? inferCommandIntent(command),
+            command,
+            description: opts.description,
+            provider: opts.provider ?? inferProvider(command),
+            mutating: opts.mutating,
+        });
         const result = await execAsync(command, { timeout });
         return result;
     }
@@ -43,6 +50,53 @@ async function execCommand(command, timeout = CLI_TIMEOUT) {
         throw error;
     }
 }
+function inferProvider(command) {
+    if (command.startsWith("aws "))
+        return "aws";
+    if (command.startsWith("gcloud "))
+        return "gcp";
+    if (command.startsWith("az "))
+        return "azure";
+    return undefined;
+}
+function inferCommandIntent(command) {
+    if (command.includes("--version") ||
+        command.includes("get-caller-identity") ||
+        command.includes("gcloud config list") ||
+        command.includes("az account show")) {
+        return "Detect cloud CLIs";
+    }
+    if (command.includes("describe-regions") ||
+        command.includes("compute regions list") ||
+        command.includes("list-locations")) {
+        return "List available regions";
+    }
+    if (command.includes("eks list-clusters") ||
+        command.includes("eks describe-cluster") ||
+        command.includes("container clusters list") ||
+        command.includes("az aks list")) {
+        return "Discover clusters";
+    }
+    if (command.includes("update-kubeconfig") ||
+        command.includes("get-credentials")) {
+        return "Refresh kubeconfig";
+    }
+    if (command.includes("s3api") ||
+        command.includes("storage buckets") ||
+        command.includes("storage account") ||
+        command.includes("storage container")) {
+        return "Discover storage resources";
+    }
+    if (command.includes("iam list-roles") ||
+        command.includes("service-accounts list") ||
+        command.includes("identity list")) {
+        return "List workload identities";
+    }
+    if (command.includes("amp ") || command.includes("monitor data-collection")) {
+        return "Discover monitoring destinations";
+    }
+    return "Run cloud CLI command";
+}
 // ============================================================================
 // AWS CLI
 // ============================================================================
@@ -128,11 +182,11 @@ export async function listS3Buckets() {
     }
 }
 /**
- * Static fallback for AWS regions (c8g Graviton4 ARM64 available or expected)
+ * Static fallback for common AWS regions.
  */
 function getStaticAwsRegions() {
     return [
-        // US regions (c8g Graviton4 available)
+        // US regions
         "us-east-1",
         "us-east-2",
         "us-west-1",
@@ -140,7 +194,7 @@ function getStaticAwsRegions() {
         // Canada
         "ca-central-1",
         "ca-west-1",
-        // Europe (c8g available)
+        // Europe
         "eu-west-1",
         "eu-west-2",
         "eu-west-3",
@@ -149,7 +203,7 @@ function getStaticAwsRegions() {
         "eu-north-1",
         "eu-south-1",
         "eu-south-2",
-        // Asia Pacific (c8g available)
+        // Asia Pacific
         "ap-northeast-1",
         "ap-northeast-2",
         "ap-northeast-3",
@@ -176,7 +230,10 @@ function getStaticAwsRegions() {
  */
 export async function listEksClusters(region) {
     try {
-        const result = await execCommand(`aws eks list-clusters --region ${region} --output json`);
+        const result = await execCommand(`aws eks list-clusters --region ${region} --output json`, {
+            intent: `Discover clusters in ${region}`,
+            provider: "aws",
+        });
         if (result.stderr && !result.stdout) {
             return [];
         }
@@ -187,16 +244,135 @@ export async function listEksClusters(region) {
         return [];
     }
 }
+/**
+ * Best-effort preflight for an external AWS Aurora Postgres cluster: Supabase
+ * Realtime needs logical replication (wal_level=logical), which on Aurora is the
+ * STATIC cluster parameter rds.logical_replication - it lives in a custom DB
+ * cluster parameter group and needs a reboot, so bootstrap.sql can't set it and
+ * Realtime crashloops without it. Parses the cluster id + region from the writer
+ * endpoint and reads the attached parameter group. Fails OPEN ("unknown") on any
+ * ambiguity (non-Aurora host, denied describe, unexpected value) so it never
+ * blocks a deploy spuriously.
