@rulebricks/cli 2.1.6 → 2.3.1

package/dist/lib/clusterSetupDefaults.d.ts

@@ -0,0 +1,30 @@
+import { CloudProvider } from "../types/index.js";
+/**
+ * Detects the IAM roles / managed identities / buckets that the bundled
+ * cluster-setup templates (cluster-setup/aws|azure|gcp) provision, so the wizard
+ * can preselect them as sensible defaults. The user can always arrow to a
+ * different option, and when nothing matches the behavior is unchanged.
+ *
+ * Naming conventions (parameterized by cluster name, default rulebricks-cluster):
+ *   AWS  (CloudFormation): roles `${cluster}-metrics`, `${cluster}-decision-logs`,
+ *                          `${cluster}-backups`; buckets `${cluster}-decision-logs-*`,
+ *                          `${cluster}-backups-*`.
+ *   Azure (Bicep):         UAMIs `${cluster}-metrics`, `${cluster}-decision-logs`,
+ *                          `${cluster}-backups`; blob containers `decision-logs`, `backups`.
+ *   GCP  (docs):           service account `rulebricks-vector` (decision logs only).
+ */
+export type ClusterSetupCategory = "metrics-identity" | "decision-logs-identity" | "backups-identity" | "decision-logs-bucket" | "backups-bucket" | "decision-logs-container" | "backups-container";
+export interface ClusterSetupDetectOptions {
+    provider?: CloudProvider | null;
+    /** Cluster name used to build the most specific match. */
+    clusterName?: string;
+}
+/**
+ * Returns the index of the best cluster-setup match in `candidates`, or -1 when
+ * none match. Matching is case-insensitive and prefers more specific patterns.
+ */
+export declare function findClusterSetupDefaultIndex(candidates: string[], category: ClusterSetupCategory, options?: ClusterSetupDetectOptions): number;
+/**
+ * Convenience wrapper returning the matched candidate string (or undefined).
+ */
+export declare function findClusterSetupDefault(candidates: string[], category: ClusterSetupCategory, options?: ClusterSetupDetectOptions): string | undefined;

package/dist/lib/clusterSetupDefaults.js

@@ -0,0 +1,64 @@
+const DEFAULT_CLUSTER = "rulebricks-cluster";
+/**
+ * Substrings to look for, ordered most-specific to least-specific. The first
+ * candidate matching the highest-priority pattern wins.
+ */
+function patternsFor(category, cluster) {
+    // The consolidated cluster-setup provisions a single `${cluster}-rulebricks`
+    // identity and a single `${cluster}-data` bucket/container. Older split
+    // resources (`-decision-logs`, `-backups`, `-metrics`) are kept as lower-
+    // priority fallbacks so the wizard still preselects sensibly on legacy infra.
+    switch (category) {
+        case "metrics-identity":
+            return [`${cluster}-rulebricks`, `${cluster}-metrics`, "-rulebricks", "-metrics"];
+        case "decision-logs-identity":
+        case "backups-identity":
+            return [
+                `${cluster}-rulebricks`,
+                "-rulebricks",
+                `${cluster}-decision-logs`,
+                "-decision-logs",
+                `${cluster}-backups`,
+                "-backups",
+            ];
+        case "decision-logs-bucket":
+        case "backups-bucket":
+            return [
+                `${cluster}-data`,
+                "-data",
+                `${cluster}-decision-logs`,
+                "-decision-logs",
+                `${cluster}-backups`,
+                "-backups",
+            ];
+        case "decision-logs-container":
+        case "backups-container":
+            return [`${cluster}-data`, "-data", "rulebricks", "decision-logs", "backups"];
+        default:
+            return [];
+    }
+}
+/**
+ * Returns the index of the best cluster-setup match in `candidates`, or -1 when
+ * none match. Matching is case-insensitive and prefers more specific patterns.
+ */
+export function findClusterSetupDefaultIndex(candidates, category, options = {}) {
+    if (candidates.length === 0)
+        return -1;
+    const cluster = (options.clusterName || DEFAULT_CLUSTER).trim() || DEFAULT_CLUSTER;
+    const lowered = candidates.map((c) => c.toLowerCase());
+    for (const pattern of patternsFor(category, cluster)) {
+        const needle = pattern.toLowerCase();
+        const index = lowered.findIndex((c) => c.includes(needle));
+        if (index >= 0)
+            return index;
+    }
+    return -1;
+}
+/**
+ * Convenience wrapper returning the matched candidate string (or undefined).
+ */
+export function findClusterSetupDefault(candidates, category, options = {}) {
+    const index = findClusterSetupDefaultIndex(candidates, category, options);
+    return index >= 0 ? candidates[index] : undefined;
+}

