@rulebricks/cli 2.1.7 → 2.3.1

package/cluster-setup/gcp/README.md

@@ -1,6 +1,6 @@
 # GCP Cluster Setup
 
-Use these commands to create a minimum GKE cluster that can run Rulebricks without using the Rulebricks CLI Terraform flow. GCP does not have an `eksctl`-style cluster YAML or a concise Bicep equivalent; the most familiar native interface is `gcloud`.
+Use these commands to create a compact GKE cluster that can run Rulebricks before installing with the Rulebricks CLI. GCP does not have an `eksctl`-style cluster YAML or a concise Bicep equivalent; the most familiar native interface is `gcloud`.
 
 ## Files
 
@@ -11,10 +11,11 @@ Use these commands to create a minimum GKE cluster that can run Rulebricks witho
 - Cluster name: `rulebricks-cluster` (`Core cluster parameters` block -> `CLUSTER_NAME`)
 - Region / zone: `us-central1` / `us-central1-a` (`Core cluster parameters` block -> `REGION` / `ZONE`)
 - Kubernetes version: `1.34` (`Core cluster parameters` block -> `KUBERNETES_VERSION`)
-- Node count: `4` (`Core cluster parameters` block -> `NODE_COUNT`)
-- Machine type: `c4a-standard-2` (`Core cluster parameters` block -> `MACHINE_TYPE`)
+- Initial node count: `2` (`Core cluster parameters` block -> `NODE_COUNT`)
+- Autoscaling range: `2-4` nodes (`Core cluster parameters` block -> `NODE_COUNT` / `MAX_NODE_COUNT`)
+- Machine type: `n2-standard-4` (`Core cluster parameters` block -> `MACHINE_TYPE`)
 - Disk size (GB): `20` (`Core cluster parameters` block -> `DISK_SIZE`)
-- Disk type: `hyperdisk-balanced` (`Core cluster parameters` block -> `DISK_TYPE`)
+- Disk type: `pd-balanced` (`Core cluster parameters` block -> `DISK_TYPE`)
 
 ## Check Access
 
@@ -29,7 +30,7 @@ If API warnings appear, run the suggested `gcloud services enable` commands and
 
 ## Create The Cluster
 
-Set the core cluster parameters. The default example uses `us-central1-a` because it supports C4A ARM64 nodes.
+Set the core cluster parameters.
 
 ```bash
 PROJECT_ID="$(gcloud config get-value project)"
@@ -37,10 +38,11 @@ CLUSTER_NAME=rulebricks-cluster
 REGION=us-central1
 ZONE=us-central1-a
 KUBERNETES_VERSION="1.34"
-NODE_COUNT=4
-MACHINE_TYPE=c4a-standard-2
+NODE_COUNT=2
+MAX_NODE_COUNT=4
+MACHINE_TYPE=n2-standard-4
 DISK_SIZE=20
-DISK_TYPE=hyperdisk-balanced
+DISK_TYPE=pd-balanced
 ```
 
 Enable required APIs:
@@ -54,7 +56,7 @@ gcloud services enable \
   --project "$PROJECT_ID"
 ```
 
-Create the VPC, subnet, NAT, and internal firewall rule:
+Create the VPC, subnet, NAT, and firewall rules:
 
 ```bash
 gcloud compute networks create "${CLUSTER_NAME}-vpc" \
@@ -87,6 +89,13 @@ gcloud compute firewall-rules create "${CLUSTER_NAME}-allow-internal" \
   --allow tcp:0-65535,udp:0-65535,icmp \
   --source-ranges 10.0.0.0/16,10.1.0.0/16,10.2.0.0/16 \
   --target-tags "gke-${CLUSTER_NAME}"
+
+gcloud compute firewall-rules create "${CLUSTER_NAME}-allow-web" \
+  --project "$PROJECT_ID" \
+  --network "${CLUSTER_NAME}-vpc" \
+  --allow tcp:80,tcp:443 \
+  --source-ranges 0.0.0.0/0 \
+  --target-tags "gke-${CLUSTER_NAME}"
 ```
 
 Create the GKE cluster:
@@ -113,13 +122,15 @@ gcloud container clusters create "$CLUSTER_NAME" \
   --node-pool rulebricks-nodes \
   --machine-type "$MACHINE_TYPE" \
   --num-nodes "$NODE_COUNT" \
+  --enable-autoscaling \
+  --min-nodes "$NODE_COUNT" \
+  --max-nodes "$MAX_NODE_COUNT" \
   --disk-type "$DISK_TYPE" \
   --disk-size "$DISK_SIZE" \
   --scopes cloud-platform \
   --workload-metadata GKE_METADATA \
   --enable-autorepair \
   --enable-autoupgrade \
-  --node-labels environment=rulebricks \
   --tags "gke-${CLUSTER_NAME}"
 ```
 
