@rulebricks/cli 2.1.6 → 2.3.1

package/dist/commands/deploy.js

@@ -1,74 +1,50 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
-import { useState, useEffect, useCallback, useRef } from "react";
-import { Box, Text, useApp, useInput } from "ink";
+import { useCallback, useEffect, useState } from "react";
+import { Box, Text, useApp } from "ink";
 import { platform } from "os";
-import { BorderBox, Spinner, StatusLine, ThemeProvider, useTheme, Logo, } from "../components/common/index.js";
+import { BorderBox, Spinner, StatusLine, ThemeProvider, useTheme, Logo, CommandApprovalProvider, } from "../components/common/index.js";
 import { DNSWaitScreen } from "../components/DNSWaitScreen.js";
-import { loadDeploymentConfig, loadDeploymentState, saveDeploymentState, updateDeploymentStatus, saveTerraformVars, } from "../lib/config.js";
-import { setupTerraformWorkspace, terraformInit, terraformPlan, terraformApply, terraformDestroy, cleanupOrphanedResources, updateKubeconfig, hasTerraformState, isTerraformInstalled, generateTerraformVars, } from "../lib/terraform.js";
-import { checkGcpApplicationDefaultCredentials, checkAzureResourceProviders, checkAzureVmQuota, AZURE_TIER_CORES, } from "../lib/cloudCli.js";
+import { loadDeploymentConfig, loadDeploymentState, loadHelmValues, saveDeploymentState, updateDeploymentStatus, } from "../lib/config.js";
 import { installOrUpgradeChart, upgradeChart, isHelmInstalled, } from "../lib/helm.js";
+import { assertValidHelmValues } from "../lib/validateValues.js";
 import { isKubectlInstalled, checkClusterAccessible, waitForCertificatesReady, } from "../lib/kubernetes.js";
+import { updateKubeconfig, checkAuroraLogicalReplication, } from "../lib/cloudCli.js";
+import { ensureWorkloadIdentityFederation } from "../lib/workloadIdentity.js";
 import { generateHelmValues, updateHelmValuesForTLS, } from "../lib/helmValues.js";
+import { ensureNamespace, applyDeploymentSecrets } from "../lib/secrets.js";
+import { CommandDeniedError } from "../lib/commandApproval.js";
 import { isSupportedDnsProvider, getNamespace, getReleaseName, } from "../types/index.js";
-function DeployCommandInner({ name, skipInfra, skipDns, version, }) {
+function getConfigProductVersion(config) {
+    return config.version;
+}
+function DeployCommandInner({ name, skipDns, version, regenerateValues = true, assumeDnsConfigured = false, inlineSecrets = false, }) {
+    const secretMode = inlineSecrets ? "inline" : "k8s";
     const { exit } = useApp();
     const { colors } = useTheme();
     const [step, setStep] = useState("loading");
     const [config, setConfig] = useState(null);
     const [error, setError] = useState(null);
     const [useExternalDns, setUseExternalDns] = useState(false);
-    const infraStartedRef = useRef(false); // Track if we started infra provisioning (ref for sync access)
-    const [cleanupError, setCleanupError] = useState(null);
     const [tlsWarning, setTlsWarning] = useState(null);
+    const [federationWarning, setFederationWarning] = useState(null);
     const [status, setStatus] = useState({
         preflight: "pending",
-        infrastructure: "pending",
+        federation: "pending",
         kubeconfig: "pending",
         helmInstall: "pending",
         certCheck: "pending",
         dnsConfig: "pending",
         helmUpgradeTls: "pending",
     });
-    // Handle cleanup prompt responses
-    const handleCleanup = useCallback(async () => {
-        setStep("cleanup-running");
-        try {
-            const cloudContext = config?.infrastructure.provider && config?.infrastructure.region
-                ? {
-                    provider: config.infrastructure.provider,
-                    clusterName: config.infrastructure.clusterName || `${name}-cluster`,
-                    region: config.infrastructure.region,
-                }
-                : undefined;
-            await terraformDestroy(name, cloudContext);
-            setStep("cleanup-complete");
-            setTimeout(() => exit(), 3000);
-        }
-        catch (err) {
-            setCleanupError(err instanceof Error ? err.message : "Cleanup failed");
-            setStep("cleanup-complete");
-            setTimeout(() => exit(), 5000);
-        }
-    }, [name, config, exit]);
-    const skipCleanup = useCallback(() => {
-        setStep("error");
+    useEffect(() => {
+        runDeployment();
     }, []);
-    useInput((input, key) => {
-        if (step === "cleanup-prompt") {
-            if (input === "y" || input === "Y") {
-                handleCleanup();
-            }
-            else if (input === "n" || input === "N" || key.escape) {
-                skipCleanup();
-            }
-        }
-        else if (key.escape &&
-            (step === "error" || step === "cleanup-complete")) {
-            exit();
-        }
-    });
-    // Resume after DNS wait (manual DNS flow)
+    const markRunning = (key) => {
+        setStatus((s) => ({ ...s, [key]: "running" }));
+    };
+    const markSuccess = (key) => {
+        setStatus((s) => ({ ...s, [key]: "success" }));
+    };
     const handleDnsComplete = useCallback(async () => {
         if (!config)
             return;
@@ -79,45 +55,21 @@ function DeployCommandInner({ name, skipInfra, skipDns, version, }) {
                 dnsConfig: "success",
                 helmUpgradeTls: "running",
             }));
-            // Update helm values to enable TLS
             await updateHelmValuesForTLS(name, true);
             const namespace = getNamespace(config.name);
             const releaseName = getReleaseName(config.name);
-            // Upgrade the chart with TLS enabled
             await upgradeChart(name, { releaseName, namespace, version, wait: true });
             setStatus((s) => ({ ...s, helmUpgradeTls: "success", certCheck: "running" }));
             setStep("cert-check");
-            try {
-                await waitForCertificatesReady(namespace);
-                setStatus((s) => ({ ...s, certCheck: "success" }));
-            }
-            catch (certErr) {
-                setStatus((s) => ({ ...s, certCheck: "error" }));
