@rulebricks/cli 2.1.7 → 2.3.2

package/dist/commands/restore.js

@@ -0,0 +1,338 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useEffect, useState } from "react";
+import { Box, Text, useApp } from "ink";
+import SelectInput from "ink-select-input";
+import TextInput from "ink-text-input";
+import { BorderBox, Logo, Spinner, StatusLine, ThemeProvider, useTheme, CommandApprovalProvider, } from "../components/common/index.js";
+import { loadDeploymentConfig } from "../lib/config.js";
+import { updateKubeconfig } from "../lib/cloudCli.js";
+import { CommandDeniedError } from "../lib/commandApproval.js";
+import { checkClusterAccessible, getDeploymentReplicas, isKubectlInstalled, runEphemeralJob, scaleDeployment, waitForDeploymentReady, } from "../lib/kubernetes.js";
+import { RCLONE_IMAGE, SUPABASE_POSTGRES_IMAGE_REPOSITORY, SUPABASE_POSTGRES_IMAGE_TAG, } from "../lib/versions.js";
+import { getNamespace, getReleaseName } from "../types/index.js";
+const DB_IMAGE = `${SUPABASE_POSTGRES_IMAGE_REPOSITORY}:${SUPABASE_POSTGRES_IMAGE_TAG}`;
+function k8sName(value) {
+    return value.toLowerCase().replace(/[^a-z0-9-]/g, "-").slice(0, 63).replace(/-+$/, "");
+}
+// The single bucket/container plus the db-backups prefix, e.g. "my-bucket/db-backups"
+// (S3/GCS) or "my-container/db-backups" (azure-blob).
+function dbBackupsTarget(config) {
+    const storage = config.storage;
+    if (!storage)
+        throw new Error("Shared object storage is required.");
+    const prefix = (storage.paths?.dbBackups || "db-backups").replace(/^\/+|\/+$/g, "");
+    if (storage.provider === "azure-blob") {
+        return `${storage.azureBlobContainer || "rulebricks"}/${prefix}`;
+    }
+    return `${storage.bucket}/${prefix}`;
+}
+// rclone on-the-fly remote "dest" config via env vars (no config file). Auth is
+// the pod's workload identity (env_auth) for every provider, or an Azure Blob
+// connection string Secret in the fallback path.
+function rcloneEnv(config) {
+    const storage = config.storage;
+    if (!storage)
+        throw new Error("Shared object storage is required.");
+    const env = [];
+    switch (storage.provider) {
+        case "azure-blob":
+            env.push({ name: "RCLONE_CONFIG_DEST_TYPE", value: "azureblob" });
+            env.push({ name: "RCLONE_CONFIG_DEST_ACCOUNT", value: storage.bucket });
+            if (storage.cloudAuthMode === "secret") {
+                if (!storage.azureBlobConnectionStringSecretRef) {
+                    throw new Error("Azure Blob connection string secret ref is required.");
+                }
+                env.push({
+                    name: "RCLONE_CONFIG_DEST_CONNECTION_STRING",
+                    valueFrom: {
+                        secretKeyRef: {
+                            name: storage.azureBlobConnectionStringSecretRef.name,
+                            key: storage.azureBlobConnectionStringSecretRef.key,
+                        },
+                    },
+                });
+            }
+            else {
+                env.push({ name: "RCLONE_CONFIG_DEST_ENV_AUTH", value: "true" });
+            }
+            break;
+        case "gcs":
+            env.push({ name: "RCLONE_CONFIG_DEST_TYPE", value: "google cloud storage" });
+            env.push({ name: "RCLONE_CONFIG_DEST_ENV_AUTH", value: "true" });
+            env.push({ name: "RCLONE_CONFIG_DEST_BUCKET_POLICY_ONLY", value: "true" });
+            break;
+        default:
+            env.push({ name: "RCLONE_CONFIG_DEST_TYPE", value: "s3" });
+            env.push({ name: "RCLONE_CONFIG_DEST_PROVIDER", value: "AWS" });
+            env.push({ name: "RCLONE_CONFIG_DEST_ENV_AUTH", value: "true" });
+            env.push({ name: "RCLONE_CONFIG_DEST_REGION", value: storage.region });
+            break;
+    }
+    return env;
+}
+function pgEnv(config, releaseName) {
+    const secret = `${releaseName}-supabase-db`;
+    return [
+        { name: "PGHOST", value: `${releaseName}-supabase-db` },
+        { name: "PGPORT", value: "5432" },
+        {
+            name: "PGDATABASE",
+            valueFrom: { secretKeyRef: { name: secret, key: "database" } },
+        },
+        // Restore as a superuser so pg_restore --clean and the globals.sql roles can
+        // drop/recreate objects in schemas owned by supabase_admin (auth, storage,
+        // realtime, etc.). The secret's `username` role (postgres) is not a superuser.