+ */
+export async function checkAuroraLogicalReplication(host, fallbackRegion) {
+    // <cluster>.cluster[-ro]-<hash>.<region>.rds.amazonaws.com
+    const match = /^([^.]+)\.cluster(?:-ro)?-[^.]+\.([^.]+)\.rds\.amazonaws\.com$/i.exec(host.trim());
+    if (!match)
+        return { status: "unknown" };
+    const clusterId = match[1];
+    const region = match[2] || fallbackRegion;
+    if (!region)
+        return { status: "unknown" };
+    try {
+        const pgRes = await execCommand(`aws rds describe-db-clusters --db-cluster-identifier ${clusterId} ` +
+            `--region ${region} --query "DBClusters[0].DBClusterParameterGroup" --output text`, {
+            intent: `Check Aurora logical replication (${clusterId})`,
+            provider: "aws",
+        });
+        const parameterGroup = pgRes.stdout.trim();
+        if (!parameterGroup || parameterGroup === "None") {
+            return { status: "unknown" };
+        }
+        const valRes = await execCommand(`aws rds describe-db-cluster-parameters ` +
+            `--db-cluster-parameter-group-name ${parameterGroup} --region ${region} ` +
+            `--query "Parameters[?ParameterName=='rds.logical_replication'].ParameterValue | [0]" ` +
+            `--output text`, { intent: "Read rds.logical_replication", provider: "aws" });
+        const value = valRes.stdout.trim();
+        if (value === "1")
+            return { status: "enabled", parameterGroup };
+        if (value === "0" || value === "" || value === "None") {
+            return { status: "disabled", parameterGroup };
+        }
+        return { status: "unknown", parameterGroup };
+    }
+    catch {
+        return { status: "unknown" };
+    }
+}
+async function describeEksCluster(name, region) {
+    try {
+        const result = await execCommand(`aws eks describe-cluster --name ${name} --region ${region} --query "cluster.{name:name,status:status,version:version}" --output json`, {
+            intent: `Discover clusters in ${region}`,
+            provider: "aws",
+        });
+        if (result.stderr && !result.stdout) {
+            return null;
+        }
+        const cluster = JSON.parse(result.stdout);
+        if (cluster.status !== "ACTIVE") {
+            return null;
+        }
+        return {
+            provider: "aws",
+            name: cluster.name,
+            region,
+            status: cluster.status,
+            version: cluster.version,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * List EKS clusters across all accessible AWS regions.
+ */
+export async function listAllEksClusters() {
+    const regions = await listAwsRegions();
+    const clustersByRegion = await Promise.all(regions.map(async (region) => {
+        const names = await listEksClusters(region);
+        return Promise.all(names.map((name) => describeEksCluster(name, region)));
+    }));
+    return clustersByRegion
+        .flat()
+        .filter((cluster) => cluster !== null)
+        .sort((a, b) => a.region.localeCompare(b.region) || a.name.localeCompare(b.name));
+}
+/**
+ * Discover active EKS clusters in one region.
+ */
+export async function discoverEksClustersInRegion(region) {
+    const names = await listEksClusters(region);
+    const clusters = await Promise.all(names.map((name) => describeEksCluster(name, region)));
+    return clusters
+        .filter((cluster) => cluster !== null)
+        .sort((a, b) => a.name.localeCompare(b.name));
+}
+/**
+ * List IAM roles for selection (e.g. IRSA roles for S3 / AMP). Returns an empty
+ * list on any failure so callers can fall back to manual entry.
+ */
+export async function listIamRoles() {
+    try {
+        const result = await execCommand('aws iam list-roles --query "Roles[].{name:RoleName,arn:Arn}" --output json');
+        if (result.stderr && !result.stdout) {
+            return [];
+        }
+        const roles = JSON.parse(result.stdout);
+        return roles.sort((a, b) => a.name.localeCompare(b.name));
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Get the active AWS account ID (useful for constructing/validating ARNs).