-                setTlsWarning("TLS certificates are still being issued. " +
-                    "HTTPS may not be available yet.");
-            }
-            // Update state
-            await updateDeploymentStatus(name, "running", {
-                application: {
-                    appVersion: config.appVersion || "latest",
-                    hpsVersion: config.hpsVersion || config.appVersion || "latest",
-                    chartVersion: version || "latest",
-                    namespace,
-                    url: `https://${config.domain}`,
-                },
-            });
+            await verifyCertificates(namespace);
+            await markRunningState(config, namespace);
             setStep("complete");
             setTimeout(() => exit(), 5000);
         }
         catch (err) {
-            const message = err instanceof Error ? err.message : "TLS upgrade failed";
-            setError(message);
-            setStep("error");
-            setStatus((s) => ({ ...s, helmUpgradeTls: "error" }));
-            await updateDeploymentStatus(name, "failed");
+            await failDeployment(err, "TLS upgrade failed");
         }
     }, [config, name, version, exit]);
-    // Skip DNS validation (manual DNS flow)
     const handleDnsSkip = useCallback(async () => {
         if (!config)
             return;
@@ -128,11 +80,10 @@ function DeployCommandInner({ name, skipInfra, skipDns, version, }) {
             certCheck: "skipped",
         }));
         const namespace = getNamespace(config.name);
-        // Mark as running without TLS upgrade
-        await updateDeploymentStatus(name, "running", {
+        const productVersion = getConfigProductVersion(config);
+        await updateDeploymentStatus(name, "waiting-dns", {
             application: {
-                appVersion: config.appVersion || "latest",
-                hpsVersion: config.hpsVersion || config.appVersion || "latest",
+                version: productVersion,
                 chartVersion: version || "latest",
                 namespace,
                 url: `https://${config.domain}`,
@@ -141,19 +92,12 @@ function DeployCommandInner({ name, skipInfra, skipDns, version, }) {
         setStep("complete");
         setTimeout(() => exit(), 5000);
     }, [config, name, version, exit]);
-    useEffect(() => {
-        runDeployment();
-    }, []);
     async function runDeployment() {
         try {
-            // Load configuration
             const cfg = await loadDeploymentConfig(name);
             setConfig(cfg);
-            // Determine if External DNS is enabled
-            // External DNS = supported provider + auto-manage enabled
             const externalDnsEnabled = cfg.dns.autoManage && isSupportedDnsProvider(cfg.dns.provider);
             setUseExternalDns(externalDnsEnabled);
-            // Initialize deployment state
             const existingState = await loadDeploymentState(name);
             const state = existingState || {
                 name,
@@ -163,68 +107,41 @@ function DeployCommandInner({ name, skipInfra, skipDns, version, }) {
                 status: "deploying",
             };
             await saveDeploymentState(name, { ...state, status: "deploying" });
-            // Preflight checks
             setStep("preflight");
-            setStatus((s) => ({ ...s, preflight: "running" }));
+            markRunning("preflight");
             await runPreflightChecks(cfg);
-            setStatus((s) => ({ ...s, preflight: "success" }));
-            // Infrastructure provisioning
-            const needsInfra = cfg.infrastructure.mode === "provision" && !skipInfra;
-            if (needsInfra) {
-                setStatus((s) => ({ ...s, infrastructure: "running" }));
-                infraStartedRef.current = true; // Mark that we're doing infrastructure work
-                // Check if already provisioned
-                const hasState = await hasTerraformState(name);
-                if (!hasState) {
-                    setStep("infra-setup");
-                    await setupTerraformWorkspace(name, cfg.infrastructure.provider);
-                }
-                // Generate and save terraform variables (always do this before plan,
-                // even if state exists, in case config changed)
-                const terraformVars = generateTerraformVars(cfg);
-                await saveTerraformVars(name, terraformVars);
-                setStep("infra-init");
-                await terraformInit(name);
-                setStep("infra-plan");
-                await terraformPlan(name);
-                // Clean up orphaned cloud resources from prior failed deployments
-                // (e.g. CloudWatch log groups that survived an incomplete destroy)
-                if (cfg.infrastructure.provider && cfg.infrastructure.region) {
-                    await cleanupOrphanedResources(cfg.infrastructure.provider, cfg.infrastructure.clusterName || `${name}-cluster`, cfg.infrastructure.region);
-                }
-                setStep("infra-apply");
-                await terraformApply(name);
-                setStatus((s) => ({ ...s, infrastructure: "success" }));
-                // Update kubeconfig
-                setStep("kubeconfig");
-                setStatus((s) => ({ ...s, kubeconfig: "running" }));
-                await updateKubeconfig(cfg.infrastructure.provider, cfg.infrastructure.clusterName || `${name}-cluster`, cfg.infrastructure.region, {
-                    gcpProjectId: cfg.infrastructure.gcpProjectId,
-                    azureResourceGroup: cfg.infrastructure.azureResourceGroup,
-                });
-                // Note: StorageClass is managed by the Helm chart, not the CLI
-                // This avoids conflicts where kubectl-created resources lack Helm ownership labels
-                setStatus((s) => ({ ...s, kubeconfig: "success" }));
+            markSuccess("preflight");
+            // Ensure the per-namespace workload-identity trust exists. cluster-setup
+            // creates the deployment-independent identity; this wires it to this
+            // deployment's ServiceAccounts so one cluster can host many deployments.