package/dist/lib/commandApproval.d.ts

@@ -0,0 +1,26 @@
+import { CloudProvider } from "../types/index.js";
+export type CommandApprovalDecision = "approve" | "deny";
+export type CommandApprovalScope = "once" | "all-like" | "all";
+export interface CommandApprovalRequest {
+    intent: string;
+    command: string;
+    description?: string;
+    provider?: CloudProvider;
+    mutating?: boolean;
+}
+export interface PendingCommandApproval extends CommandApprovalRequest {
+    id: number;
+}
+type Listener = () => void;
+export declare class CommandDeniedError extends Error {
+    readonly command: string;
+    readonly intent: string;
+    constructor(command: string, intent: string);
+}
+export declare function setCommandApprovalInteractive(value: boolean): void;
+export declare function subscribeCommandApprovals(listener: Listener): () => void;
+export declare function getCurrentCommandApproval(): PendingCommandApproval | null;
+export declare function respondToCommandApproval(id: number, decision: CommandApprovalDecision, scope?: CommandApprovalScope): void;
+export declare function requestCommandApproval(req: CommandApprovalRequest): Promise<CommandApprovalDecision>;
+export declare function approveCloudCommandOrThrow(req: CommandApprovalRequest): Promise<void>;
+export {};

package/dist/lib/commandApproval.js

@@ -0,0 +1,114 @@
+export class CommandDeniedError extends Error {
+    command;
+    intent;
+    constructor(command, intent) {
+        super(`User denied cloud CLI command: ${command}`);
+        this.name = "CommandDeniedError";
+        this.command = command;
+        this.intent = intent;
+    }
+}
+let nextId = 1;
+let interactive = false;
+let approveAll = false;
+const approvedIntents = new Set();
+const queue = [];
+const inFlightByCommand = new Map();
+const listeners = new Set();
+let current = null;
+function isTty() {
+    return process.stdin.isTTY === true && process.stdout.isTTY === true;
+}
+function shouldPrompt(req) {
+    if (!interactive || !isTty())
+        return false;
+    if (approveAll || approvedIntents.has(req.intent))
+        return false;
+    return true;
+}
+function notify() {
+    for (const listener of listeners) {
+        listener();
+    }
+}
+function pumpQueue() {
+    if (current || queue.length === 0)
+        return;
+    current = queue.shift() || null;
+    notify();
+}
+function complete(approval, decision) {
+    inFlightByCommand.delete(approval.command);
+    for (const resolve of approval.resolvers) {
+        resolve(decision);
+    }
+}
+function completeQueuedByIntent(intent) {
+    for (let i = queue.length - 1; i >= 0; i -= 1) {
+        const approval = queue[i];
+        if (approval.intent !== intent)
+            continue;
+        queue.splice(i, 1);
+        complete(approval, "approve");
+    }
+}
+export function setCommandApprovalInteractive(value) {
+    interactive = value;
+}
+export function subscribeCommandApprovals(listener) {
+    listeners.add(listener);
+    return () => {
+        listeners.delete(listener);
+    };
+}
+export function getCurrentCommandApproval() {
+    if (!current)
+        return null;
+    const { resolvers: _resolvers, ...pending } = current;
+    return pending;
+}
+export function respondToCommandApproval(id, decision, scope = "once") {
+    if (!current || current.id !== id)
+        return;
+    const approval = current;
+    current = null;
+    if (decision === "approve") {
+        if (scope === "all") {
+            approveAll = true;
+        }
+        else if (scope === "all-like") {
+            approvedIntents.add(approval.intent);
+            completeQueuedByIntent(approval.intent);
+        }
+    }
+    complete(approval, decision);
+    notify();
+    pumpQueue();
+}
+export async function requestCommandApproval(req) {
+    if (!shouldPrompt(req)) {
+        return "approve";
+    }
+    const existing = inFlightByCommand.get(req.command);
+    if (existing) {
+        return new Promise((resolve) => {
+            existing.resolvers.push(resolve);
+        });
+    }
+    return new Promise((resolve) => {
+        const approval = {
+            id: nextId++,
+            ...req,
+            resolvers: [resolve],
+        };
+        inFlightByCommand.set(req.command, approval);
+        queue.push(approval);
+        pumpQueue();
+    });
+}
+export async function approveCloudCommandOrThrow(req) {
+    const decision = await requestCommandApproval(req);
+    if (decision === "deny") {
+        throw new CommandDeniedError(req.command, req.intent);
+    }
+}