+ */
+export async function getAwsAccountId() {
+    try {
+        const result = await execCommand("aws sts get-caller-identity --query Account --output text");
+        const accountId = result.stdout.trim();
+        return accountId || null;
+    }
+    catch {
+        return null;
+    }
+}
 // ============================================================================
 // GCP CLI (gcloud)
 // ============================================================================
 /**
- * Check if gcloud CLI is installed and fully authenticated
- *
- * For GCP to be considered "authenticated", the user must have:
- * 1. Logged in with `gcloud auth login`
- * 2. Set a default project with `gcloud config set project PROJECT_ID`
- * 3. Configured Application Default Credentials with `gcloud auth application-default login`
+ * Check if gcloud CLI is installed and authenticated enough to list clusters.
  */
 export async function checkGcloudCli() {
     const status = {
@@ -221,25 +397,15 @@ export async function checkGcloudCli() {
             const config = JSON.parse(configResult.stdout);
             const account = config.core?.account;
             const project = config.core?.project;
-            // Step 1: Check if logged in
             if (!account) {
                 status.error = 'Not authenticated - run "gcloud auth login"';
                 return status;
             }
-            // Step 2: Check if project is set
             if (!project) {
                 status.error =
                     'No default project set - run "gcloud config set project PROJECT_ID"';
                 return status;
             }
-            // Step 3: Check Application Default Credentials
-            const adcResult = await checkGcpApplicationDefaultCredentials();
-            if (!adcResult.configured) {
-                status.error =
-                    'Application Default Credentials not configured - run "gcloud auth application-default login"';
-                return status;
-            }
-            // All checks passed
             status.authenticated = true;
             status.identity = `Project: ${project}`;
         }
@@ -265,39 +431,6 @@ export async function getGcpProjectId() {
         return null;
     }
 }
-/**
- * Check if GCP Application Default Credentials (ADC) are configured
- * ADC is required for Terraform to authenticate with Google Cloud
- */
-export async function checkGcpApplicationDefaultCredentials() {
-    try {
-        // Try to get an access token using ADC
-        const result = await execCommand("gcloud auth application-default print-access-token");
-        if (result.stdout && result.stdout.trim().length > 0) {
-            return { configured: true };
-        }
-        return {
-            configured: false,
-            error: "Application Default Credentials not configured",
-        };
-    }
-    catch (error) {
-        const errorMessage = error instanceof Error ? error.message : "Unknown error";
-        // Check if it's specifically an authentication error
-        if (errorMessage.includes("not found") ||
-            errorMessage.includes("not configured") ||
-            errorMessage.includes("Could not automatically determine credentials")) {
-            return {
-                configured: false,
-                error: "Application Default Credentials not configured",
-            };
-        }
-        return {
-            configured: false,
-            error: errorMessage,
-        };
-    }
-}
 /**
  * List available GCP regions
  */
@@ -335,33 +468,53 @@ export async function listGcsBuckets() {
     }
 }
 /**
- * Static fallback for GCP regions (C4A/Google Axion ARM64 confirmed availability)
- * Only includes regions with full C4A zone coverage for GKE regional clusters
+ * List GCP service accounts for selection (e.g. for GKE Workload Identity).
+ * Returns an empty list on any failure so callers can fall back to manual entry.
+ */
+export async function listGcpServiceAccounts() {
+    try {
+        const result = await execCommand('gcloud iam service-accounts list --format="json(email,displayName)"');
+        if (result.stderr && !result.stdout) {
+            return [];
+        }
+        const accounts = JSON.parse(result.stdout);
+        return accounts
+            .map((account) => ({
+            email: account.email,
+            displayName: account.displayName,
+        }))
+            .sort((a, b) => a.email.localeCompare(b.email));
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Static fallback for common GCP regions.