+            setStep("federation");
+            markRunning("federation");
+            try {
+                const federation = await ensureWorkloadIdentityFederation(cfg);
+                setStatus((s) => ({
+                    ...s,
+                    federation: federation.skipped ? "skipped" : "success",
+                }));
             }
-            else {
-                // For existing infrastructure, infrastructure is always skipped
-                // kubeconfig may have been updated during preflight if cluster wasn't accessible
-                // (in that case, it's already set to 'success'), otherwise mark as skipped
+            catch (federationError) {
+                if (!(federationError instanceof CommandDeniedError)) {
+                    throw federationError;
+                }
+                setFederationWarning("Workload identity setup was skipped because a cloud CLI command was denied. Continuing assumes you created the trust manually.");
                 setStatus((s) => ({
                     ...s,
-                    infrastructure: "skipped",
-                    kubeconfig: s.kubeconfig === "success" ? "success" : "skipped",
+                    federation: "skipped",
                 }));
             }
-            // Helm Chart Installation
             setStep("helm-install");
-            setStatus((s) => ({ ...s, helmInstall: "running" }));
+            markRunning("helmInstall");
             const namespace = getNamespace(cfg.name);
             const releaseName = getReleaseName(cfg.name);
             if (externalDnsEnabled) {
-                // SINGLE-PHASE DEPLOYMENT (External DNS)
-                // Install with TLS enabled from the start - external-dns handles DNS records
-                await generateHelmValues(cfg, { tlsEnabled: true });
+                if (regenerateValues) {
+                    await generateHelmValues(cfg, { tlsEnabled: true, secretMode });
+                }
+                await ensureGeneratedValuesValid();
                 await installOrUpgradeChart(name, {
                     releaseName,
                     namespace,
@@ -234,25 +151,59 @@ function DeployCommandInner({ name, skipInfra, skipDns, version, }) {
                 setStatus((s) => ({
                     ...s,
                     helmInstall: "success",
-                    dnsConfig: "skipped", // External DNS handles this
-                    helmUpgradeTls: "skipped", // TLS enabled from start
+                    dnsConfig: "skipped",
+                    helmUpgradeTls: "skipped",
                     certCheck: "running",
                 }));
                 setStep("cert-check");
-                try {
-                    await waitForCertificatesReady(namespace);
-                    setStatus((s) => ({ ...s, certCheck: "success" }));
-                }
-                catch (certErr) {
-                    setStatus((s) => ({ ...s, certCheck: "error" }));
-                    setTlsWarning("TLS certificates are still being issued. " +
-                        "HTTPS may not be available yet.");
-                }
-                // Update state to running
-                await updateDeploymentStatus(name, "running", {
+                await verifyCertificates(namespace);
+                await markRunningState(cfg, namespace);
+                setStep("complete");
+                setTimeout(() => exit(), 5000);
+                return;
+            }
+            if (regenerateValues) {
+                await generateHelmValues(cfg, { tlsEnabled: false, secretMode });
+            }
+            await ensureGeneratedValuesValid();
+            // k8s secret mode: create the namespace + Secrets (idempotent upsert) so
+            // they exist before Helm runs and the chart's secretRef seams resolve.
