@rulebricks/cli 2.1.7 → 2.3.1

package/dist/components/Wizard/steps/StorageStep.js

@@ -0,0 +1,592 @@
+import { jsxs as _jsxs, jsx as _jsx, Fragment as _Fragment } from "react/jsx-runtime";
+import { useEffect, useState } from "react";
+import { Box, Text } from "ink";
+import SelectInput from "ink-select-input";
+import TextInput from "ink-text-input";
+import { useWizard } from "../WizardContext.js";
+import { BorderBox, useGatedInput, useTheme } from "../../common/index.js";
+import { Spinner } from "../../common/Spinner.js";
+import { CLOUD_REGIONS, } from "../../../types/index.js";
+import { listRegions, listBucketsInRegion, listAzureBlobContainers, listIamRoles, listAzureManagedIdentities, getAzureTenantId, listGcpServiceAccounts, } from "../../../lib/cloudCli.js";
+import { findClusterSetupDefaultIndex } from "../../../lib/clusterSetupDefaults.js";
+// Sentinel value used in select lists to drop into manual text entry.
+const MANUAL = "__manual__";
+const PROVIDERS = [
+    { label: "AWS S3", value: "s3" },
+    { label: "Azure Blob Storage", value: "azure-blob" },
+    { label: "Google Cloud Storage", value: "gcs" },
+];
+const AZURE_AUTH = [
+    { label: "Workload identity (recommended)", value: "workload-identity" },
+    { label: "Connection string Secret (fallback)", value: "secret" },
+];
+// Healthy cron presets so users don't hand-write cron for DB backups.
+const BACKUP_FREQUENCY_PRESETS = [
+    { label: "Every 30 minutes", value: "*/30 * * * *" },
+    { label: "Hourly", value: "0 * * * *" },
+    { label: "Every 6 hours", value: "0 */6 * * *" },
+    { label: "Every 12 hours", value: "0 */12 * * *" },
+    { label: "Daily (02:00 UTC)", value: "0 2 * * *" },
+    { label: "Weekly (Sun 02:00 UTC)", value: "0 2 * * 0" },
+    { label: "Custom cron…", value: "__custom__" },
+];
+const CUSTOM_CRON = "__custom__";
+function providerToCloud(provider) {
+    if (provider === "azure-blob")
+        return "azure";
+    if (provider === "gcs")
+        return "gcp";
+    return "aws";
+}
+export function storageProviderForCloud(provider) {
+    if (provider === "azure")
+        return "azure-blob";
+    if (provider === "gcp")
+        return "gcs";
+    return "s3";
+}
+// GKE zonal clusters report a zone (e.g. us-central1-a) as their location, but
+// object storage wants the region (us-central1). GCP zones always end in a
+// single-letter suffix; AWS/Azure regions never do, so this is GCS-only.
+function gcpZoneToRegion(location) {
+    return location.replace(/-[a-z]$/, "");
+}
+export function storageRegionForCloud(cloudProvider, clusterRegion, savedStorageProvider, savedStorageRegion) {
+    const provider = storageProviderForCloud(cloudProvider);
+    if (savedStorageProvider === provider && savedStorageRegion) {
+        return savedStorageRegion;
+    }
+    return provider === "gcs" ? gcpZoneToRegion(clusterRegion) : clusterRegion;
+}
+export function StorageStep({ onComplete, onBack }) {
+    const { state, dispatch } = useWizard();
+    const { colors } = useTheme();
+    // Object storage always lives in the same cloud as the cluster, so derive the
+    // provider from the cluster's cloud instead of asking again. (No real scenario
+    // deploys to e.g. an AKS cluster and writes to S3.)
+    const provider = storageProviderForCloud(state.provider);
+    // The storage region is likewise assumed to be the cluster's region, so the
+    // region question is skipped whenever one is known (Esc from the bucket list
+    // still drops back to region selection for the rare cross-region setup).
+    // Only the manual-cluster path (no region captured) asks up front.