@@ -131,42 +142,48 @@ gcloud container clusters get-credentials "$CLUSTER_NAME" \
   --project "$PROJECT_ID"
 ```
 
-Use `rulebricks init` with **Use existing Kubernetes cluster** after kubeconfig works.
+Use `rulebricks init` after kubeconfig works, then select this cluster from the GCP cluster list.
 
-## Optional Identity Setup
+## Multi-Node Scheduling
 
-If you use GCS decision-log export, bind the `vector` Kubernetes service account to a Google service account that can write to the bucket:
+The default configuration starts with two 4-vCPU nodes for a simple standalone deployment and can scale out to four nodes. Splitting the baseline across two nodes provides more Kubernetes pod slots than a single large node while keeping the initial 8-vCPU footprint. Rulebricks worker pods use soft scheduling preferences so Kubernetes can place them away from the rest of the deployment when extra nodes are available. No node labels or taints are required.
+
+## Identity Setup (one service account, one bucket)
+
+All Rulebricks data lives in a single GCS bucket; decision logs and database
+backups are key prefixes (`decision-logs/`, `db-backups/`) within it. Create one
+Google service account and the bucket — this is deployment-independent:
 
 ```bash
-NAMESPACE=rulebricks-demo
 PROJECT_ID="$(gcloud config get-value project)"
-GSA=rulebricks-vector@"$PROJECT_ID".iam.gserviceaccount.com
+CLUSTER_NAME=rulebricks-cluster
+GSA=rulebricks@"$PROJECT_ID".iam.gserviceaccount.com
+BUCKET="$CLUSTER_NAME-data"
 
-gcloud iam service-accounts create rulebricks-vector \
-  --project "$PROJECT_ID"
+gcloud iam service-accounts create rulebricks --project "$PROJECT_ID"
 
-gcloud storage buckets add-iam-policy-binding gs://<bucket-name> \
+# Create the single data bucket and grant read/write/delete (delete is needed so
+# the backup job can prune backups older than the retention window).
+gcloud storage buckets create "gs://$BUCKET" --project "$PROJECT_ID" --location "$REGION"
+gcloud storage buckets add-iam-policy-binding "gs://$BUCKET" \
   --member "serviceAccount:$GSA" \
-  --role roles/storage.objectCreator
-
-gcloud iam service-accounts add-iam-policy-binding "$GSA" \
-  --project "$PROJECT_ID" \
-  --role roles/iam.workloadIdentityUser \
-  --member "serviceAccount:$PROJECT_ID.svc.id.goog[$NAMESPACE/vector]"
-```
+  --role roles/storage.objectAdmin
 