package/dist/lib/config.d.ts

@@ -15,6 +15,16 @@ export declare function listDeployments(): Promise<string[]>;
  * Checks if a deployment exists
  */
 export declare function deploymentExists(name: string): Promise<boolean>;
+export declare function resolveDeploymentConfigVersion(parsed: Record<string, unknown>, values?: {
+    global?: {
+        version?: unknown;
+    };
+}, state?: {
+    version?: unknown;
+    application?: {
+        version?: unknown;
+    };
+}): string;
 /**
  * Saves a deployment configuration
  */
@@ -24,8 +34,8 @@ export declare function saveDeploymentConfig(config: DeploymentConfig): Promise<
  */
 export declare function loadDeploymentConfig(name: string): Promise<DeploymentConfig>;
 /**
- * Clones a deployment configuration to a new name
- * Only copies config.yaml with the new name - state and terraform are not copied
+ * Clones a deployment configuration to a new name.
+ * Only copies config.yaml with the new name - state is not copied.
  */
 export declare function cloneDeploymentConfig(sourceName: string, targetName: string): Promise<DeploymentConfig>;
 /**
@@ -48,14 +58,6 @@ export declare function loadHelmValues(name: string): Promise<Record<string, unk
  * Gets the Helm values file path
  */
 export declare function getHelmValuesPath(name: string): string;
-/**
- * Saves Terraform variables
- */
-export declare function saveTerraformVars(name: string, vars: Record<string, unknown>): Promise<string>;
-/**
- * Gets the Terraform working directory
- */
-export declare function getTerraformDir(name: string): string;
 /**
  * Deletes a deployment and all its files
  */