+    const savedStorageMatchesProvider = state.storageProvider === provider;
+    const initialRegion = storageRegionForCloud(state.provider, state.region, state.storageProvider, state.storageRegion) || "";
+    const [field, setField] = useState(initialRegion ? "bucket-loading" : "region-loading");
+    const [region, setRegion] = useState(initialRegion);
+    const [bucket, setBucket] = useState(savedStorageMatchesProvider ? state.storageBucket || "" : "");
+    const [roleArn, setRoleArn] = useState(savedStorageMatchesProvider && provider === "s3"
+        ? state.storageAwsIamRoleArn || ""
+        : "");
+    const [azureContainer, setAzureContainer] = useState(savedStorageMatchesProvider && provider === "azure-blob"
+        ? state.storageAzureBlobContainer || "rulebricks"
+        : "rulebricks");
+    const [authMode, setAuthMode] = useState(savedStorageMatchesProvider && provider === "azure-blob"
+        ? state.storageCloudAuthMode || "workload-identity"
+        : "workload-identity");
+    const [azureClientId, setAzureClientId] = useState(savedStorageMatchesProvider && provider === "azure-blob"
+        ? state.storageAzureBlobClientId || ""
+        : "");
+    const [azureTenantId, setAzureTenantId] = useState(savedStorageMatchesProvider && provider === "azure-blob"
+        ? state.storageAzureBlobTenantId || ""
+        : "");
+    const [tenantAutoDetected, setTenantAutoDetected] = useState(false);
+    const [azureSecretRef, setAzureSecretRef] = useState(savedStorageMatchesProvider && provider === "azure-blob"
+        ? state.storageAzureBlobConnectionStringSecretRef || ""
+        : "");
+    const [gcpServiceAccount, setGcpServiceAccount] = useState(savedStorageMatchesProvider && provider === "gcs"
+        ? state.storageGcpServiceAccountEmail || ""
+        : "");
+    // Database backups are configured in this same step only when the chart owns
+    // the in-cluster Postgres. Managed/external databases own their own backups.
+    const usesInClusterPostgres = state.databaseType === "self-hosted" && state.postgresMode !== "external";
+    const [backupEnabled, setBackupEnabled] = useState(state.backupEnabled);
+    const [backupSchedule, setBackupSchedule] = useState(state.backupSchedule || "0 2 * * *");
+    const [backupRetentionDays, setBackupRetentionDays] = useState(String(state.backupRetentionDays || 7));
+    // Dynamic resource lists (empty => manual entry fallback).
+    const [availableRegions, setAvailableRegions] = useState([]);
+    const [availableBuckets, setAvailableBuckets] = useState([]);
+    const [availableContainers, setAvailableContainers] = useState([]);
+    const [availableRoles, setAvailableRoles] = useState([]);
+    const [availableIdentities, setAvailableIdentities] = useState([]);
+    const [availableServiceAccounts, setAvailableServiceAccounts] = useState([]);
+    const [isRefreshing, setIsRefreshing] = useState(false);
+    const [error, setError] = useState(null);
+    const bucketLabel = provider === "azure-blob" ? "Storage account" : "Bucket";
+    // ===== Loaders =====
+    const loadRegions = async (selected) => {
+        const cloud = providerToCloud(selected);
+        setField("region-loading");
+        try {
+            const regions = await listRegions(cloud);
+            setAvailableRegions(regions.length > 0 ? regions : CLOUD_REGIONS[cloud]);
+        }
+        catch {
+            setAvailableRegions(CLOUD_REGIONS[cloud]);
+        }
+        setField("region");
+    };
+    // Provider (and usually region) are derived from the cluster, so jump
+    // straight to bucket discovery when the region is already known.
+    useEffect(() => {
+        if (initialRegion) {
+            loadBuckets(initialRegion);
+        }
+        else {
+            loadRegions(provider);
+        }
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, []);
+    const loadBuckets = async (selectedRegion) => {
+        const cloud = providerToCloud(provider);
+        setField("bucket-loading");
+        try {
+            const buckets = await listBucketsInRegion(cloud, selectedRegion);
+            setAvailableBuckets(buckets);
+        }
+        catch {
+            setAvailableBuckets([]);
+        }
+        setField("bucket");
+    };
+    const proceedAfterBucket = () => {
+        if (provider === "s3") {
+            loadRoles();
+        }
+        else if (provider === "gcs") {
+            loadServiceAccounts();
+        }
+        else {
+            loadContainers(bucket);
+        }
+    };
+    // Narrow huge account-wide lists to the Rulebricks workload identity from
+    // cluster-setup (by cluster name or the "rulebricks" marker). Falls back to the
+    // full list if nothing matches, and "Enter manually…" is always available.