+        { name: "PGUSER", value: "supabase_admin" },
+        {
+            name: "PGPASSWORD",
+            valueFrom: { secretKeyRef: { name: secret, key: "password" } },
+        },
+    ];
+}
+function jobLabels(config) {
+    const labels = {
+        "app.kubernetes.io/component": "db-restore",
+    };
+    // Azure Workload Identity requires this pod label so the projected token is
+    // injected for the rclone download. S3 (IRSA) and GCS (GKE WI) work via the SA.
+    if (config.storage?.provider === "azure-blob" &&
+        config.storage.cloudAuthMode !== "secret") {
+        labels["azure.workload.identity/use"] = "true";
+    }
+    return labels;
+}
+function parseBackups(output) {
+    return output
+        .split("\n")
+        .map((line) => line.trim().replace(/\/+$/, ""))
+        .filter((line) => line.length > 0 && !line.includes("/"))
+        .sort()
+        .reverse()
+        .map((id) => ({ id, label: id }));
+}
+function RestoreCommandInner({ name }) {
+    const { exit } = useApp();
+    const { colors } = useTheme();
+    const [step, setStep] = useState("loading");
+    const [config, setConfig] = useState(null);
+    const [backups, setBackups] = useState([]);
+    const [selectedBackup, setSelectedBackup] = useState(null);
+    const [confirmation, setConfirmation] = useState("");
+    const [error, setError] = useState(null);
+    const [logs, setLogs] = useState("");
+    const [status, setStatus] = useState({
+        preflight: "pending",
+        list: "pending",
+        scaleDown: "pending",
+        restore: "pending",
+        scaleUp: "pending",
+    });
+    useEffect(() => {
+        prepare();
+    }, []);
+    async function prepare() {
+        try {
+            const cfg = await loadDeploymentConfig(name);
+            validateConfig(cfg);
+            setConfig(cfg);
+            setStep("preflight");
+            setStatus((current) => ({ ...current, preflight: "running" }));
+            await runPreflight(cfg);
+            setStatus((current) => ({ ...current, preflight: "success" }));
+            setStep("listing");
+            setStatus((current) => ({ ...current, list: "running" }));
+            const available = await listBackups(cfg);
+            setBackups(available);
+            setStatus((current) => ({ ...current, list: "success" }));
+            setStep("select");
+        }
+        catch (err) {
+            setError(err instanceof Error ? err.message : "Restore preparation failed");
+            setStep("error");
+        }
+    }
+    function validateConfig(cfg) {
+        if (cfg.database.type !== "self-hosted") {
+            throw new Error("Restore is only available for self-hosted Supabase.");
+        }
+        if (!cfg.storage) {
+            throw new Error("Shared object storage is required for restore.");
+        }
+        if (!cfg.backup?.enabled) {
+            throw new Error("Database backups are disabled for this deployment.");
+        }
+    }
+    async function runPreflight(cfg) {
+        if (!(await isKubectlInstalled())) {
+            throw new Error("kubectl is not installed. Please install kubectl first.");
+        }
+        let clusterError = await checkClusterAccessible();
+        if (clusterError &&
+            cfg.infrastructure.provider &&
+            cfg.infrastructure.region &&
+            cfg.infrastructure.clusterName) {
+            try {
+                await updateKubeconfig(cfg.infrastructure.provider, cfg.infrastructure.clusterName, cfg.infrastructure.region, {
+                    gcpProjectId: cfg.infrastructure.gcpProjectId,
+                    azureResourceGroup: cfg.infrastructure.azureResourceGroup,
+                });
+            }
+            catch (err) {
+                if (!(err instanceof CommandDeniedError)) {
+                    throw err;
+                }
+            }
+            clusterError = await checkClusterAccessible();
+        }
+        if (clusterError) {
+            throw new Error(`Cannot access Kubernetes cluster:\n${clusterError}`);