+            if (secretMode === "k8s") {
+                await ensureNamespace(namespace);
+                await applyDeploymentSecrets(cfg, namespace);
+            }
+            await installOrUpgradeChart(name, {
+                releaseName,
+                namespace,
+                version,
+                wait: true,
+            });
+            markSuccess("helmInstall");
+            if (assumeDnsConfigured) {
+                setStatus((s) => ({
+                    ...s,
+                    dnsConfig: "skipped",
+                    helmUpgradeTls: "skipped",
+                    certCheck: "running",
+                }));
+                setStep("cert-check");
+                await verifyCertificates(namespace);
+                await markRunningState(cfg, namespace);
+                setStep("complete");
+                setTimeout(() => exit(), 5000);
+                return;
+            }
+            if (skipDns) {
+                setStatus((s) => ({
+                    ...s,
+                    dnsConfig: "skipped",
+                    helmUpgradeTls: "skipped",
+                    certCheck: "skipped",
+                }));
+                const productVersion = getConfigProductVersion(cfg);
+                await updateDeploymentStatus(name, "waiting-dns", {
                     application: {
-                        appVersion: cfg.appVersion || "latest",
-                        hpsVersion: cfg.hpsVersion || cfg.appVersion || "latest",
+                        version: productVersion,
                         chartVersion: version || "latest",
                         namespace,
                         url: `https://${cfg.domain}`,
@@ -260,65 +211,28 @@ function DeployCommandInner({ name, skipInfra, skipDns, version, }) {
                 });
                 setStep("complete");
                 setTimeout(() => exit(), 5000);
+                return;
             }
-            else {
-                // TWO-PHASE DEPLOYMENT (Manual DNS)
-                // Phase 1: Install without TLS
-                await generateHelmValues(cfg, { tlsEnabled: false });
-                await installOrUpgradeChart(name, {
-                    releaseName,
-                    namespace,
-                    version,
-                    wait: true,
-                });
-                setStatus((s) => ({ ...s, helmInstall: "success" }));
-                // If skipping DNS, go straight to complete
-                if (skipDns) {
-                    setStatus((s) => ({
-                        ...s,
-                        dnsConfig: "skipped",
-                        helmUpgradeTls: "skipped",
-                        certCheck: "skipped",
-                    }));
-                    await updateDeploymentStatus(name, "waiting-dns", {
-                        application: {
-                            appVersion: cfg.appVersion || "latest",
-                            hpsVersion: cfg.hpsVersion || cfg.appVersion || "latest",
-                            chartVersion: version || "latest",
-                            namespace,
-                            url: `https://${cfg.domain}`,
-                        },
-                    });
-                    setStep("complete");
-                    setTimeout(() => exit(), 5000);
-                    return;
-                }
-                // Update state to waiting for DNS
-                await updateDeploymentStatus(name, "waiting-dns");
-                // Phase 2: DNS configuration wait
-                setStep("dns-wait");
-                setStatus((s) => ({ ...s, dnsConfig: "running" }));
-            }
+            await updateDeploymentStatus(name, "waiting-dns");
+            setStep("dns-wait");
+            markRunning("dnsConfig");
         }
         catch (err) {
-            const message = err instanceof Error ? err.message : "Unknown error";
-            setError(message);
-            await updateDeploymentStatus(name, "failed");
-            // If we started infrastructure provisioning but failed, offer cleanup
-            if (infraStartedRef.current) {
-                setStep("cleanup-prompt");
-            }
-            else {
-                setStep("error");
-            }
+            await failDeployment(err, "Unknown error");
+        }
+    }
+    // Guardrail: validate the values we're about to install against the chart's
+    // bundled schema. Catches reused/hand-edited values too (regenerateValues=false).
+    async function ensureGeneratedValuesValid() {
+        const values = await loadHelmValues(name);
+        if (values) {
+            assertValidHelmValues(values);
         }
     }
     async function runPreflightChecks(cfg) {
-        // Check required tools
-        const [helm, kubectl, terraform] = await Promise.all([
+        const [helm, kubectl] = await Promise.all([
             isHelmInstalled(),
             isKubectlInstalled(),
-            isTerraformInstalled(),
         ]);
         if (!helm) {
             throw new Error("Helm is not installed. Please install Helm first.");
@@ -326,141 +240,135 @@ function DeployCommandInner({ name, skipInfra, skipDns, version, }) {
         if (!kubectl) {
             throw new Error("kubectl is not installed. Please install kubectl first.");
         }
-        if (cfg.infrastructure.mode === "provision" && !terraform) {
-            throw new Error("Terraform is not installed. Required for infrastructure provisioning.");
-        }
-        // Check GCP Application Default Credentials if provisioning GCP infrastructure
-        if (cfg.infrastructure.mode === "provision" &&
-            cfg.infrastructure.provider === "gcp") {
-            const adcCheck = await checkGcpApplicationDefaultCredentials();
-            if (!adcCheck.configured) {
-                throw new Error("GCP Application Default Credentials (ADC) not configured.\n\n" +
-                    "Terraform requires ADC to authenticate with Google Cloud.\n\n" +
-                    "To fix this:\n" +
-                    "  • Run: gcloud auth login\n" +
-                    "  • Run: gcloud auth application-default login\n" +
-                    "  • Verify: gcloud auth application-default print-access-token\n\n" +
-                    "For more information: https://cloud.google.com/docs/authentication/application-default-credentials");
-            }
-        }
-        // Check Azure prerequisites if provisioning Azure infrastructure