+    const relevantToRulebricks = (name) => {
+        const n = name.toLowerCase();
+        const cluster = (state.clusterName || "").toLowerCase();
+        return n.includes("rulebricks") || (cluster !== "" && n.includes(cluster));
+    };
+    const loadRoles = async () => {
+        setField("s3-role-loading");
+        try {
+            const roles = await listIamRoles();
+            const narrowed = roles.filter((r) => relevantToRulebricks(r.name));
+            setAvailableRoles(narrowed.length > 0 ? narrowed : roles);
+        }
+        catch {
+            setAvailableRoles([]);
+        }
+        setField("s3-role");
+    };
+    const loadServiceAccounts = async () => {
+        setField("gcp-sa-loading");
+        try {
+            const accounts = await listGcpServiceAccounts();
+            const narrowed = accounts.filter((s) => relevantToRulebricks(s.email));
+            setAvailableServiceAccounts(narrowed.length > 0 ? narrowed : accounts);
+        }
+        catch {
+            setAvailableServiceAccounts([]);
+        }
+        setField("gcp-sa");
+    };
+    const loadContainers = async (account) => {
+        setField("azure-container-loading");
+        try {
+            setAvailableContainers(await listAzureBlobContainers(account));
+        }
+        catch {
+            setAvailableContainers([]);
+        }
+        setField("azure-container");
+    };
+    const loadAzureIdentities = async () => {
+        setField("azure-identity-loading");
+        try {
+            const [identities, tenant] = await Promise.all([
+                listAzureManagedIdentities(),
+                azureTenantId ? Promise.resolve(null) : getAzureTenantId(),
+            ]);
+            // Hide the identities AKS creates for itself (the kubelet "-agentpool" and
+            // the control-plane "<cluster>-identity") -- they are never the Rulebricks
+            // workload identity, and listing them just makes the choice confusing.
+            const cluster = (state.clusterName || "").toLowerCase();
+            const workloadIdentities = identities.filter((i) => {
+                const name = i.name.toLowerCase();
+                if (name.endsWith("-agentpool"))
+                    return false;
+                if (cluster && name === `${cluster}-identity`)
+                    return false;
+                return true;
+            });
+            setAvailableIdentities(workloadIdentities.length > 0 ? workloadIdentities : identities);
+            if (tenant) {
+                setAzureTenantId(tenant);
+                setTenantAutoDetected(true);
+            }
+        }
+        catch {
+            setAvailableIdentities([]);
+        }
+        setField("azure-client");
+    };
+    const refreshList = async () => {
+        if (isRefreshing)
+            return;
+        const cloud = providerToCloud(provider);
+        setIsRefreshing(true);
+        try {
+            if (field === "bucket") {
+                setAvailableBuckets(await listBucketsInRegion(cloud, region));
+            }
+            else if (field === "azure-container") {
+                setAvailableContainers(await listAzureBlobContainers(bucket));
+            }
+        }
+        catch {
+            // Keep existing list on error
+        }
+        setIsRefreshing(false);
+    };
+    // ===== Persistence =====
+    const persistStorage = () => {
+        dispatch({
+            type: "SET_STORAGE_CONFIG",
+            config: {
+                storageProvider: provider,
+                storageRegion: region,
+                storageBucket: bucket,
+                storageCloudAuthMode: provider === "azure-blob" ? authMode : "workload-identity",
+                storageAwsIamRoleArn: provider === "s3" ? roleArn : "",
+                storageAzureBlobContainer: provider === "azure-blob" ? azureContainer : "",
+                storageAzureBlobClientId: provider === "azure-blob" && authMode === "workload-identity"
+                    ? azureClientId
+                    : "",
+                storageAzureBlobTenantId: provider === "azure-blob" && authMode === "workload-identity"
+                    ? azureTenantId
+                    : "",
+                storageAzureBlobConnectionStringSecretRef: provider === "azure-blob" && authMode === "secret"
+                    ? azureSecretRef
+                    : "",
+                storageGcpServiceAccountEmail: provider === "gcs" ? gcpServiceAccount : "",
+            },
+        });
+    };
+    // After object storage is configured, deployments with bundled Postgres
+    // continue into the database backup policy (same bucket); external databases
+    // are done here.