-Annotate the service account after the Rulebricks namespace exists:
-
-```bash
-kubectl annotate serviceaccount vector \
-  --namespace "$NAMESPACE" \
-  iam.gke.io/gcp-service-account="$GSA"
+# Prometheus remote write to Google Managed Prometheus (skip if unused).
+gcloud projects add-iam-policy-binding "$PROJECT_ID" \
+  --member "serviceAccount:$GSA" \
+  --role roles/monitoring.metricWriter
 ```
 
-Enter the Google service account email when prompted by the CLI.
+The per-namespace `roles/iam.workloadIdentityUser` bindings (for `vector`,
+`<release>-backup`, and `prometheus`) are **created by the Rulebricks CLI at
+`rulebricks deploy` time**, since they're namespace-scoped — so this setup stays
+generic and one cluster can host many deployments. Enter the Google service
+account email (`$GSA`) and the `$BUCKET` name when prompted by the CLI.
 
 ## Notes
 
-- The example creates four `c4a-standard-2` ARM64 nodes with `hyperdisk-balanced`, matching the minimum CLI Terraform defaults.
-- C4A availability varies by region and zone. If you change `REGION`, choose a `ZONE` where C4A is available.
+- The example creates two `n2-standard-4` nodes initially and enables autoscaling up to four nodes. The initial nodes provide 8 vCPU total for the compact Rulebricks cluster shape while avoiding single-node pod density limits.
+- If you change `REGION`, choose a `ZONE` where the selected machine type is available.
 - Regional GKE clusters can multiply node counts across node locations. This example pins one node location to keep the minimum cluster shape predictable.
+- The public web firewall rule allows HTTP and HTTPS to the node pool so Kubernetes LoadBalancer services and cert-manager HTTP-01 validation can receive internet traffic.

package/cluster-setup/gcp/check-gke-prereqs.sh

@@ -1,9 +1,28 @@
 #!/usr/bin/env bash
+# Rulebricks GKE prerequisite check.
+#
+# Prints a short pass/fail report and a final READY / NOT READY verdict
+# with the exact actions you need to take before running the GKE deploy.
+#
+# Env vars:
+#   GOOGLE_CLOUD_PROJECT   GCP project id (defaults to gcloud config)
+#   GCP_REGION             Region to check (default: us-central1)
+#   VERBOSE=1              Print raw gcloud error messages inline
+
 set -euo pipefail
 
+if [[ -z "${BASH_VERSION:-}" ]]; then
+  exec bash "$0" "$@"
+fi
+
+# Quiet gcloud's interactive nags / survey output.
+export CLOUDSDK_CORE_DISABLE_PROMPTS=1
+
 PROJECT_ID="${GOOGLE_CLOUD_PROJECT:-$(gcloud config get-value project 2>/dev/null || true)}"
 REGION="${GCP_REGION:-us-central1}"
 REQUIRED_VCPU=8
+VERBOSE="${VERBOSE:-0}"
+
 REQUIRED_APIS=(
   compute.googleapis.com
   container.googleapis.com
@@ -11,88 +30,231 @@ REQUIRED_APIS=(
   cloudresourcemanager.googleapis.com
 )
 
+ACTIONS=()
+BLOCKERS=0
+
+# ---------- helpers ----------
+
 require_cmd() {
   command -v "$1" >/dev/null 2>&1 || {
-    echo "Missing required command: $1" >&2
+    printf "ERROR: required command not found: %s\n" "$1" >&2
     exit 1
   }
 }
 
-check_api() {
-  local api="$1"
-  if gcloud services list \
-    --project "$PROJECT_ID" \
-    --enabled \
-    --filter="name:${api}" \
-    --format="value(name)" | awk -v api="$api" '$0 ~ api { found=1 } END { exit found ? 0 : 1 }'; then
-    echo "OK: $api is enabled"
-  else
-    echo "WARN: $api is not enabled. Run: gcloud services enable $api --project $PROJECT_ID"
+# Run a gcloud command. Sets GC_STDOUT / GC_STDERR / GC_RC. Never aborts.
+gc_run() {
+  GC_STDOUT=""; GC_STDERR=""; GC_RC=0
+  local _err
+  _err="$(mktemp)"
+  GC_STDOUT="$(gcloud "$@" 2>"$_err")" || GC_RC=$?
+  GC_STDERR="$(cat "$_err")"
+  rm -f "$_err"
+  if [[ "$VERBOSE" == "1" && -n "$GC_STDERR" ]]; then
+    printf "      debug: %s\n" "${GC_STDERR%%$'\n'*}" >&2
   fi
+  return "$GC_RC"
 }
 
-check_quota() {