-        if (cfg.infrastructure.mode === "provision" &&
-            cfg.infrastructure.provider === "azure") {
-            // 1. Verify resource providers are registered
-            const providerCheck = await checkAzureResourceProviders();
-            if (!providerCheck.allRegistered) {
-                throw new Error(`Azure resource providers not registered: ${providerCheck.missing.join(", ")}\n\n` +
-                    "To register:\n" +
-                    providerCheck.missing
-                        .map((p) => `  • az provider register --namespace ${p}`)
-                        .join("\n") +
-                    "\n\nNote: Registration may take a few minutes to complete.");
-            }
-            // 2. Check VM quota for the selected tier
-            const tier = cfg.tier || "small";
-            const region = cfg.infrastructure.region;
-            if (!region) {
-                throw new Error("Azure region is required for infrastructure provisioning");
-            }
-            const requiredCores = AZURE_TIER_CORES[tier] || AZURE_TIER_CORES.small;
-            const quotaCheck = await checkAzureVmQuota(region, requiredCores);
-            if (!quotaCheck.sufficient) {
-                throw new Error(`Insufficient Azure vCPU quota in ${region}.\n` +
-                    `Required: ${requiredCores} cores (${tier} tier), Available: ${quotaCheck.available}/${quotaCheck.limit}\n\n` +
-                    "Request a quota increase in the Azure portal:\n" +
-                    "  • Go to: Subscriptions > Usage + quotas\n" +
-                    "  • Request increase for 'Total Regional vCPUs' in your region");
+        let clusterError = await checkClusterAccessible();
+        if (clusterError &&
+            cfg.infrastructure.provider &&
+            cfg.infrastructure.region &&
+            cfg.infrastructure.clusterName) {
+            try {
+                setStep("kubeconfig");
+                setStatus((s) => ({
+                    ...s,
+                    preflight: "success",
+                    kubeconfig: "running",
+                }));
+                await updateKubeconfig(cfg.infrastructure.provider, cfg.infrastructure.clusterName, cfg.infrastructure.region, {
+                    gcpProjectId: cfg.infrastructure.gcpProjectId,
+                    azureResourceGroup: cfg.infrastructure.azureResourceGroup,
+                });
+                clusterError = await checkClusterAccessible();
+                if (!clusterError) {
+                    markSuccess("kubeconfig");
+                }
             }
-        }
-        // Check cluster access if using existing infrastructure
-        if (cfg.infrastructure.mode === "existing") {
-            let clusterError = await checkClusterAccessible();
-            // If cluster not accessible but we have provider details, try updating kubeconfig
-            if (clusterError &&
-                cfg.infrastructure.provider &&
-                cfg.infrastructure.region &&
-                cfg.infrastructure.clusterName) {
-                try {
-                    // Show visual feedback for kubeconfig update
-                    setStep("kubeconfig");
-                    setStatus((s) => ({
-                        ...s,
-                        preflight: "success",
-                        kubeconfig: "running",
-                    }));
-                    await updateKubeconfig(cfg.infrastructure.provider, cfg.infrastructure.clusterName, cfg.infrastructure.region, {
-                        gcpProjectId: cfg.infrastructure.gcpProjectId,
-                        azureResourceGroup: cfg.infrastructure.azureResourceGroup,
-                    });
-                    // Retry cluster access check
+            catch (kubeconfigError) {
+                if (kubeconfigError instanceof CommandDeniedError) {
                     clusterError = await checkClusterAccessible();
                     if (!clusterError) {
-                        setStatus((s) => ({ ...s, kubeconfig: "success" }));
+                        markSuccess("kubeconfig");
+                        return;
                     }
                 }
-                catch (kubeconfigError) {
-                    // Kubeconfig update failed, include both errors
-                    const kubeconfigMsg = kubeconfigError instanceof Error
-                        ? kubeconfigError.message
-                        : "Unknown error";
-                    throw new Error(`Cannot access Kubernetes cluster and kubeconfig update failed:\n` +
-                        `Cluster error: ${clusterError}\n` +
-                        `Kubeconfig update error: ${kubeconfigMsg}`);
-                }
+                const kubeconfigMsg = kubeconfigError instanceof Error
+                    ? kubeconfigError.message
+                    : "Unknown error";
+                throw new Error(`Cannot access Kubernetes cluster and kubeconfig refresh failed:\n` +
+                    `Cluster error: ${clusterError}\n` +
+                    `Kubeconfig error: ${kubeconfigMsg}`);
             }
-            if (clusterError) {
-                // Provide helpful message based on whether provider details are missing
-                if (!cfg.infrastructure.provider ||
-                    !cfg.infrastructure.region ||
-                    !cfg.infrastructure.clusterName) {
-                    throw new Error(`Cannot access Kubernetes cluster:\n${clusterError}\n\n` +
-                        `Tip: Re-run 'rulebricks init' and provide your cloud provider, region, and cluster name ` +
-                        `to enable automatic kubeconfig updates.`);
-                }
-                throw new Error(`Cannot access Kubernetes cluster:\n${clusterError}`);
+        }
+        if (clusterError) {
+            throw new Error(`Cannot access Kubernetes cluster:\n${clusterError}`);
+        }
+        setStatus((s) => ({
+            ...s,
+            kubeconfig: s.kubeconfig === "success" ? "success" : "skipped",
+        }));
+        // External AWS Aurora needs logical replication for Supabase Realtime - a
+        // static cluster parameter bootstrap.sql can't set - so catch it here before
+        // a long deploy ends in a Realtime crashloop. Fail-open: the check returns
+        // "unknown" (and we proceed) on any ambiguity; we only block when the
+        // parameter is definitively off.