+    const completeFromStorage = () => {
+        persistStorage();
+        if (usesInClusterPostgres) {
+            setField("backup-enabled");
+        }
+        else {
+            onComplete();
+        }
+    };
+    const finishBackups = () => {
+        const parsedRetention = Number.parseInt(backupRetentionDays, 10);
+        dispatch({ type: "SET_BACKUP_ENABLED", enabled: backupEnabled });
+        dispatch({
+            type: "SET_BACKUP_SCHEDULE",
+            schedule: backupSchedule || "0 2 * * *",
+        });
+        dispatch({
+            type: "SET_BACKUP_RETENTION_DAYS",
+            retentionDays: Number.isFinite(parsedRetention) ? parsedRetention : 7,
+        });
+        onComplete();
+    };
+    // ===== Back navigation =====
+    const handleBack = () => {
+        setError(null);
+        switch (field) {
+            case "region":
+            case "region-loading":
+                // Provider is derived from the cluster cloud (no provider step), so the
+                // first storage field returns to the previous wizard step.
+                onBack();
+                break;
+            case "bucket":
+            case "bucket-loading":
+            case "bucket-manual":
+                // The region list may not have been loaded yet when the region
+                // question was skipped (region derived from the cluster).
+                if (availableRegions.length === 0) {
+                    loadRegions(provider);
+                }
+                else {
+                    setField("region");
+                }
+                break;
+            case "s3-role":
+            case "s3-role-loading":
+            case "s3-role-manual":
+            case "azure-container":
+            case "azure-container-loading":
+            case "azure-container-manual":
+            case "gcp-sa":
+            case "gcp-sa-loading":
+            case "gcp-sa-manual":
+                setField("bucket");
+                break;
+            case "azure-auth":
+                setField("azure-container");
+                break;
+            case "azure-client":
+            case "azure-identity-loading":
+            case "azure-client-manual":
+                setField("azure-auth");
+                break;
+            case "azure-tenant":
+                setField("azure-client");
+                break;
+            case "azure-secret":
+                setField("azure-auth");
+                break;
+            case "done":
+                if (provider === "s3")
+                    setField("s3-role");
+                else if (provider === "gcs")
+                    setField("gcp-sa");
+                else
+                    setField(authMode === "secret" ? "azure-secret" : "azure-tenant");
+                break;
+            case "backup-enabled":
+                setField("done");
+                break;
+            case "backup-frequency":
+            case "backup-frequency-custom":
+                setField("backup-enabled");
+                break;
+            case "backup-retention":
+                setField("backup-frequency");
+                break;
+            case "backup-done":
+                setField("backup-retention");
+                break;
+        }
+    };
+    useGatedInput((input, key) => {
+        if (key.escape) {
+            handleBack();
+            return;
+        }
+        if (input.toLowerCase() === "r" &&
+            (field === "bucket" || field === "azure-container")) {
+            refreshList();
+            return;
+        }
+        if (field === "done" && key.return) {
+            completeFromStorage();
+            return;
+        }
+        if (field === "backup-enabled") {
+            if (input === " " || input.toLowerCase() === "x") {
+                setBackupEnabled((value) => !value);
+            }
+            else if (key.return) {
+                if (backupEnabled) {
+                    setField("backup-frequency");
+                }
+                else {
+                    finishBackups();
+                }
+            }
+            return;
+        }
+        if (field === "backup-done" && key.return) {
+            finishBackups();
+        }
+    });
+    // ===== Selection handlers =====
+    const handleRegionSelect = (item) => {
+        setRegion(item.value);
+        loadBuckets(item.value);
+    };
+    const handleBucketSelect = (item) => {
+        if (item.value === MANUAL) {
+            setField("bucket-manual");
+            return;
+        }