-  echo "Checking regional CPU quota in $REGION..."
-  local quota_line
-  quota_line="$(gcloud compute regions describe "$REGION" \
-    --project "$PROJECT_ID" \
-    --format="csv[no-heading](quotas.metric,quotas.limit,quotas.usage)" 2>/dev/null \
-    | awk -F, '$1=="CPUS"{print $2 "," $3; exit}' || true)"
-
-  if [[ -z "$quota_line" ]]; then
-    echo "WARN: Could not read regional CPU quota."
-    return
-  fi
-
-  local limit="${quota_line%,*}"
-  local usage="${quota_line#*,}"
-  local available
-  available="$(awk -v limit="$limit" -v usage="$usage" 'BEGIN { printf "%d", limit - usage }')"
+is_auth_error() {
+  [[ "$GC_STDERR" == *"reauthentication"*    ]] && return 0
+  [[ "$GC_STDERR" == *"credentials"*"expired"* ]] && return 0
+  [[ "$GC_STDERR" == *"invalid_grant"*       ]] && return 0
+  [[ "$GC_STDERR" == *"gcloud auth login"*   ]] && return 0
+  [[ "$GC_STDERR" == *"gcloud auth application-default login"* ]] && return 0
+  [[ "$GC_STDERR" == *"There was a problem refreshing"* ]] && return 0
+  [[ "$GC_STDERR" == *"do not have active credentials"* ]] && return 0
+  return 1
+}
 
-  if (( available < REQUIRED_VCPU )); then
-    echo "WARN: ${available}/${limit} CPUs available; ${REQUIRED_VCPU}+ recommended for the included cluster commands."
-  else
-    echo "OK: ${available}/${limit} CPUs available."
-  fi
+row() {
+  printf "  %-50s %s\n" "$1" "$2"
 }
 
+mark_blocker() { BLOCKERS=$((BLOCKERS + 1)); }
+add_action()   { ACTIONS+=("$1"); }
+
+# ---------- pre-flight ----------
+
 require_cmd gcloud
 require_cmd kubectl
 require_cmd helm
 require_cmd awk
 
+printf "Rulebricks GKE prerequisite check\n"
+printf "  Region:  %s\n" "$REGION"
+printf "  Project: %s\n" "${PROJECT_ID:-<unset>}"
+printf "\n"
+
 if [[ -z "$PROJECT_ID" ]]; then
-  echo "No GCP project configured. Run: gcloud config set project PROJECT_ID" >&2
+  row "GCP project configured" "FAIL - no project set"
+  add_action "Set a project: gcloud config set project <PROJECT_ID>"
+  printf "\n========================================\n"
+  printf "RESULT: NOT READY\n"
+  printf "========================================\n"
+  printf "Required actions:\n  1. %s\n" "${ACTIONS[0]}"
   exit 1
 fi
 
-echo "Rulebricks GKE prerequisite checks"
-echo "Project: $PROJECT_ID"
-echo "Region: $REGION"
-echo
+# ---------- 1. Authentication ----------
+AUTH_OK=0
+ACTIVE_ACCOUNT=""
+
+if gc_run auth list --filter=status:ACTIVE --format="value(account)"; then
+  ACTIVE_ACCOUNT="$(printf '%s' "$GC_STDOUT" | head -n 1)"
+  if [[ -z "$ACTIVE_ACCOUNT" ]]; then
+    row "gcloud user signed in" "FAIL - no active account"
+    add_action "Run: gcloud auth login"
+    mark_blocker
+  else
+    row "gcloud user signed in" "OK ($ACTIVE_ACCOUNT)"
+
+    # Now verify ADC actually works against Google APIs - this is what
+    # the deploy tooling uses, and the most common breakage.
+    if gc_run auth application-default print-access-token; then
+      row "Application Default Credentials" "OK"
+      AUTH_OK=1
+    else
+      if is_auth_error; then
+        row "Application Default Credentials" "FAIL - ADC missing or expired"
+      else
+        row "Application Default Credentials" "FAIL - ${GC_STDERR%%$'\n'*}"
+      fi
+      add_action "Run: gcloud auth application-default login"
+      mark_blocker
+    fi
+  fi
+else
+  row "gcloud user signed in" "FAIL - ${GC_STDERR%%$'\n'*}"
+  add_action "Run: gcloud auth login && gcloud auth application-default login"
+  mark_blocker
+fi
 
-echo "Checking gcloud account..."
-gcloud auth list --filter=status:ACTIVE --format="value(account)"
-gcloud auth application-default print-access-token >/dev/null
-echo "OK: gcloud auth and Application Default Credentials are available."
-echo
+if [[ $AUTH_OK -eq 0 ]]; then
+  printf "\nRemaining checks skipped - fix authentication first.\n"