  */
 function getStaticGcpRegions() {
     return [
-        // Tier 1: Full C4A (Google Axion ARM64) availability - 3+ zones confirmed
         // US regions
-        "us-central1", // C4A in zones a, b, c, f (best availability)
-        "us-east1", // C4A in zones b, c, d
-        "us-east4", // C4A in zones a, b, c
-        "us-west1", // C4A in zones a, b, c
-        "us-west4", // C4A in zones a, b, c
+        "us-central1",
+        "us-east1",
+        "us-east4",
+        "us-west1",
+        "us-west4",
         // North America
-        "northamerica-south1", // C4A in zones a, b, c (Mexico)
+        "northamerica-south1",
         // Europe
-        "europe-west1", // C4A in zones b, c, d
-        "europe-west2", // C4A in zones a, b, c
-        "europe-west3", // C4A in zones a, b, c
-        "europe-west4", // C4A in zones a, b, c
-        "europe-north1", // C4A in zones a, b
+        "europe-west1",
+        "europe-west2",
+        "europe-west3",
+        "europe-west4",
+        "europe-north1",
         // Asia Pacific
-        "asia-east1", // C4A in zones a, b, c
-        "asia-northeast1", // C4A in zones b, c
-        "asia-south1", // C4A in zones a, b, c
-        "asia-southeast1", // C4A in zones a, b, c
+        "asia-east1",
+        "asia-northeast1",
+        "asia-south1",
+        "asia-southeast1",
         // Australia
-        "australia-southeast2", // C4A in zones a, b, c
+        "australia-southeast2",
     ];
 }
 /**
@@ -371,7 +524,10 @@ function getStaticGcpRegions() {
 export async function listGkeClusters(region) {
     try {
         // List clusters in the specified region (includes both regional and zonal clusters in that region)
-        const result = await execCommand(`gcloud container clusters list --region ${region} --format="json(name)" 2>/dev/null || gcloud container clusters list --filter="location~^${region}" --format="json(name)"`);
+        const result = await execCommand(`gcloud container clusters list --region ${region} --format="json(name)" 2>/dev/null || gcloud container clusters list --filter="location~^${region}" --format="json(name)"`, {
+            intent: `Discover clusters in ${region}`,
+            provider: "gcp",
+        });
         if (result.stderr && !result.stdout) {
             return [];
         }
@@ -382,17 +538,70 @@ export async function listGkeClusters(region) {
         return [];
     }
 }
+/**
+ * List GKE clusters across the active GCP project.
+ */
+export async function listAllGkeClusters() {
+    const projectId = await getGcpProjectId();
+    try {
+        const result = await execCommand('gcloud container clusters list --format="json(name,location,status,currentMasterVersion,currentNodeCount)"');
+        if (result.stderr && !result.stdout) {
+            return [];
+        }
+        const clusters = JSON.parse(result.stdout);
+        return clusters
+            .filter((cluster) => cluster.status === "RUNNING")
+            .map((cluster) => ({
+            provider: "gcp",
+            name: cluster.name,
+            region: cluster.location,
+            projectId: projectId || undefined,
+            status: cluster.status,
+            version: cluster.currentMasterVersion,
+            nodeCount: cluster.currentNodeCount,
+        }))
+            .sort((a, b) => a.region.localeCompare(b.region) || a.name.localeCompare(b.name));
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Discover running GKE clusters in a selected region/location.
+ */
+export async function discoverGkeClustersInRegion(region) {
+    const projectId = await getGcpProjectId();
+    try {
+        const result = await execCommand(`gcloud container clusters list --region ${region} --format="json(name,location,status,currentMasterVersion,currentNodeCount)" 2>/dev/null || gcloud container clusters list --filter="location~^${region}" --format="json(name,location,status,currentMasterVersion,currentNodeCount)"`, {
+            intent: `Discover clusters in ${region}`,
+            provider: "gcp",
+        });
+        if (result.stderr && !result.stdout) {
+            return [];
+        }
+        const clusters = JSON.parse(result.stdout);
+        return clusters
+            .filter((cluster) => cluster.status === "RUNNING")
+            .map((cluster) => ({
+            provider: "gcp",
+            name: cluster.name,
+            region: cluster.location,
+            projectId: projectId || undefined,
+            status: cluster.status,
+            version: cluster.currentMasterVersion,
+            nodeCount: cluster.currentNodeCount,
+        }))
+            .sort((a, b) => a.name.localeCompare(b.name));
+    }
+    catch {
+        return [];
+    }
+}
 // ============================================================================
 // Azure CLI
 // ============================================================================
 /**
- * Check if Azure CLI is installed and fully authenticated
- *
- * For Azure to be considered "authenticated", the user must have:
- * 1. Logged in with `az login`
- * 2. An active subscription in "Enabled" state
- * 3. Required resource providers registered (Microsoft.ContainerService, etc.)