+        setBucket(item.value);
+        proceedAfterBucket();
+    };
+    const handleBucketManualSubmit = () => {
+        if (!bucket.trim()) {
+            setError(`${bucketLabel} name is required`);
+            return;
+        }
+        setError(null);
+        proceedAfterBucket();
+    };
+    const handleRoleSelect = (item) => {
+        if (item.value === MANUAL) {
+            setField("s3-role-manual");
+            return;
+        }
+        setRoleArn(item.value);
+        setField("done");
+    };
+    const handleRoleManualSubmit = () => {
+        if (!roleArn.startsWith("arn:")) {
+            setError("Enter a valid IAM role ARN (arn:aws:iam::...)");
+            return;
+        }
+        setError(null);
+        setField("done");
+    };
+    const handleServiceAccountSelect = (item) => {
+        if (item.value === MANUAL) {
+            setField("gcp-sa-manual");
+            return;
+        }
+        setGcpServiceAccount(item.value);
+        setField("done");
+    };
+    const handleServiceAccountManualSubmit = () => {
+        if (!gcpServiceAccount.includes("@")) {
+            setError("Enter a valid service account email");
+            return;
+        }
+        setError(null);
+        setField("done");
+    };
+    const handleContainerSelect = (item) => {
+        if (item.value === MANUAL) {
+            setField("azure-container-manual");
+            return;
+        }
+        setAzureContainer(item.value);
+        setField("azure-auth");
+    };
+    const handleContainerManualSubmit = () => {
+        if (!azureContainer.trim()) {
+            setError("Container name is required");
+            return;
+        }
+        setError(null);
+        setField("azure-auth");
+    };
+    const handleAuthSelect = (item) => {
+        const mode = item.value;
+        setAuthMode(mode);
+        if (mode === "workload-identity") {
+            loadAzureIdentities();
+        }
+        else {
+            setField("azure-secret");
+        }
+    };
+    const handleIdentitySelect = (item) => {
+        if (item.value === MANUAL) {
+            setField("azure-client-manual");
+            return;
+        }
+        setAzureClientId(item.value);
+        setField("azure-tenant");
+    };
+    const handleIdentityManualSubmit = () => {
+        if (!azureClientId.trim()) {
+            setError("Managed identity client ID is required");
+            return;
+        }
+        setError(null);
+        setField("azure-tenant");
+    };
+    const handleTenantSubmit = () => {
+        if (!azureTenantId.trim()) {
+            setError("Azure tenant ID is required");
+            return;
+        }
+        setError(null);
+        setField("done");
+    };
+    const handleSecretSubmit = () => {
+        if (!azureSecretRef.includes(":")) {
+            setError("Use secret-name:key format");
+            return;
+        }
+        setError(null);
+        setField("done");
+    };
+    // ===== Backup handlers =====
+    const handleBackupFrequencySelect = (item) => {
+        if (item.value === CUSTOM_CRON) {
+            setField("backup-frequency-custom");
+            return;
+        }
+        setBackupSchedule(item.value);
+        setField("backup-retention");
+    };
+    const handleBackupFrequencyCustomSubmit = () => {
+        if (!backupSchedule.trim()) {
+            setError("Enter a cron expression or go back to pick a preset");
+            return;
+        }
+        setError(null);
+        setField("backup-retention");
+    };
+    const handleBackupRetentionSubmit = () => {
+        const parsed = Number.parseInt(backupRetentionDays, 10);
+        if (!Number.isFinite(parsed) || parsed < 2) {
+            setError("Retention must be greater than 1 (at least 2 days)");
+            return;
+        }
+        setError(null);
+        setField("backup-done");
+    };
+    // ===== Item builders =====
+    const withManual = (items) => [
+        ...items,
+        { label: "Enter manually…", value: MANUAL },
+    ];
+    const renderSelect = (items, onSelect, initialIndex = 0) => (_jsx(Box, { marginTop: 1, height: 10, flexDirection: "column", overflowY: "hidden", children: _jsx(SelectInput, { items: items, onSelect: onSelect, limit: 8, initialIndex: initialIndex, indicatorComponent: () => null, itemComponent: ({ isSelected, label }) => (_jsxs(Text, { color: isSelected ? colors.accent : undefined, children: [isSelected ? "❯ " : "  ", label] })) }) }));
+    // Summary of what's chosen so far (shown on identity sub-steps).