+  printf "\n========================================\n"
+  printf "RESULT: NOT READY\n"
+  printf "========================================\n"
+  printf "Required actions:\n"
+  i=1
+  for a in "${ACTIONS[@]}"; do
+    printf "  %d. %s\n" "$i" "$a"
+    i=$((i + 1))
+  done
+  exit 1
+fi
 
-for api in "${REQUIRED_APIS[@]}"; do
-  check_api "$api"
+# ---------- 2. Project access ----------
+if gc_run projects describe "$PROJECT_ID" --format="value(projectId)"; then
+  row "Project '$PROJECT_ID' accessible" "OK"
+else
+  row "Project '$PROJECT_ID' accessible" "FAIL - ${GC_STDERR%%$'\n'*}"
+  add_action "Ensure '$ACTIVE_ACCOUNT' has at least roles/viewer on project '$PROJECT_ID', or fix the project id."
+  mark_blocker
+fi
+
+# ---------- 3. Required APIs ----------
+missing_apis=()
+unknown_apis=()
+if gc_run services list --project "$PROJECT_ID" --enabled --format="value(config.name)"; then
+  enabled="$GC_STDOUT"
+  for api in "${REQUIRED_APIS[@]}"; do
+    if ! printf '%s\n' "$enabled" | grep -qx "$api"; then
+      missing_apis+=("$api")
+    fi
+  done
+else
+  unknown_apis=("${REQUIRED_APIS[@]}")
+fi
+
+total=${#REQUIRED_APIS[@]}
+
+if [[ ${#unknown_apis[@]} -gt 0 ]]; then
+  row "Required APIs enabled" "WARN - could not list enabled services"
+  add_action "Verify 'serviceusage.services.list' permission, then re-run."
+elif [[ ${#missing_apis[@]} -eq 0 ]]; then
+  row "Required APIs enabled" "OK ($total/$total)"
+else
+  enabled_count=$((total - ${#missing_apis[@]}))
+  row "Required APIs enabled" "WARN ($enabled_count/$total)"
+  enable_cmd="gcloud services enable ${missing_apis[*]} --project $PROJECT_ID"
+  add_action "Enable missing APIs (takes ~1 min):"
+  add_action "    $enable_cmd"
+fi
+
+# ---------- 4. Region + GKE access ----------
+REGION_OK=1
+if ! gc_run compute regions describe "$REGION" --project "$PROJECT_ID" --format="value(name)"; then
+  REGION_OK=0
+  row "Region '$REGION' accessible" "FAIL - ${GC_STDERR%%$'\n'*}"
+  add_action "Verify region name '$REGION' and that the Compute Engine API is enabled."
+  mark_blocker
+fi
+
+if [[ $REGION_OK -eq 1 ]]; then
+  if gc_run container clusters list --region "$REGION" --project "$PROJECT_ID" --format="value(name)"; then
+    row "Region + GKE list access" "OK"
+  else
+    row "Region + GKE list access" "WARN - ${GC_STDERR%%$'\n'*}"
+    add_action "Ensure '$ACTIVE_ACCOUNT' has roles/container.viewer (or higher) on '$PROJECT_ID'."
+  fi
+fi
+
+# ---------- 5. Regional CPU quota ----------
+quota_label="Regional CPU quota in $REGION (need ${REQUIRED_VCPU}+)"
+quota_line=""
+if gc_run compute regions describe "$REGION" --project "$PROJECT_ID" \
+       --format="csv[no-heading](quotas.metric,quotas.limit,quotas.usage)"; then
+  quota_line="$(printf '%s\n' "$GC_STDOUT" | awk -F, '$1=="CPUS"{print $2 "," $3; exit}')"
+fi
+
+if [[ -z "$quota_line" ]]; then
+  row "$quota_label" "WARN - could not read quota"
+  add_action "Manually check CPU quota in Console → IAM & Admin → Quotas (region: $REGION)."
+else
+  limit="${quota_line%,*}"
+  usage="${quota_line#*,}"
+  available="$(awk -v l="$limit" -v u="$usage" 'BEGIN { printf "%d", l - u }')"
+  if (( available < REQUIRED_VCPU )); then
+    row "$quota_label" "WARN ($available/$limit free)"
+    add_action "Request CPU quota increase: Console → IAM & Admin → Quotas → 'Compute Engine API CPUs' in $REGION."
+  else
+    row "$quota_label" "OK ($available/$limit free)"
+  fi
+fi
+
+# ---------- 6. Local tools ----------
+if kubectl version --client=true >/dev/null 2>&1 && helm version >/dev/null 2>&1; then
+  row "Local tools (kubectl, helm)" "OK"
+else
+  row "Local tools (kubectl, helm)" "FAIL"
+  add_action "Install/repair kubectl and helm."
+  mark_blocker
+fi
+
+# ---------- summary ----------
+printf "\n========================================\n"