+        const pg = cfg.externalServices?.postgres;
+        if (pg?.mode === "external" &&
+            pg.external?.provider === "aws" &&
+            pg.external.host) {
+            const lr = await checkAuroraLogicalReplication(pg.external.host, cfg.infrastructure.region);
+            if (lr.status === "disabled") {
+                const pgName = lr.parameterGroup ?? "<db-cluster-parameter-group>";
+                throw new Error("External Aurora Postgres has logical replication DISABLED" +
+                    (lr.parameterGroup ? ` (parameter group ${lr.parameterGroup})` : "") +
+                    ". Supabase Realtime requires it, and rds.logical_replication is a " +
+                    "static parameter the chart's bootstrap cannot set. Enable it, then " +
+                    "reboot the writer, before deploying:\n" +
+                    `  aws rds modify-db-cluster-parameter-group --db-cluster-parameter-group-name ${pgName} \\\n` +
+                    '    --parameters "ParameterName=rds.logical_replication,ParameterValue=1,ApplyMethod=pending-reboot"\n' +
+                    "  aws rds reboot-db-instance --db-instance-identifier <writer-instance>\n" +
+                    "(If the cluster uses a default parameter group, create a custom one first and attach it.)");
             }
         }
     }
-    // Cleanup prompt screen
-    if (step === "cleanup-prompt") {
-        return (_jsx(BorderBox, { title: "Deployment Failed", children: _jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { color: colors.error, bold: true, children: "\u2717 Infrastructure provisioning failed" }), _jsx(Text, { color: colors.error, children: error }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { color: colors.warning, bold: true, children: "Partial infrastructure may have been created." }), _jsx(Text, { color: colors.muted, children: "Would you like to clean up to avoid orphaned resources?" })] }), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: colors.accent, bold: true, children: "[Y]" }), _jsxs(Text, { color: colors.muted, children: [" ", "Yes, destroy partial infrastructure"] })] }), _jsxs(Box, { children: [_jsx(Text, { color: colors.accent, bold: true, children: "[N]" }), _jsxs(Text, { color: colors.muted, children: [" ", "No, keep for debugging (you can run `rulebricks destroy --cluster` later)"] })] })] }) }));
+    async function verifyCertificates(namespace) {
+        try {
+            await waitForCertificatesReady(namespace);
+            markSuccess("certCheck");
+        }
+        catch {
+            setStatus((s) => ({ ...s, certCheck: "error" }));
+            setTlsWarning("TLS certificates are still being issued. HTTPS may not be available yet.");
+        }
     }
-    // Cleanup running screen
-    if (step === "cleanup-running") {
-        return (_jsx(BorderBox, { title: "Cleaning Up", children: _jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Spinner, { label: "Destroying partial infrastructure..." }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { color: colors.muted, children: "This may take several minutes..." }) })] }) }));
+    async function markRunningState(cfg, namespace) {
+        const productVersion = getConfigProductVersion(cfg);
+        await updateDeploymentStatus(name, "running", {
+            application: {
+                version: productVersion,
+                chartVersion: version || "latest",
+                namespace,
+                url: `https://${cfg.domain}`,
+            },
+        });
     }
-    // Cleanup complete screen
-    if (step === "cleanup-complete") {
-        return (_jsx(BorderBox, { title: "Cleanup Complete", children: _jsxs(Box, { flexDirection: "column", marginY: 1, children: [cleanupError ? (_jsxs(_Fragment, { children: [_jsx(Text, { color: colors.warning, bold: true, children: "\u26A0 Cleanup encountered issues" }), _jsx(Text, { color: colors.warning, children: cleanupError }), _jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: colors.muted, children: ["Some resources may remain. Run `rulebricks destroy ", name, " ", "--cluster` to retry."] }) })] })) : (_jsxs(_Fragment, { children: [_jsx(Text, { color: colors.success, bold: true, children: "\u2713 Infrastructure cleaned up successfully" }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { color: colors.muted, children: "All partial resources have been destroyed. You can try deploying again." }) })] })), _jsx(Box, { marginTop: 1, children: _jsx(Text, { color: colors.muted, dimColor: true, children: "Press Esc to exit" }) })] }) }));
+    async function failDeployment(err, fallback) {
+        const message = err instanceof Error ? err.message : fallback;
+        setError(message);
+        setStep("error");
+        setStatus((s) => ({
+            ...s,
+            preflight: step === "preflight" ? "error" : s.preflight,
+            federation: step === "federation" ? "error" : s.federation,
+            helmInstall: step === "helm-install" ? "error" : s.helmInstall,
