@swovohq/fuel 0.2.2-alpha.87 → 0.2.2-alpha.89

package/dist/commands/infra-init.js

@@ -36,8 +36,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CONFIG_TEMPLATE = void 0;
+exports.CONFIG_TEMPLATE_AZURE = exports.CONFIG_TEMPLATE = void 0;
 exports.applyInfraInitAnswers = applyInfraInitAnswers;
+exports.applyAzureInfraInitAnswers = applyAzureInfraInitAnswers;
 exports.infraInit = infraInit;
 const fs = __importStar(require("fs-extra"));
 const path = __importStar(require("path"));
@@ -47,6 +48,11 @@ const promises_1 = require("readline/promises");
 const child_process_1 = require("child_process");
 const util_1 = require("util");
 const https = __importStar(require("https"));
+const identity_1 = require("@azure/identity");
+const arm_resources_1 = require("@azure/arm-resources");
+const azure_defaults_1 = require("../infra/azure-defaults");
+const github_client_1 = require("../infra/github-client");
+const github_token_link_1 = require("../infra/github-token-link");
 const execAsync = (0, util_1.promisify)(child_process_1.exec);
 function httpsGetJson(url, headers) {
     return new Promise((resolve, reject) => {
@@ -98,6 +104,44 @@ exports.CONFIG_TEMPLATE = {
         },
     ],
 };
+exports.CONFIG_TEMPLATE_AZURE = {
+    name: 'my-app',
+    deployment: 'azure',
+    slack_webhook_url: '',
+    location: 'eastus2',
+    monitor: { daily_data_cap_gb: 1, retention_days: 90, dashboard_count: 0 },
+    front_door: { sku_name: 'Standard_AzureFrontDoor' },
+    storage_account: { account_kind: 'BlockBlobStorage', account_tier: 'Premium', account_replication_type: 'LRS', access_tier: 'Hot' },
+    key_vault: { sku_name: 'standard' },
+    apps: [
+        {
+            name: 'my-app-api',
+            technology: 'nest',
+            dockerfile: 'apps/api/Dockerfile',
+            health_check_path: '/health',
+            domain: 'api.example.com',
+            port: 3000,
+            branch: 'main',
+            database: { enabled: true, engine: 'mssql', sku_name: 'GP_S_Gen5_4' },
+            redis: { enabled: false, sku_name: 'Balanced_B0' },
+            container_app: { cpu: 1, memory: '2Gi', concurrent_requests: 20, min_replicas: 0, max_replicas: 3 },
+            variables: {},
+            workers: [],
+        },
+        {
+            name: 'my-app-web',
+            technology: 'react',
+            dockerfile: 'apps/web/Dockerfile',
+            health_check_path: '/health',
+            domain: 'app.example.com',
+            port: 3000,
+            branch: 'main',
+            build_env: {
+                NEXT_PUBLIC_API_HOST: 'https://api.example.com',
+            },
+        },
+    ],
+};
 // --- Private prompt helpers ---
 async function ask(rl, label, defaultVal) {
     const hint = defaultVal ? ` [${defaultVal}]` : '';
@@ -134,6 +178,14 @@ async function askSelect(rl, label, options, defaultIdx = 1) {
         console.log(`  Please enter a number between 1 and ${options.length}.`);
     }
 }
+/** Prompts which cloud provider to provision infrastructure for. */
+async function askCloudChoice(rl) {
+    console.log('  Cloud provider');
+    console.log('  ────────────────────────────────────────────────────');
+    const choice = await askSelect(rl, 'Deploy to', ['AWS (ECS)', 'Azure (Container Apps)'], 1);
+    console.log('');
+    return choice === 'AWS (ECS)' ? 'aws' : 'azure';
+}
 /** Prompts for KEY=VALUE pairs until the user submits an empty line. */
 async function askKeyValues(rl, label) {
     console.log(`\n  ${label} (KEY=VALUE format, empty line to finish):`);
@@ -152,6 +204,58 @@ async function askKeyValues(rl, label) {
     }
     return result;
 }
+/**
+ * Opens a GitHub token-creation page with the required scope already checked — the user
+ * never has to know or look up which permissions the CLI needs — then collects the pasted
+ * token and validates it immediately so a wrong/incomplete token surfaces right away instead
+ * of deep into a later step (repo creation, push, branch protection).