+        }
+    }
+    async function listBackups(cfg) {
+        const namespace = getNamespace(cfg.name);
+        const releaseName = getReleaseName(cfg.name);
+        const target = dbBackupsTarget(cfg);
+        const result = await runEphemeralJob({
+            name: k8sName(`${releaseName}-backup-list-${Date.now()}`),
+            namespace,
+            serviceAccountName: `${releaseName}-backup`,
+            image: RCLONE_IMAGE,
+            command: [
+                "/bin/sh",
+                "-c",
+                `rclone lsf "dest:${target}/" --dirs-only`,
+            ],
+            env: rcloneEnv(cfg),
+            labels: jobLabels(cfg),
+            timeoutSeconds: 300,
+        });
+        const parsed = parseBackups(result.logs);
+        if (parsed.length === 0) {
+            throw new Error("No database backups found in object storage.");
+        }
+        return parsed;
+    }
+    async function handleRestore() {
+        if (!config || !selectedBackup)
+            return;
+        if (confirmation !== config.name) {
+            setError(`Type "${config.name}" to confirm restore.`);
+            return;
+        }
+        setError(null);
+        setStep("restoring");
+        let originalReplicas = [];
+        try {
+            setStatus((current) => ({ ...current, scaleDown: "running" }));
+            originalReplicas = await scaleDownForRestore(config);
+            setStatus((current) => ({ ...current, scaleDown: "success" }));
+            setStatus((current) => ({ ...current, restore: "running" }));
+            const result = await runRestoreJob(config, selectedBackup.id);
+            setLogs(result.logs);
+            setStatus((current) => ({ ...current, restore: "success" }));
+            setStatus((current) => ({ ...current, scaleUp: "running" }));
+            await scaleBackUp(config, originalReplicas);
+            setStatus((current) => ({ ...current, scaleUp: "success" }));
+            setStep("complete");
+            setTimeout(() => exit(), 8000);
+        }
+        catch (err) {
+            if (originalReplicas.length > 0) {
+                await scaleBackUp(config, originalReplicas).catch(() => { });
+            }
+            setError(err instanceof Error ? err.message : "Restore failed");
+            setStep("error");
+        }
+    }
+    // Logical restore runs pg_restore against the live database, so we keep the DB
+    // up and instead pause the application tier to stop writes during the restore.
+    async function scaleDownForRestore(cfg) {
+        const namespace = getNamespace(cfg.name);
+        const releaseName = getReleaseName(cfg.name);
+        const appName = `${releaseName}-app`;
+        const replicas = await getDeploymentReplicas(namespace, appName);
+        if (replicas === null || replicas <= 0) {
+            return [];
+        }
+        await scaleDeployment(namespace, appName, 0);
+        await waitForDeploymentReady(namespace, appName, 120).catch(() => { });
+        return [{ name: appName, replicas }];
+    }
+    async function scaleBackUp(cfg, originalReplicas) {
+        const namespace = getNamespace(cfg.name);
+        for (const item of originalReplicas) {
+            if (item.replicas <= 0)
+                continue;
+            await scaleDeployment(namespace, item.name, item.replicas);
+            await waitForDeploymentReady(namespace, item.name).catch(() => { });
+        }
+    }
+    async function runRestoreJob(cfg, backupId) {
+        const namespace = getNamespace(cfg.name);
+        const releaseName = getReleaseName(cfg.name);
+        const target = dbBackupsTarget(cfg);
+        return runEphemeralJob({
+            name: k8sName(`${releaseName}-db-restore-${Date.now()}`),
+            namespace,
+            serviceAccountName: `${releaseName}-backup`,
+            // Init container downloads the selected backup; the main container restores
+            // it into the live database over the network. They share an emptyDir.