+            helmUpgradeTls: step === "helm-upgrade-tls" ? "error" : s.helmUpgradeTls,
+        }));
+        await updateDeploymentStatus(name, "failed");
     }
-    // Error screen (non-infra failures or when user skips cleanup)
     if (step === "error") {
-        // Format error message, preserving newlines for multi-line errors
         const errorLines = error?.split("\n") || ["Unknown error"];
-        return (_jsx(BorderBox, { title: "Deployment Failed", children: _jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { color: colors.error, bold: true, children: "\u2717 Error" }), _jsx(Box, { flexDirection: "column", marginTop: 1, children: errorLines.map((line, i) => (_jsx(Text, { color: line.startsWith("  •") ? colors.muted : colors.error, children: line }, i))) }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { color: colors.muted, dimColor: true, children: "Press Esc to exit" }) })] }) }));
+        return (_jsx(BorderBox, { title: "Deployment Failed", children: _jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { color: colors.error, bold: true, children: "\u2717 Error" }), _jsx(Box, { flexDirection: "column", marginTop: 1, children: errorLines.map((line, i) => (_jsx(Text, { color: line.startsWith("  •") ? colors.muted : colors.error, children: line }, i))) })] }) }));
     }
-    // DNS wait screen (only for manual DNS flow)
     if (step === "dns-wait" && config) {
-        return (_jsx(DNSWaitScreen, { domain: config.domain, selfHostedSupabase: config.database.type === "self-hosted", namespace: getNamespace(config.name), onComplete: handleDnsComplete, onSkip: handleDnsSkip }));
+        return (_jsx(DNSWaitScreen, { domain: config.domain, selfHostedSupabase: config.database.type === "self-hosted", builtInObservability: config.features.observability?.clickstack?.enabled ?? true, valkeyAdminIngress: config.features.cache?.valkeyAdmin?.enabled === true &&
+                config.features.cache.valkeyAdmin.exposure === "ingress", valkeyAdminHostname: config.features.cache?.valkeyAdmin?.hostname, namespace: getNamespace(config.name), onComplete: handleDnsComplete, onSkip: handleDnsSkip }));
     }
-    // Complete screen
     if (step === "complete") {
-        const tlsSkipped = status.helmUpgradeTls === "skipped" && !useExternalDns;
-        return (_jsx(BorderBox, { title: "Deployment Complete", children: _jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { color: colors.success, bold: true, children: "\u2713 Rulebricks deployed successfully!" }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsxs(Text, { children: ["URL:", " ", _jsxs(Text, { color: colors.accent, children: ["https://", config?.domain, "/auth/signup"] })] }), useExternalDns && (_jsx(Text, { color: colors.muted, children: "DNS records will be created automatically by external-dns" })), tlsSkipped && (_jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: colors.warning, children: ["\u26A0 TLS not configured. Run `rulebricks deploy ", name, "` again after DNS setup."] }) })), tlsWarning && (_jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: colors.warning, children: ["\u26A0 ", tlsWarning] }) }))] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Next steps:" }), _jsxs(Text, { color: colors.muted, children: [" ", "\u2022 Visit the URL to complete initial setup"] }), _jsxs(Text, { color: colors.muted, children: [" ", "\u2022 Run `rulebricks status ", name, "` to check deployment health"] }), tlsSkipped && (_jsxs(Text, { color: colors.muted, children: [" ", "\u2022 Configure DNS and re-run deploy for TLS"] })), tlsWarning && (_jsxs(Text, { color: colors.muted, children: [" ", "\u2022 Run `rulebricks status ", name, "` to check TLS certificate status"] }))] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { color: colors.muted, dimColor: true, children: "Tip: If the URL isn't accessible yet, your local DNS may need time to propagate." }), _jsxs(Text, { color: colors.muted, dimColor: true, children: ["Flush DNS cache: ", getDnsFlushCommand()] })] })] }) }));
+        const tlsSkipped = status.helmUpgradeTls === "skipped" &&
+            !useExternalDns &&
+            !assumeDnsConfigured;
+        return (_jsx(BorderBox, { title: "Deployment Complete", children: _jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { color: colors.success, bold: true, children: "\u2713 Rulebricks deployed successfully!" }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsxs(Text, { children: ["URL:", " ", _jsxs(Text, { color: colors.accent, children: ["https://", config?.domain, "/auth/signup"] })] }), useExternalDns && (_jsx(Text, { color: colors.muted, children: "DNS records will be created automatically by external-dns" })), tlsSkipped && (_jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: colors.warning, children: ["\u26A0 TLS not configured. Run `rulebricks deploy ", name, "` again after DNS setup."] }) })), tlsWarning && (_jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: colors.warning, children: ["\u26A0 ", tlsWarning] }) })), federationWarning && (_jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: colors.warning, children: ["\u26A0 ", federationWarning] }) }))] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Next steps:" }), _jsx(Text, { color: colors.muted, children: " \u2022 Visit the URL to complete setup" }), _jsxs(Text, { color: colors.muted, children: [" ", "\u2022 Run `rulebricks status ", name, "` to check deployment health"] }), tlsSkipped && (_jsxs(Text, { color: colors.muted, children: [" ", "\u2022 Configure DNS and re-run deploy for TLS"] }))] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { color: colors.muted, dimColor: true, children: "Tip: If the URL isn't accessible yet, your local DNS may need time to propagate." }), _jsxs(Text, { color: colors.muted, dimColor: true, children: ["Flush DNS cache: ", getDnsFlushCommand()] })] })] }) }));
     }
-    // Progress screen
     const helmInstallLabel = useExternalDns
         ? "Helm chart installation (with TLS)"
         : "Helm chart installation";
-    return (_jsx(BorderBox, { title: `Deploying ${name}`, children: _jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(StatusLine, { status: status.preflight, label: "Preflight checks" }), _jsx(StatusLine, { status: status.infrastructure, label: "Infrastructure provisioning", detail: step === "infra-setup"
-                        ? "Setting up workspace"
-                        : step === "infra-init"
-                            ? "Initializing Terraform"
-                            : step === "infra-plan"
-                                ? "Planning changes"
-                                : step === "infra-apply"
-                                    ? "Applying infrastructure"
-                                    : undefined }), _jsx(StatusLine, { status: status.kubeconfig, label: "Kubernetes configuration" }), _jsx(StatusLine, { status: status.helmInstall, label: helmInstallLabel }), !useExternalDns && (_jsxs(_Fragment, { children: [_jsx(StatusLine, { status: status.dnsConfig, label: "DNS configuration" }), _jsx(StatusLine, { status: status.helmUpgradeTls, label: "TLS configuration" })] })), _jsx(StatusLine, { status: status.certCheck, label: "TLS certificate verification" }), step !== "dns-wait" && (_jsx(Box, { marginTop: 1, children: _jsx(Spinner, { label: getStepLabel(step, useExternalDns) }) }))] }) }));
+    // The federation step does the cloud-appropriate per-namespace identity wiring;
+    // label it for the cluster's cloud so it's clear what's happening.
+    const federationLabel = config?.infrastructure.provider === "aws"
+        ? "EKS Pod Identity associations"
+        : config?.infrastructure.provider === "gcp"
+            ? "Workload Identity bindings"
+            : config?.infrastructure.provider === "azure"
+                ? "Azure federated identity credentials"
+                : "Workload identity setup";
+    return (_jsx(BorderBox, { title: `Deploying ${name}`, children: _jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(StatusLine, { status: status.preflight, label: "Preflight checks" }), _jsx(StatusLine, { status: status.kubeconfig, label: "Kubernetes configuration" }), _jsx(StatusLine, { status: status.federation, label: federationLabel }), federationWarning && (_jsx(Box, { marginLeft: 2, children: _jsx(Text, { color: colors.warning, children: federationWarning }) })), _jsx(StatusLine, { status: status.helmInstall, label: helmInstallLabel }), !useExternalDns && (_jsxs(_Fragment, { children: [_jsx(StatusLine, { status: status.dnsConfig, label: "DNS configuration" }), _jsx(StatusLine, { status: status.helmUpgradeTls, label: "TLS configuration" })] })), _jsx(StatusLine, { status: status.certCheck, label: "TLS certificate verification" }), _jsx(Box, { marginTop: 1, children: _jsx(Spinner, { label: getStepLabel(step, useExternalDns) }) })] }) }));
 }
 function getDnsFlushCommand() {
     switch (platform()) {
@@ -478,16 +386,8 @@ function getStepLabel(step, useExternalDns) {
             return "Loading configuration...";
         case "preflight":
             return "Running preflight checks...";
-        case "infra-setup":
-            return "Setting up Terraform workspace...";
-        case "infra-init":
-            return "Initializing Terraform...";
-        case "infra-plan":
-            return "Planning infrastructure changes...";
-        case "infra-apply":
-            return "Creating infrastructure (may take up to 15 minutes)...";
         case "kubeconfig":
-            return "Updating kubeconfig...";
+            return "Refreshing kubeconfig...";
         case "helm-install":
             return useExternalDns
                 ? "Installing Helm chart with TLS..."
@@ -503,5 +403,5 @@ function getStepLabel(step, useExternalDns) {
     }
 }
 export function DeployCommand(props) {
-    return (_jsxs(ThemeProvider, { theme: "deploy", children: [_jsx(Logo, {}), _jsx(DeployCommandInner, { ...props })] }));
+    return (_jsxs(ThemeProvider, { theme: "deploy", children: [_jsx(Logo, {}), _jsx(CommandApprovalProvider, { children: _jsx(DeployCommandInner, { ...props }) })] }));
 }