+if [[ $BLOCKERS -eq 0 && ${#ACTIONS[@]} -eq 0 ]]; then
+  printf "RESULT: READY - you can run the GKE deploy.\n"
+  printf "========================================\n"
+  exit 0
+elif [[ $BLOCKERS -eq 0 ]]; then
+  printf "RESULT: READY WITH WARNINGS\n"
+  printf "========================================\n"
+  printf "The deploy should work, but address these first if possible:\n"
+else
+  printf "RESULT: NOT READY\n"
+  printf "========================================\n"
+  printf "Required actions:\n"
+fi
+
+i=1
+for a in "${ACTIONS[@]}"; do
+  printf "  %d. %s\n" "$i" "$a"
+  i=$((i + 1))
 done
 
-echo
-gcloud compute regions describe "$REGION" --project "$PROJECT_ID" >/dev/null
-echo "OK: region $REGION is accessible."
-gcloud container clusters list --region "$REGION" --project "$PROJECT_ID" >/dev/null
-echo "OK: GKE cluster list access works."
-check_quota
-
-echo
-echo "Checking local Kubernetes tools..."
-kubectl version --client=true >/dev/null
-helm version >/dev/null
-echo "OK: kubectl and Helm are installed."
-
-echo
-echo "GKE prerequisite checks completed. Warnings may require GCP project-admin review before cluster creation."
+printf "\nRe-run this script after completing the actions above.\n"
+printf "(Set VERBOSE=1 to see raw gcloud error messages.)\n"
+
+[[ $BLOCKERS -gt 0 ]] && exit 1 || exit 0

package/dist/commands/backup.d.ts

@@ -0,0 +1,5 @@
+interface BackupCommandProps {
+    name: string;
+}
+export declare function BackupCommand(props: BackupCommandProps): import("react/jsx-runtime").JSX.Element;
+export {};

package/dist/commands/backup.js

@@ -0,0 +1,104 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useEffect, useState } from "react";
+import { Box, Text, useApp } from "ink";
+import { BorderBox, Logo, Spinner, StatusLine, ThemeProvider, useTheme, CommandApprovalProvider, } from "../components/common/index.js";
+import { loadDeploymentConfig } from "../lib/config.js";
+import { updateKubeconfig } from "../lib/cloudCli.js";
+import { CommandDeniedError } from "../lib/commandApproval.js";
+import { checkClusterAccessible, createJobFromCronJob, isKubectlInstalled, waitForJobComplete, } from "../lib/kubernetes.js";
+import { getNamespace, getReleaseName } from "../types/index.js";
+function k8sName(value) {
+    return value.toLowerCase().replace(/[^a-z0-9-]/g, "-").slice(0, 63).replace(/-+$/, "");
+}
+function BackupCommandInner({ name }) {
+    const { exit } = useApp();
+    const { colors } = useTheme();
+    const [step, setStep] = useState("loading");
+    const [error, setError] = useState(null);
+    const [logs, setLogs] = useState("");
+    const [status, setStatus] = useState({
+        preflight: "pending",
+        job: "pending",
+    });
+    useEffect(() => {
+        runBackup();
+    }, []);
+    async function runBackup() {
+        try {
+            const config = await loadDeploymentConfig(name);
+            validateConfig(config);
+            setStep("preflight");
+            setStatus((current) => ({ ...current, preflight: "running" }));
+            await runPreflight(config);
+            setStatus((current) => ({ ...current, preflight: "success" }));
+            const namespace = getNamespace(config.name);
+            const releaseName = getReleaseName(config.name);
+            const cronJobName = `${releaseName}-db-backup`;
+            const jobName = k8sName(`${cronJobName}-manual-${Date.now()}`);
+            setStep("running");
+            setStatus((current) => ({ ...current, job: "running" }));
+            await createJobFromCronJob(namespace, cronJobName, jobName);
+            const jobLogs = await waitForJobComplete(namespace, jobName);
+            setLogs(jobLogs);
+            setStatus((current) => ({ ...current, job: "success" }));
+            setStep("complete");
+            setTimeout(() => exit(), 5000);