+            initContainers: [
+                {
+                    name: "download",
+                    image: RCLONE_IMAGE,
+                    imagePullPolicy: "IfNotPresent",
+                    command: [
+                        "/bin/sh",
+                        "-c",
+                        `set -e; echo "Downloading backup ${backupId}"; rclone copy "dest:${target}/${backupId}/" /work/`,
+                    ],
+                    env: rcloneEnv(cfg),
+                    volumeMounts: [{ name: "work", mountPath: "/work" }],
+                },
+            ],
+            image: DB_IMAGE,
+            command: [
+                "/bin/bash",
+                "-c",
+                [
+                    "set -euo pipefail",
+                    'if [ -f /work/globals.sql ]; then',
+                    '  echo "Applying cluster globals (roles)"',
+                    '  psql -h "$PGHOST" -p "$PGPORT" -U "$PGUSER" -d "$PGDATABASE" -v ON_ERROR_STOP=0 -f /work/globals.sql || true',
+                    "fi",
+                    'echo "Restoring database from /work/db.dump"',
+                    'pg_restore -h "$PGHOST" -p "$PGPORT" -U "$PGUSER" -d "$PGDATABASE" --clean --if-exists --no-owner --no-privileges /work/db.dump',
+                    'echo "Restore complete"',
+                ].join("\n"),
+            ],
+            env: pgEnv(cfg, releaseName),
+            labels: jobLabels(cfg),
+            volumeMounts: [{ name: "work", mountPath: "/work" }],
+            volumes: [{ name: "work", emptyDir: {} }],
+            timeoutSeconds: 3600,
+        });
+    }
+    if (step === "error") {
+        return (_jsx(BorderBox, { title: "Restore Failed", children: _jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { color: colors.error, bold: true, children: "\u2717 Error" }), _jsx(Text, { color: colors.error, children: error })] }) }));
+    }
+    if (step === "select") {
+        return (_jsx(BorderBox, { title: "Select Backup", children: _jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { children: "Select a backup to restore:" }), _jsx(Box, { marginTop: 1, children: _jsx(SelectInput, { items: backups.map((backup) => ({
+                                label: backup.label,
+                                value: backup,
+                            })), onSelect: (item) => {
+                                setSelectedBackup(item.value);
+                                setStep("confirm");
+                            }, indicatorComponent: () => null, itemComponent: ({ isSelected, label }) => (_jsxs(Text, { color: isSelected ? colors.accent : undefined, children: [isSelected ? "❯ " : "  ", label] })) }) })] }) }));
+    }
+    if (step === "confirm" && config && selectedBackup) {
+        return (_jsx(BorderBox, { title: "Confirm Restore", children: _jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { color: colors.warning, bold: true, children: "WARNING" }), _jsxs(Text, { children: ["This will overwrite the live database for ", config.name, "."] }), _jsxs(Text, { children: ["Selected backup: ", selectedBackup.id] }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { children: "Type the deployment name to continue:" }) }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: confirmation, onChange: setConfirmation, onSubmit: handleRestore, placeholder: config.name }) }), error && (_jsx(Box, { marginTop: 1, children: _jsx(Text, { color: colors.error, children: error }) }))] }) }));
+    }
+    if (step === "complete") {
+        return (_jsx(BorderBox, { title: "Restore Complete", children: _jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { color: colors.success, bold: true, children: "\u2713 Database restore completed" }), logs && (_jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { color: colors.muted, children: "Restore output:" }), logs.split("\n").slice(-8).map((line, index) => (_jsx(Text, { color: colors.muted, children: line }, index)))] }))] }) }));
+    }