package/dist/lib/config.js

@@ -44,6 +44,83 @@ export async function deploymentExists(name) {
         return false;
     }
 }
+function migrateStorageConfig(parsed) {
+    if (!parsed || typeof parsed !== "object")
+        return;
+    // Collapse the older per-purpose storage shape (separate decisionLogs/dbBackups
+    // buckets, containers, and identities) into a single bucket/container with key
+    // prefixes. The decision-logs location is treated as canonical; the dbBackups
+    // path becomes a prefix in the same bucket/container.
+    const storage = parsed.storage;
+    if (storage && typeof storage === "object" && storage.decisionLogs) {
+        const dl = storage.decisionLogs || {};
+        const db = storage.dbBackups || {};
+        parsed.storage = {
+            provider: storage.provider,
+            cloudAuthMode: storage.cloudAuthMode,
+            bucket: dl.bucket ?? db.bucket,
+            region: dl.region ?? db.region,
+            awsIamRoleArn: storage.awsIamRoleArn,
+            azureBlobClientId: storage.azureBlobClientId,
+            azureBlobTenantId: storage.azureBlobTenantId,
+            azureBlobConnectionStringSecretRef: storage.azureBlobConnectionStringSecretRef,
+            azureBlobContainer: dl.azureBlobContainer ?? db.azureBlobContainer,
+            gcpServiceAccountEmail: storage.gcpServiceAccountEmail,
+            paths: {
+                decisionLogs: dl.path || "decision-logs",
+                dbBackups: db.path || "db-backups",
+            },
+        };
+    }
+    if (parsed.features?.decisionLogQuery) {
+        delete parsed.features.decisionLogQuery;
+    }
+}
+export function resolveDeploymentConfigVersion(parsed, values, state) {
+    if (typeof values?.global?.version === "string" && values.global.version) {
+        return values.global.version;
+    }
+    if (typeof state?.application?.version === "string" &&
+        state.application.version) {
+        return state.application.version;
+    }
+    if (typeof state?.version === "string" && state.version) {
+        return state.version;
+    }
+    if (typeof parsed.chartVersion === "string" && parsed.chartVersion) {
+        return parsed.chartVersion;
+    }
+    return "latest";
+}
+async function inferMissingVersion(name, parsed) {
+    const dir = getDeploymentDir(name);
+    let values;
+    let state;
+    try {
+        const valuesContent = await fs.readFile(path.join(dir, "values.yaml"), "utf-8");
+        values = yaml.parse(valuesContent);
+    }
+    catch {
+        // values.yaml is optional for config-only deployments.
+    }
+    try {
+        const stateContent = await fs.readFile(path.join(dir, "state.yaml"), "utf-8");
+        state = yaml.parse(stateContent);
+    }
+    catch {
+        // state.yaml may not exist yet.
+    }
+    return resolveDeploymentConfigVersion(parsed, values, state);
+}
+async function migrateConfig(name, parsed) {
+    if (!parsed || typeof parsed !== "object")
+        return;
+    const config = parsed;
+    migrateStorageConfig(config);
+    if (typeof config.version !== "string" || !config.version) {
+        config.version = await inferMissingVersion(name, config);
+    }
+}
 /**
  * Saves a deployment configuration
  */
@@ -60,11 +137,21 @@ export async function loadDeploymentConfig(name) {
     const configPath = path.join(getDeploymentDir(name), "config.yaml");
     const content = await fs.readFile(configPath, "utf-8");
     const parsed = yaml.parse(content);
+    if (parsed &&
+        typeof parsed === "object" &&
+        "infrastructure" in parsed &&
+        parsed.infrastructure &&
+        typeof parsed.infrastructure === "object" &&
+        "mode" in parsed.infrastructure &&
+        parsed.infrastructure.mode === "provision") {
+        throw new Error(`Deployment "${name}" was created with CLI-managed infrastructure, which is no longer supported. Use an existing Kubernetes cluster and create a new deployment config.`);
+    }
+    await migrateConfig(name, parsed);
     return DeploymentConfigSchema.parse(parsed);
 }
 /**
- * Clones a deployment configuration to a new name
- * Only copies config.yaml with the new name - state and terraform are not copied
+ * Clones a deployment configuration to a new name.
+ * Only copies config.yaml with the new name - state is not copied.
  */
 export async function cloneDeploymentConfig(sourceName, targetName) {
     const sourceConfig = await loadDeploymentConfig(sourceName);
@@ -126,35 +213,6 @@ export async function loadHelmValues(name) {
 export function getHelmValuesPath(name) {
     return path.join(getDeploymentDir(name), "values.yaml");
 }
-/**
- * Saves Terraform variables
- */
-export async function saveTerraformVars(name, vars) {
-    const dir = path.join(getDeploymentDir(name), "terraform");
-    await fs.mkdir(dir, { recursive: true });
-    // Convert to HCL-compatible format
-    let content = "";
-    for (const [key, value] of Object.entries(vars)) {
-        if (typeof value === "string") {
-            content += `${key} = "${value}"\n`;
-        }
-        else if (typeof value === "number" || typeof value === "boolean") {
-            content += `${key} = ${value}\n`;
-        }
-        else {
-            content += `${key} = ${JSON.stringify(value)}\n`;
-        }
-    }
-    const varsPath = path.join(dir, "terraform.tfvars");
-    await fs.writeFile(varsPath, content, "utf-8");
-    return varsPath;
-}
-/**
- * Gets the Terraform working directory
- */
-export function getTerraformDir(name) {
-    return path.join(getDeploymentDir(name), "terraform");
-}
 /**
  * Deletes a deployment and all its files
  */
@@ -212,6 +270,7 @@ export async function loadProfile() {
     try {
         const content = await fs.readFile(profilePath, "utf-8");
         const data = yaml.parse(content);
+        migrateStorageConfig(data);
         return ProfileConfigSchema.parse(data);
     }
     catch {
@@ -238,7 +297,6 @@ export function extractProfileFromConfig(config) {
         provider: config.infrastructure.provider,
         region: config.infrastructure.region,
         clusterName: config.infrastructure.clusterName,
-        infrastructureMode: config.infrastructure.mode,
         // Domain - store suffix for suggesting new domains
         domainSuffix: extractDomainSuffix(config.domain),
         adminEmail: config.adminEmail,
@@ -255,8 +313,8 @@ export function extractProfileFromConfig(config) {
         openaiApiKey: config.features.ai.openaiApiKey,
         licenseKey: config.licenseKey,
         // Preferences
-        tier: config.tier,
         databaseType: config.database.type,
+        storage: config.storage,
         // SSO
         ssoProvider: config.features.sso.provider,
         ssoUrl: config.features.sso.url,

package/dist/lib/configFixtures.d.ts

@@ -0,0 +1,5 @@
+import { DeploymentConfig } from "../types/index.js";
+export declare function buildConfigMatrix(): {
+    name: string;
+    config: DeploymentConfig;
+}[];