- * 4. Sufficient vCPU quota for at least the small tier (8 cores)
+ * Check if Azure CLI is installed and authenticated enough to list clusters.
  */
 export async function checkAzureCli() {
     const status = {
@@ -411,7 +620,6 @@ export async function checkAzureCli() {
         // Extract version (e.g., "azure-cli                         2.51.0")
         const versionMatch = versionResult.stdout.match(/azure-cli\s+([\d.]+)/);
         status.version = versionMatch ? versionMatch[1] : undefined;
-        // Step 1: Check authentication and subscription
         const accountResult = await execCommand("az account show --output json");
         if (accountResult.stderr && accountResult.stderr.includes("Please run")) {
             status.error = 'Not authenticated - run "az login"';
@@ -421,7 +629,6 @@ export async function checkAzureCli() {
         try {
             const account = JSON.parse(accountResult.stdout);
             subscriptionName = account.name;
-            // Step 2: Check subscription state is Enabled
             if (account.state !== "Enabled") {
                 status.error = `Subscription "${account.name}" is not enabled (state: ${account.state})`;
                 return status;
@@ -434,23 +641,6 @@ export async function checkAzureCli() {
             status.error = "Failed to parse account info";
             return status;
         }
-        // Step 3: Check required resource providers are registered
-        const providerCheck = await checkAzureResourceProviders();
-        if (!providerCheck.allRegistered) {
-            status.error =
-                `Resource providers not registered: ${providerCheck.missing.join(", ")}. ` +
-                    `Run: ${providerCheck.missing.map((p) => `az provider register --namespace ${p}`).join(" && ")}`;
-            return status;
-        }
-        // Step 4: Check minimum vCPU quota (small tier = 8 cores)
-        const quotaCheck = await checkAzureVmQuota(AZURE_DEFAULT_QUOTA_CHECK_REGION, AZURE_TIER_CORES.small);
-        if (!quotaCheck.sufficient) {
-            status.error =
-                `Insufficient vCPU quota (${quotaCheck.available}/${quotaCheck.limit} available in ${AZURE_DEFAULT_QUOTA_CHECK_REGION}). ` +
-                    "Request increase at Azure portal > Subscriptions > Usage + quotas";
-            return status;
-        }
-        // All checks passed
         status.authenticated = true;
     }
     catch (error) {
@@ -470,6 +660,99 @@ export async function getAzureSubscriptionId() {
         return null;
     }
 }
+/**
+ * Get the active Azure tenant ID. Used to auto-fill workload-identity tenant
+ * fields so users don't have to look it up manually.
+ */
+export async function getAzureTenantId() {
+    try {
+        const result = await execCommand("az account show --query tenantId --output tsv");
+        return result.stdout.trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * List Azure user-assigned managed identities for selection (workload identity
+ * client IDs). Returns an empty list on any failure so callers can fall back to
+ * manual entry.
+ */
+export async function listAzureManagedIdentities() {
+    try {
+        const result = await execCommand('az identity list --query "[].{name:name,clientId:clientId,resourceGroup:resourceGroup}" --output json');
+        if (result.stderr && !result.stdout) {
+            return [];
+        }
+        const identities = JSON.parse(result.stdout);
+        return identities.sort((a, b) => a.name.localeCompare(b.name));
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Discovers Azure Monitor Prometheus remote_write targets: every Data Collection
+ * Rule that ingests the Microsoft-PrometheusMetrics stream, paired with its Data
+ * Collection Endpoint's metrics-ingestion endpoint, assembled into the exact
+ * remote_write URL. Works for any DCR the caller can see (not just ones we made).