+    return (_jsx(BorderBox, { title: `Restoring ${name}`, children: _jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(StatusLine, { status: status.preflight, label: "Preflight checks" }), _jsx(StatusLine, { status: status.list, label: "Listing backups" }), _jsx(StatusLine, { status: status.scaleDown, label: "Pausing application writers" }), _jsx(StatusLine, { status: status.restore, label: "Restoring selected backup" }), _jsx(StatusLine, { status: status.scaleUp, label: "Resuming application" }), _jsx(Box, { marginTop: 1, children: _jsx(Spinner, { label: step === "listing" ? "Listing backups..." : "Preparing restore..." }) })] }) }));
+}
+export function RestoreCommand(props) {
+    return (_jsxs(ThemeProvider, { theme: "status", children: [_jsx(Logo, {}), _jsx(CommandApprovalProvider, { children: _jsx(RestoreCommandInner, { ...props }) })] }));
+}

package/dist/commands/status.js

@@ -2,14 +2,12 @@ import { jsxs as _jsxs, jsx as _jsx, Fragment as _Fragment } from "react/jsx-run
 import { useState, useEffect } from "react";
 import { Box, Text, useApp } from "ink";
 import { BorderBox, Section, Spinner, ThemeProvider, useTheme, Logo, } from "../components/common/index.js";
-import { loadDeploymentConfig, loadDeploymentState } from "../lib/config.js";
-import { getPodStatus, getServiceStatus, getIngressStatus, getCertificateStatus, } from "../lib/kubernetes.js";
-import { getInstalledVersion } from "../lib/helm.js";
-import { getNamespace, getReleaseName, } from "../types/index.js";
+import { getServiceStatus, getIngressStatus, getCertificateStatus, } from "../lib/kubernetes.js";
+import { arePodsHealthy, loadDeploymentHealth, } from "../lib/deploymentHealth.js";
 function StatusCommandInner({ name, data, }) {
     const { exit } = useApp();
     const { colors } = useTheme();
-    const { config, state, clusterStatus } = data;
+    const { config, state, health, clusterStatus } = data;
     useEffect(() => {
         // Auto-exit after displaying
         const timer = setTimeout(() => exit(), 10000);
@@ -17,36 +15,42 @@ function StatusCommandInner({ name, data, }) {
     }, [exit]);
     // Determine overall status based on deployment state and pod health
     const getOverallStatus = () => {
-        // If no state file exists, deployment was never attempted
-        if (!state)
-            return "not-deployed";
-        // Check the deployment state status
-        if (state.status === "failed")
-            return "failed";
-        if (state.status === "destroyed")
+        if (health.kind === "online")
+            return "healthy";
+        if (health.kind === "installed-unreachable")
+            return "unreachable";
+        if (health.kind === "installed-degraded")
+            return "degraded";
+        if (health.kind === "cluster-unreachable")
+            return "cluster-unreachable";
+        if (health.kind === "destroyed")
             return "destroyed";
-        if (state.status === "pending")
-            return "pending";
-        if (state.status === "deploying")
-            return "deploying";
-        if (state.status === "waiting-dns")
-            return "waiting-dns";
-        // If state says running, verify with actual pod status
-        const pods = clusterStatus.pods || [];
-        if (pods.length === 0) {
-            // No pods means something is wrong (unless still deploying)
-            return state.status === "running" ? "degraded" : "unknown";
+        if (health.kind === "not-installed") {
+            if (state?.status === "failed")
+                return "failed";
+            if (state?.status === "pending")
+                return "pending";
+            if (state?.status === "deploying")
+                return "deploying";
+            if (state?.status === "waiting-dns")
+                return "waiting-dns";
+            return state ? "not-installed" : "not-deployed";
         }
-        // Consider a pod healthy if it's ready OR if it's a completed Job pod
-        const allPodsHealthy = pods.every((p) => p.ready || p.status === "Succeeded" || p.status === "Completed");
-        return allPodsHealthy ? "healthy" : "degraded";
+        return "unknown";
     };
     const overallStatus = getOverallStatus();
     const statusDisplay = {
         healthy: { icon: "●", label: "Healthy", color: colors.success },
+        unreachable: { icon: "◐", label: "Installed, URL Unreachable", color: colors.warning },
         degraded: { icon: "◐", label: "Degraded", color: colors.warning },
         failed: { icon: "✗", label: "Failed", color: colors.error },
+        "cluster-unreachable": {