+        }
+        catch (err) {
+            setError(err instanceof Error ? err.message : "Backup failed");
+            setStatus((current) => ({
+                ...current,
+                preflight: step === "preflight" ? "error" : current.preflight,
+                job: step === "running" ? "error" : current.job,
+            }));
+            setStep("error");
+        }
+    }
+    function validateConfig(config) {
+        if (config.database.type !== "self-hosted") {
+            throw new Error("Backups are only available for self-hosted Supabase.");
+        }
+        if (!config.storage) {
+            throw new Error("Shared object storage is required for database backups.");
+        }
+        if (!config.backup?.enabled) {
+            throw new Error("Database backups are disabled for this deployment. Re-run `rulebricks init` to enable them.");
+        }
+    }
+    async function runPreflight(config) {
+        if (!(await isKubectlInstalled())) {
+            throw new Error("kubectl is not installed. Please install kubectl first.");
+        }
+        let clusterError = await checkClusterAccessible();
+        if (clusterError &&
+            config.infrastructure.provider &&
+            config.infrastructure.region &&
+            config.infrastructure.clusterName) {
+            try {
+                await updateKubeconfig(config.infrastructure.provider, config.infrastructure.clusterName, config.infrastructure.region, {
+                    gcpProjectId: config.infrastructure.gcpProjectId,
+                    azureResourceGroup: config.infrastructure.azureResourceGroup,
+                });
+            }
+            catch (err) {
+                if (!(err instanceof CommandDeniedError)) {
+                    throw err;
+                }
+            }
+            clusterError = await checkClusterAccessible();
+        }
+        if (clusterError) {
+            throw new Error(`Cannot access Kubernetes cluster:\n${clusterError}`);
+        }
+    }
+    if (step === "error") {
+        return (_jsx(BorderBox, { title: "Backup Failed", children: _jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { color: colors.error, bold: true, children: "\u2717 Error" }), _jsx(Text, { color: colors.error, children: error })] }) }));
+    }
+    if (step === "complete") {
+        return (_jsx(BorderBox, { title: "Backup Complete", children: _jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { color: colors.success, bold: true, children: "\u2713 Database backup completed" }), logs && (_jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { color: colors.muted, children: "Job output:" }), logs.split("\n").slice(-8).map((line, index) => (_jsx(Text, { color: colors.muted, children: line }, index)))] }))] }) }));
+    }
+    return (_jsx(BorderBox, { title: `Backing Up ${name}`, children: _jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(StatusLine, { status: status.preflight, label: "Preflight checks" }), _jsx(StatusLine, { status: status.job, label: "Database backup job" }), _jsx(Box, { marginTop: 1, children: _jsx(Spinner, { label: step === "running" ? "Running backup job..." : "Preparing backup..." }) })] }) }));
+}
+export function BackupCommand(props) {
+    return (_jsxs(ThemeProvider, { theme: "status", children: [_jsx(Logo, {}), _jsx(CommandApprovalProvider, { children: _jsx(BackupCommandInner, { ...props }) })] }));
+}

package/dist/commands/deploy.d.ts

@@ -1,8 +1,10 @@
 interface DeployCommandProps {
     name: string;
-    skipInfra?: boolean;
     skipDns?: boolean;
     version?: string;
+    regenerateValues?: boolean;
+    assumeDnsConfigured?: boolean;
+    inlineSecrets?: boolean;
 }
 export declare function DeployCommand(props: DeployCommandProps): import("react/jsx-runtime").JSX.Element;
 export {};