+    const ChosenSummary = () => (_jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" ", PROVIDERS.find((p) => p.value === provider)?.label] })] }), _jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" Region: ", region] })] }), _jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" ", bucketLabel, ": ", bucket] })] })] }));
+    const storageTitle = usesInClusterPostgres
+        ? "Storage & Backups"
+        : "Object Storage";
+    const storagePurpose = usesInClusterPostgres
+        ? "Decision logs and database backups are stored as prefixes within it."
+        : "Decision logs are stored as a prefix within it.";
+    const cloudAccessPurpose = usesInClusterPostgres
+        ? "decision logs, database backups, and metrics"
+        : "decision logs and metrics";
+    return (_jsxs(BorderBox, { title: storageTitle, children: [_jsxs(Box, { flexDirection: "column", marginBottom: 1, children: [_jsx(Text, { children: "Configure one bucket/container for all Rulebricks data." }), _jsx(Text, { color: "gray", dimColor: true, children: storagePurpose })] }), field === "region-loading" && (_jsx(Spinner, { label: "Loading available regions..." })), field === "region" && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Select Region" }), _jsx(Text, { color: "gray", dimColor: true, children: "Region where decision logs will be stored." }), renderSelect(availableRegions.map((r) => ({ label: r, value: r })), handleRegionSelect, Math.max(0, availableRegions.indexOf(region)))] })), field === "bucket-loading" && (_jsx(Spinner, { label: `Loading ${bucketLabel.toLowerCase()}s in ${region}...` })), field === "bucket" && (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Text, { bold: true, children: ["Select ", provider === "azure-blob" ? "Storage Account" : "Bucket"] }), _jsxs(Text, { color: "gray", dimColor: true, children: ["Existing ", bucketLabel.toLowerCase(), "s in ", region, "."] }), isRefreshing ? (_jsx(Box, { marginTop: 1, children: _jsx(Spinner, { label: "Refreshing list..." }) })) : (_jsxs(_Fragment, { children: [availableBuckets.length === 0 && (_jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: "yellow", children: ["None found in ", region, ". Press R to refresh or enter manually."] }) })), renderSelect(withManual(availableBuckets.map((b) => ({ label: b, value: b }))), handleBucketSelect, Math.max(0, findClusterSetupDefaultIndex(availableBuckets, "decision-logs-bucket", {
+                                provider: providerToCloud(provider),
+                                clusterName: state.clusterName,
+                            })))] })), _jsx(Box, { marginTop: 1, children: _jsx(Text, { color: "gray", dimColor: true, children: "R to refresh \u2022 \u2191/\u2193 to navigate \u2022 Enter to select \u2022 Esc to change region" }) })] })), field === "bucket-manual" && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: provider === "azure-blob"
+                            ? "Storage Account Name"
+                            : "Bucket Name" }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: bucket, onChange: setBucket, onSubmit: handleBucketManualSubmit, placeholder: provider === "azure-blob" ? "mystorageaccount" : "my-bucket" }) })] })), field === "s3-role-loading" && (_jsx(Spinner, { label: "Loading IAM roles..." })), field === "s3-role" && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Select the Rulebricks IAM role" }), _jsxs(Text, { color: "gray", dimColor: true, children: ["The single role from cluster-setup (", `${state.clusterName || "<cluster>"}-rulebricks`, "), used for all cloud access: ", cloudAccessPurpose, "."] }), (() => {
+                        const recommendedIndex = Math.max(0, findClusterSetupDefaultIndex(availableRoles.map((r) => r.name), "decision-logs-identity", { provider: "aws", clusterName: state.clusterName }));
+                        return renderSelect(withManual(availableRoles.map((r, idx) => ({
+                            label: idx === recommendedIndex
+                                ? `${r.name}  - recommended`
+                                : r.name,
+                            value: r.arn,
+                        }))), handleRoleSelect, recommendedIndex);
+                    })(), _jsx(ChosenSummary, {})] })), field === "s3-role-manual" && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: "S3 IRSA Role ARN" }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: roleArn, onChange: setRoleArn, onSubmit: handleRoleManualSubmit, placeholder: "arn:aws:iam::123456789012:role/rulebricks-vector" }) }), _jsx(ChosenSummary, {})] })), field === "gcp-sa-loading" && (_jsx(Spinner, { label: "Loading service accounts..." })), field === "gcp-sa" && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Select the Rulebricks Google service account" }), _jsxs(Text, { color: "gray", dimColor: true, children: ["The single service account from cluster-setup, used for all cloud access: ", cloudAccessPurpose, "."] }), (() => {