+ */
+export async function listAzurePrometheusTargets() {
+    try {
+        const dceResult = await execCommand('az monitor data-collection endpoint list --query "[].{id:id,endpoint:metricsIngestion.endpoint}" --output json');
+        const dces = JSON.parse(dceResult.stdout || "[]");
+        const endpointById = new Map();
+        for (const dce of dces) {
+            if (dce.id && dce.endpoint) {
+                endpointById.set(dce.id.toLowerCase(), dce.endpoint);
+            }
+        }
+        const dcrResult = await execCommand('az monitor data-collection rule list --query "[].{name:name,immutableId:immutableId,dce:dataCollectionEndpointId,streams:dataFlows[].streams[]}" --output json');
+        const dcrs = JSON.parse(dcrResult.stdout || "[]");
+        const targets = [];
+        for (const dcr of dcrs) {
+            if (!dcr.immutableId || !dcr.dce)
+                continue;
+            if (!(dcr.streams || []).includes("Microsoft-PrometheusMetrics"))
+                continue;
+            const endpoint = endpointById.get(dcr.dce.toLowerCase());
+            if (!endpoint)
+                continue;
+            const url = `${endpoint.replace(/\/+$/, "")}/dataCollectionRules/${dcr.immutableId}/streams/Microsoft-PrometheusMetrics/api/v1/write?api-version=2023-04-24`;
+            targets.push({ name: dcr.name, url });
+        }
+        return targets.sort((a, b) => a.name.localeCompare(b.name));
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Discovers AWS Managed Prometheus (AMP) workspaces in a region and assembles the
+ * remote_write URL (<prometheusEndpoint>api/v1/remote_write) for each.
+ */
+export async function listAwsPrometheusWorkspaces(region) {
+    try {
+        const listResult = await execCommand(`aws amp list-workspaces --region ${region} --query "workspaces[].{id:workspaceId,alias:alias}" --output json`);
+        const workspaces = JSON.parse(listResult.stdout || "[]");
+        const targets = [];
+        for (const ws of workspaces) {
+            const descResult = await execCommand(`aws amp describe-workspace --workspace-id ${ws.id} --region ${region} --query "workspace.prometheusEndpoint" --output text`);
+            const endpoint = descResult.stdout.trim();
+            if (!endpoint || endpoint === "None")
+                continue;
+            const url = `${endpoint.replace(/\/+$/, "")}/api/v1/remote_write`;
+            targets.push({
+                name: ws.alias ? `${ws.alias} (${ws.id})` : ws.id,
+                url,
+            });
+        }
+        return targets.sort((a, b) => a.name.localeCompare(b.name));
+    }
+    catch {
+        return [];
+    }
+}
 /**
  * List available Azure regions (locations)
  */
@@ -519,11 +802,11 @@ export async function listAzureBlobContainers(storageAccount) {
     }
 }
 /**
- * Static fallback for Azure regions (Dpsv5 ARM64 available or expected)
+ * Static fallback for common Azure regions.
  */
 function getStaticAzureRegions() {
     return [
-        // US regions (Dpsv5 ARM64 available)
+        // US regions
         "eastus",
         "eastus2",
         "westus",
@@ -538,7 +821,7 @@ function getStaticAzureRegions() {
         "canadaeast",
         // South America
         "brazilsouth",
-        // Europe (Dpsv5 available)
+        // Europe
         "northeurope",
         "westeurope",
         "uksouth",
@@ -594,101 +877,60 @@ export async function listAksClusters(resourceGroup) {
     }
 }
 /**
- * Required Azure resource providers for AKS deployment
- */
-const AZURE_REQUIRED_PROVIDERS = [
-    "Microsoft.ContainerService", // For AKS
-    "Microsoft.Network", // For VNets, NSGs
-    "Microsoft.ManagedIdentity", // For managed identities
-    "Microsoft.Compute", // For VMs
-];
-/**
- * Azure tier to vCPU core requirements mapping
- */
-export const AZURE_TIER_CORES = {
-    small: 8, // 4 nodes × 2 vCPU
-    medium: 16, // 4 nodes × 4 vCPU
-    large: 40, // 5 nodes × 8 vCPU
-};
-/**
- * Default region used for baseline quota checks when region is not yet selected
- */
-const AZURE_DEFAULT_QUOTA_CHECK_REGION = "eastus";
-/**
- * Check if required Azure resource providers are registered
+ * List AKS clusters across the active Azure subscription.