+            icon: "?",
+            label: "Cluster Unreachable",
+            color: colors.warning,
+        },
         destroyed: { icon: "○", label: "Destroyed", color: colors.muted },
+        "not-installed": { icon: "○", label: "Not Installed", color: colors.muted },
         pending: { icon: "○", label: "Pending", color: colors.muted },
         deploying: { icon: "◐", label: "Deploying", color: colors.accent },
         "waiting-dns": {
@@ -58,11 +62,8 @@ function StatusCommandInner({ name, data, }) {
         unknown: { icon: "?", label: "Unknown", color: colors.muted },
     };
     const status = statusDisplay[overallStatus] || statusDisplay["unknown"];
-    return (_jsx(BorderBox, { title: `Status: ${name}`, children: _jsxs(Box, { flexDirection: "column", children: [_jsxs(Section, { title: "Overview", children: [_jsxs(Text, { children: ["Status:", " ", _jsxs(Text, { color: status.color, children: [status.icon, " ", status.label] })] }), state && (_jsxs(Text, { children: ["Version:", " ", _jsx(Text, { color: colors.accent, children: clusterStatus.version || "Unknown" })] })), _jsxs(Text, { children: ["URL: ", _jsxs(Text, { color: colors.accent, children: ["https://", config.domain] })] })] }), overallStatus === "not-deployed" && (_jsxs(Box, { marginY: 1, flexDirection: "column", children: [_jsx(Text, { color: colors.muted, children: "This configuration has not been deployed yet." }), _jsx(Box, { marginTop: 0, children: _jsxs(Text, { color: colors.muted, children: ["Run: ", _jsxs(Text, { color: colors.accent, children: ["rulebricks deploy ", name] })] }) })] })), state && (_jsxs(_Fragment, { children: [_jsx(Section, { title: "Pods", children: clusterStatus.pods.length === 0 ? (_jsx(Text, { color: colors.muted, children: "No pods found" })) : (clusterStatus.pods.map((pod) => {
-                                // Consider pod healthy if ready OR if it's a completed Job
-                                const isHealthy = pod.ready ||
-                                    pod.status === "Succeeded" ||
-                                    pod.status === "Completed";
+    return (_jsx(BorderBox, { title: `Status: ${name}`, children: _jsxs(Box, { flexDirection: "column", children: [_jsxs(Section, { title: "Overview", children: [_jsxs(Text, { children: ["Status:", " ", _jsxs(Text, { color: status.color, children: [status.icon, " ", status.label] })] }), state && (_jsxs(Text, { children: ["Version:", " ", _jsx(Text, { color: colors.accent, children: clusterStatus.version || "Unknown" })] })), _jsxs(Text, { children: ["URL: ", _jsxs(Text, { color: colors.accent, children: ["https://", config.domain] })] }), _jsxs(Text, { children: ["URL Health:", " ", _jsx(Text, { color: health.httpReachable ? colors.success : colors.warning, children: health.httpReachable ? "Reachable" : "Unreachable" })] }), health.clusterError && (_jsx(Text, { color: colors.warning, children: "Cluster: Unreachable" }))] }), overallStatus === "not-deployed" && (_jsxs(Box, { marginY: 1, flexDirection: "column", children: [_jsx(Text, { color: colors.muted, children: "This configuration has not been deployed yet." }), _jsx(Box, { marginTop: 0, children: _jsxs(Text, { color: colors.muted, children: ["Run: ", _jsxs(Text, { color: colors.accent, children: ["rulebricks deploy ", name] })] }) })] })), !health.clusterError && health.kind !== "not-installed" && health.kind !== "destroyed" && (_jsxs(_Fragment, { children: [_jsx(Section, { title: "Pods", children: clusterStatus.pods.length === 0 ? (_jsx(Text, { color: colors.muted, children: "No pods found" })) : (clusterStatus.pods.map((pod) => {
+                                const isHealthy = arePodsHealthy([pod]);
                                 return (_jsxs(Box, { children: [_jsx(Text, { color: isHealthy ? colors.success : colors.warning, children: isHealthy ? "✓" : "○" }), _jsxs(Text, { children: [" ", truncate(pod.name, 40)] }), _jsxs(Text, { color: colors.muted, children: [" ", pod.status] }), pod.restarts > 0 && (_jsxs(Text, { color: colors.warning, children: [" ", "(", pod.restarts, " restarts)"] }))] }, pod.name));