+                        const recommendedIndex = Math.max(0, findClusterSetupDefaultIndex(availableServiceAccounts.map((s) => s.email), "decision-logs-identity", { provider: "gcp", clusterName: state.clusterName }));
+                        return renderSelect(withManual(availableServiceAccounts.map((s, idx) => ({
+                            label: idx === recommendedIndex
+                                ? `${s.email}  - recommended`
+                                : s.email,
+                            value: s.email,
+                        }))), handleServiceAccountSelect, recommendedIndex);
+                    })(), _jsx(ChosenSummary, {})] })), field === "gcp-sa-manual" && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Google Service Account Email" }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: gcpServiceAccount, onChange: setGcpServiceAccount, onSubmit: handleServiceAccountManualSubmit, placeholder: "rulebricks-vector@project.iam.gserviceaccount.com" }) }), _jsx(ChosenSummary, {})] })), field === "azure-container-loading" && (_jsx(Spinner, { label: "Loading blob containers..." })), field === "azure-container" && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Select Blob Container" }), _jsxs(Text, { color: "gray", dimColor: true, children: ["Container in ", bucket, " where decision logs are written."] }), isRefreshing ? (_jsx(Box, { marginTop: 1, children: _jsx(Spinner, { label: "Refreshing list..." }) })) : (_jsxs(_Fragment, { children: [availableContainers.length === 0 && (_jsx(Box, { marginTop: 1, children: _jsx(Text, { color: "yellow", children: "None found. Press R to refresh or enter manually." }) })), renderSelect(withManual(availableContainers.map((c) => ({ label: c, value: c }))), handleContainerSelect, Math.max(0, findClusterSetupDefaultIndex(availableContainers, "decision-logs-container", { provider: "azure", clusterName: state.clusterName })))] })), _jsx(Box, { marginTop: 1, children: _jsx(Text, { color: "gray", dimColor: true, children: "R to refresh \u2022 \u2191/\u2193 to navigate \u2022 Enter to select" }) })] })), field === "azure-container-manual" && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Azure Blob Container" }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: azureContainer, onChange: setAzureContainer, onSubmit: handleContainerManualSubmit, placeholder: "rulebricks-logs" }) })] })), field === "azure-auth" && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Azure Blob Authentication" }), _jsx(Text, { color: "gray", dimColor: true, children: "Workload identity is recommended; connection-string Secret is a fallback for clusters without Azure Workload Identity." }), renderSelect(AZURE_AUTH, handleAuthSelect)] })), field === "azure-identity-loading" && (_jsx(Spinner, { label: "Loading managed identities..." })), field === "azure-client" && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Select the Rulebricks workload identity" }), _jsxs(Text, { color: "gray", dimColor: true, children: ["The single identity from cluster-setup (", `${state.clusterName || "<cluster>"}-rulebricks`, "), used for all cloud access: ", cloudAccessPurpose, "."] }), (() => {
+                        const recommendedIndex = Math.max(0, findClusterSetupDefaultIndex(availableIdentities.map((i) => i.name), "decision-logs-identity", { provider: "azure", clusterName: state.clusterName }));
+                        return renderSelect(withManual(availableIdentities.map((i, idx) => ({
+                            label: idx === recommendedIndex
+                                ? `${i.name} (${i.clientId})  - recommended`
+                                : `${i.name} (${i.clientId})`,
+                            value: i.clientId,
+                        }))), handleIdentitySelect, recommendedIndex);
+                    })()] })), field === "azure-client-manual" && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Managed Identity Client ID" }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: azureClientId, onChange: setAzureClientId, onSubmit: handleIdentityManualSubmit, placeholder: "00000000-0000-0000-0000-000000000000" }) })] })), field === "azure-tenant" && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Azure Tenant ID" }), _jsx(Text, { color: "gray", dimColor: true, children: tenantAutoDetected
+                            ? "Auto-detected from your Azure CLI session - edit if needed."