  */
-export async function checkAzureResourceProviders() {
-    const missing = [];
+export async function listAllAksClusters() {
     try {
-        for (const provider of AZURE_REQUIRED_PROVIDERS) {
-            const result = await execCommand(`az provider show --namespace ${provider} --query "registrationState" --output tsv`);
-            const state = result.stdout.trim();
-            if (state !== "Registered") {
-                missing.push(provider);
-            }
+        const result = await execCommand('az aks list --query "[].{name:name,resourceGroup:resourceGroup,location:location,kubernetesVersion:kubernetesVersion,powerState:powerState,agentPoolProfiles:agentPoolProfiles}" --output json');
+        if (result.stderr && !result.stdout) {
+            return [];
         }
-        return {
-            allRegistered: missing.length === 0,
-            missing,
-        };
+        const clusters = JSON.parse(result.stdout);
+        return clusters
+            .filter((cluster) => cluster.powerState?.code === "Running")
+            .map((cluster) => ({
+            provider: "azure",
+            name: cluster.name,
+            region: cluster.location,
+            resourceGroup: cluster.resourceGroup,
+            status: cluster.powerState?.code,
+            version: cluster.kubernetesVersion,
+            nodeCount: cluster.agentPoolProfiles?.reduce((sum, pool) => sum + (pool.count || 0), 0),
+        }))
+            .sort((a, b) => a.region.localeCompare(b.region) || a.name.localeCompare(b.name));
     }
     catch {
-        // If we can't check, assume they're not registered
-        return {
-            allRegistered: false,
-            missing: AZURE_REQUIRED_PROVIDERS,
-        };
+        return [];
     }
 }
 /**
- * Check Azure VM quota for a specific region
- *
- * @param region - Azure region to check quota for
- * @param requiredCores - Number of vCPUs required
- * @returns Quota check result with availability info
+ * Discover running AKS clusters in a selected Azure location.
  */
-export async function checkAzureVmQuota(region, requiredCores) {
+export async function discoverAksClustersInRegion(region) {
     try {
-        const result = await execCommand(`az vm list-usage --location ${region} --output json`);
+        const result = await execCommand('az aks list --query "[].{name:name,resourceGroup:resourceGroup,location:location,kubernetesVersion:kubernetesVersion,powerState:powerState,agentPoolProfiles:agentPoolProfiles}" --output json', {
+            intent: `Discover clusters in ${region}`,
+            provider: "azure",
+        });
         if (result.stderr && !result.stdout) {
-            return {
-                sufficient: false,
-                available: 0,
-                limit: 0,
-                used: 0,
-                error: "Failed to check VM quota",
-            };
-        }
-        const usageList = JSON.parse(result.stdout);
-        // Find total regional vCPU quota
-        const regionalQuota = usageList.find((u) => u.name.value === "cores" || u.name.localizedValue === "Total Regional vCPUs");
-        if (!regionalQuota) {
-            return {
-                sufficient: false,
-                available: 0,
-                limit: 0,
-                used: 0,
-                error: "Could not find regional vCPU quota",
-            };
+            return [];
         }
-        const used = regionalQuota.currentValue;
-        const limit = regionalQuota.limit;
-        const available = limit - used;
-        return {
-            sufficient: available >= requiredCores,
-            available,
-            limit,
-            used,
-        };
+        const clusters = JSON.parse(result.stdout);
+        return clusters
+            .filter((cluster) => cluster.location === region && cluster.powerState?.code === "Running")
+            .map((cluster) => ({
+            provider: "azure",
+            name: cluster.name,
+            region: cluster.location,
+            resourceGroup: cluster.resourceGroup,
+            status: cluster.powerState?.code,
+            version: cluster.kubernetesVersion,
+            nodeCount: cluster.agentPoolProfiles?.reduce((sum, pool) => sum + (pool.count || 0), 0),
+        }))
+            .sort((a, b) => a.name.localeCompare(b.name));
     }
-    catch (error) {
-        return {
-            sufficient: false,
-            available: 0,
-            limit: 0,
-            used: 0,
-            error: error instanceof Error ? error.message : "Failed to check VM quota",
-        };
+    catch {
+        return [];
     }
 }
 // ============================================================================
@@ -752,6 +994,86 @@ export async function listClusters(provider, region, options) {
             return [];
     }
 }
+/**
+ * List managed Kubernetes clusters discoverable through a provider CLI.