                             })) }), _jsxs(Section, { title: "Services", children: [clusterStatus.services.length === 0 ? (_jsx(Text, { color: colors.muted, children: "No services found" })) : (clusterStatus.services.slice(0, 5).map((svc) => (_jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { children: [" ", truncate(svc.name, 30)] }), _jsxs(Text, { color: colors.muted, children: [" ", svc.type] }), svc.externalIP && (_jsxs(Text, { color: colors.accent, children: [" \u2192 ", svc.externalIP] }))] }, svc.name)))), (clusterStatus.services.length || 0) > 5 && (_jsxs(Text, { color: colors.muted, children: ["... and ", (clusterStatus.services.length || 0) - 5, " more"] }))] }), _jsx(Section, { title: "Ingress", children: clusterStatus.ingresses.length === 0 ? (_jsx(Text, { color: colors.muted, children: "No ingresses found" })) : (clusterStatus.ingresses.map((ing) => (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { color: ing.address ? colors.success : colors.warning, children: ing.address ? "✓" : "○" }), _jsxs(Text, { children: [" ", ing.name] })] }), ing.hosts.map((host) => (_jsx(Box, { marginLeft: 2, children: _jsxs(Text, { color: colors.muted, children: ["\u2192 ", host, " ", ing.tls ? "(TLS)" : ""] }) }, host)))] }, ing.name)))) }), _jsx(Section, { title: "TLS Certificates", children: clusterStatus.certificates.length === 0 ? (_jsx(Text, { color: colors.muted, children: "No certificates found" })) : (clusterStatus.certificates.map((cert) => (_jsxs(Box, { children: [_jsx(Text, { color: cert.ready ? colors.success : colors.warning, children: cert.ready ? "✓" : "○" }), _jsxs(Text, { children: [" ", cert.name] }), _jsx(Text, { color: cert.ready ? colors.success : colors.warning, children: cert.ready ? " Ready" : " Pending" })] }, cert.name)))) })] })), _jsx(Box, { marginTop: 1, children: _jsx(Text, { color: colors.muted, children: "Press Ctrl+C to exit" }) })] }) }));
 }
@@ -79,26 +80,38 @@ function StatusLoader({ name }) {
     }, []);
     async function loadStatus() {
         try {
-            const config = await loadDeploymentConfig(name);
-            const state = await loadDeploymentState(name);
-            // Determine theme based on whether deployment was attempted
-            // Use 'logs' theme (gray/muted) for undeployed, 'status' (green) for deployed
-            const selectedTheme = state ? "status" : "logs";
+            const health = await loadDeploymentHealth(name, {
+                refreshKubeconfig: true,
+            });
+            if (!health.config) {
+                setError(health.configError || "Invalid deployment config");
+                setLoading(false);
+                return;
+            }
+            const selectedTheme = health.kind === "online" ||
+                health.kind === "installed-unreachable" ||
+                health.kind === "installed-degraded"
+                ? "status"
+                : "logs";
             setTheme(selectedTheme);
-            // Use namespace from state if available (backwards compat), otherwise compute from deployment name
-            const namespace = state?.application?.namespace || getNamespace(name);
-            const releaseName = getReleaseName(name);
-            const [pods, services, ingresses, certificates, version] = await Promise.all([
-                getPodStatus(namespace),
-                getServiceStatus(namespace),
-                getIngressStatus(namespace),
-                getCertificateStatus(namespace),
-                getInstalledVersion(releaseName, namespace),
-            ]);
+            const [services, ingresses, certificates] = health.clusterError
+                ? [[], [], []]
+                : await Promise.all([
+                    getServiceStatus(health.namespace),
+                    getIngressStatus(health.namespace),
+                    getCertificateStatus(health.namespace),
+                ]);
             setData({
-                config,
-                state,
-                clusterStatus: { pods, services, ingresses, certificates, version },
+                config: health.config,
+                state: health.state,
+                health,
+                clusterStatus: {
+                    pods: health.pods,
+                    services,
+                    ingresses,
+                    certificates,
+                    version: health.helmVersion,
+                },
             });
             setLoading(false);
         }