+                            : "Tenant ID used by Azure Workload Identity." }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: azureTenantId, onChange: setAzureTenantId, onSubmit: handleTenantSubmit, placeholder: "00000000-0000-0000-0000-000000000000" }) })] })), field === "azure-secret" && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Azure Connection String Secret" }), _jsx(Text, { color: "gray", dimColor: true, children: "Existing Kubernetes Secret key in the format name:key." }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: azureSecretRef, onChange: setAzureSecretRef, onSubmit: handleSecretSubmit, placeholder: "azure-blob-logs:connection-string" }) })] })), field === "done" && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { color: colors.success, children: "Storage backend configured." }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsxs(Text, { children: ["Provider: ", PROVIDERS.find((p) => p.value === provider)?.label] }), _jsxs(Text, { children: [bucketLabel, ": ", bucket] }), _jsxs(Text, { children: ["Region: ", region] }), provider === "azure-blob" && (_jsxs(Text, { children: ["Container: ", azureContainer] }))] }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { color: colors.muted, children: usesInClusterPostgres
+                                ? "Press Enter to configure database backups"
+                                : "Press Enter to continue" }) })] })), field === "backup-enabled" && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Database Backups" }), _jsxs(Text, { color: "gray", dimColor: true, children: ["Logical pg_dump backups of the in-cluster Postgres are written to the same bucket under the db-backups/ prefix. Restore any time with `rulebricks restore ", state.name, "`."] }), _jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: colors.accent, children: [backupEnabled ? "[x]" : "[ ]", " Enable database backups"] }) }), _jsx(Text, { color: colors.muted, children: "Space toggles backups. Enter continues." })] })), field === "backup-frequency" && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Backup frequency" }), _jsx(Text, { color: "gray", dimColor: true, children: "How often a backup is taken (UTC cron)." }), renderSelect(BACKUP_FREQUENCY_PRESETS, handleBackupFrequencySelect, Math.max(0, BACKUP_FREQUENCY_PRESETS.findIndex((p) => p.value === backupSchedule)))] })), field === "backup-frequency-custom" && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Custom cron schedule" }), _jsx(Text, { color: "gray", dimColor: true, children: "Standard cron format (UTC)." }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: backupSchedule, onChange: setBackupSchedule, onSubmit: handleBackupFrequencyCustomSubmit, placeholder: "0 2 * * *" }) })] })), field === "backup-retention" && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Retention days" }), _jsx(Text, { color: "gray", dimColor: true, children: "Backups older than this are pruned from object storage (must be greater than 1)." }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: backupRetentionDays, onChange: setBackupRetentionDays, onSubmit: handleBackupRetentionSubmit, placeholder: "7" }) })] })), field === "backup-done" && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { color: colors.success, children: "Database backups configured." }), _jsxs(Text, { children: ["Frequency:", " ", BACKUP_FREQUENCY_PRESETS.find((p) => p.value === backupSchedule)
+                                ?.label || backupSchedule] }), _jsxs(Text, { children: ["Retention: ", backupRetentionDays, " days"] }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { color: colors.muted, children: "Press Enter to continue" }) })] })), error && (_jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: "red", children: ["\u2717 ", error] }) })), _jsx(Box, { marginTop: 1, children: _jsx(Text, { color: "gray", dimColor: true, children: "Esc to go back \u2022 Enter to continue" }) })] }));
+}