+ */
+export async function listManagedClusters(provider) {
+    switch (provider) {
+        case "aws":
+            return listAllEksClusters();
+        case "gcp":
+            return listAllGkeClusters();
+        case "azure":
+            return listAllAksClusters();
+        default:
+            return [];
+    }
+}
+/**
+ * List managed Kubernetes clusters discoverable through a provider CLI in a
+ * selected region/location. This is used by init to avoid account-wide fan-out.
+ */
+export async function discoverClustersInRegion(provider, region) {
+    switch (provider) {
+        case "aws":
+            return discoverEksClustersInRegion(region);
+        case "gcp":
+            return discoverGkeClustersInRegion(region);
+        case "azure":
+            return discoverAksClustersInRegion(region);
+        default:
+            return [];
+    }
+}
+/**
+ * Refresh kubeconfig credentials for a selected managed Kubernetes cluster.
+ */
+export async function updateKubeconfig(provider, clusterName, region, options = {}) {
+    switch (provider) {
+        case "aws":
+            {
+                const result = await execCommand(`aws eks update-kubeconfig --name ${clusterName} --region ${region}`, {
+                    timeout: 30000,
+                    intent: `Refresh kubeconfig for ${clusterName}`,
+                    provider: "aws",
+                    mutating: true,
+                });
+                if (result.stderr && !result.stdout)
+                    throw new Error(result.stderr);
+            }
+            return;
+        case "gcp":
+            if (!options.gcpProjectId) {
+                throw new Error("GCP project ID is required to refresh kubeconfig");
+            }
+            {
+                const result = await execCommand(`gcloud container clusters get-credentials ${clusterName} --location ${region} --project ${options.gcpProjectId}`, {
+                    timeout: 30000,
+                    intent: `Refresh kubeconfig for ${clusterName}`,
+                    provider: "gcp",
+                    mutating: true,
+                });
+                if (result.stderr && !result.stdout)
+                    throw new Error(result.stderr);
+            }
+            return;
+        case "azure":
+            if (!options.azureResourceGroup) {
+                throw new Error("Azure resource group is required to refresh kubeconfig");
+            }
+            {
+                const result = await execCommand(`az aks get-credentials --name ${clusterName} --resource-group ${options.azureResourceGroup} --overwrite-existing`, {
+                    timeout: 30000,
+                    intent: `Refresh kubeconfig for ${clusterName}`,
+                    provider: "azure",
+                    mutating: true,
+                });
+                if (result.stderr && !result.stdout)
+                    throw new Error(result.stderr);
+            }
+            return;
+    }
+}
 /**
  * Get installation URLs for cloud CLIs
  */
@@ -780,42 +1102,12 @@ export const CLI_LOGIN_COMMANDS = {
     gcp: [
         "gcloud auth login",
         "gcloud config set project PROJECT_ID",
-        "gcloud auth application-default login",
     ],
     azure: [
         "az login",
         "az account set --subscription YOUR_SUBSCRIPTION_ID",
-        "az provider register --namespace Microsoft.ContainerService",
     ],
 };
-/**
- * Check if Terraform is installed
- */
-export async function checkTerraform() {
-    try {
-        const result = await execCommand("terraform --version");
-        if (result.stderr && !result.stdout) {
-            return { installed: false, error: "Terraform not found" };
-        }
-        // Extract version (e.g., "Terraform v1.5.0")
-        const versionMatch = result.stdout.match(/Terraform v([\d.]+)/);
-        return {
-            installed: true,
-            version: versionMatch ? versionMatch[1] : undefined,
-        };
-    }
-    catch {
-        return { installed: false, error: "Terraform not found" };
-    }
-}
-/**
- * Terraform installation info
- */
-export const TERRAFORM_INSTALL_INFO = {
-    name: "Terraform",
-    url: "https://developer.hashicorp.com/terraform/downloads",
-    installCmd: "brew install terraform",
-};
 // ============================================================================
 // Region-filtered bucket listing
 // ============================================================================