+ */
+async function askGitHubToken(rl) {
+    const url = (0, github_token_link_1.buildGitHubTokenUrl)();
+    console.log(chalk_1.default.cyan('\n  Create a GitHub Personal Access Token'));
+    console.log(`    ${url}`);
+    console.log('    The "repo" scope is already selected — just click "Generate token" at the bottom of the page.\n');
+    (0, github_token_link_1.openInBrowser)(url);
+    while (true) {
+        const token = await ask(rl, 'Paste the generated token (GITHUB_TOKEN)');
+        try {
+            await (0, github_client_1.validateGitHubToken)(token);
+            console.log(chalk_1.default.green('  ✓') + ' Token has the required permissions');
+            return { token };
+        }
+        catch (err) {
+            console.log(chalk_1.default.yellow(`  ⚠ ${err instanceof Error ? err.message : String(err)}`));
+            const retry = await askYesNo(rl, '  Try pasting the token again?', true);
+            if (!retry) {
+                throw new Error('GitHub token setup aborted — a validated token is required to continue.');
+            }
+        }
+    }
+}
+/** Lists the orgs available to the given token and lets the user pick one, falling back to manual entry. */
+async function askGitHubOrganizationFor(rl, token) {
+    try {
+        const { status, body } = await httpsGetJson('https://api.github.com/user/orgs', {
+            Authorization: `Bearer ${token}`,
+            'User-Agent': 'fuel-cli',
+            Accept: 'application/vnd.github+json',
+        });
+        if (status === 200) {
+            const orgs = JSON.parse(body);
+            if (orgs.length === 1) {
+                console.log(`  GitHub Org:   ${chalk_1.default.green(orgs[0].login)} (only org available to this account)`);
+                return orgs[0].login;
+            }
+            if (orgs.length > 1) {
+                return askSelect(rl, 'GitHub organization', orgs.map((o) => o.login), 1);
+            }
+        }
+    }
+    catch {
+        // fall through to manual entry
+    }
+    return ask(rl, 'GITHUB_ORGANIZATION');
+}
 /** Calls GET /user on the GitHub API to verify the token. Returns login + email on success or `{ error: string }` on failure. */
 async function tryGetGithubUser(credentials) {
     try {
@@ -236,6 +340,19 @@ async function tryGetAcmCertificate(arn, credentials) {
         return { error: firstLine };
     }
 }
+/** Verifies Azure credentials by acquiring a token and listing resource groups (cheap, works with just Reader access). */
+async function tryGetAzureAccountInfo(credentials) {
+    try {
+        const credential = new identity_1.ClientSecretCredential(credentials.AZURE_TENANT_ID, credentials.AZURE_CLIENT_ID, credentials.AZURE_CLIENT_SECRET);
+        const client = new arm_resources_1.ResourceManagementClient(credential, credentials.AZURE_SUBSCRIPTION_ID);
+        const iterator = client.resourceGroups.list();
+        await iterator.next();
+        return { subscriptionId: credentials.AZURE_SUBSCRIPTION_ID };
+    }
+    catch (err) {
+        return { error: err instanceof Error ? err.message : String(err) };
+    }
+}
 /** Displays credential verification results and throws if any check failed. */
 function assertCredentialResults(stsResult, ghUserResult, ghOrgResult) {
     const failures = [];
@@ -250,6 +367,20 @@ function assertCredentialResults(stsResult, ghUserResult, ghOrgResult) {
             failures.map((f) => `  • ${f}`).join('\n'));
     }
 }
+/** Displays Azure credential verification results and throws if any check failed. */
+function assertAzureCredentialResults(azResult, ghUserResult, ghOrgResult) {
+    const failures = [];
+    if ('error' in azResult)
+        failures.push(`Azure credentials: ${azResult.error}`);
+    if ('error' in ghUserResult)
+        failures.push(`GitHub token: ${ghUserResult.error}`);
+    if ('error' in ghOrgResult)
+        failures.push(`GitHub org: ${ghOrgResult.error}`);
+    if (failures.length > 0) {
+        throw new Error('Credential verification failed:\n' +
+            failures.map((f) => `  • ${f}`).join('\n'));
+    }
+}
 /** Derives a sensible domain default: cliswovotest-api.swovo.com (production), cliswovotest-api-dev.swovo.com (others) */
 function defaultDomain(projectName, suffix, env, baseDomain) {
     const label = suffix === 'web' ? 'app' : suffix;
@@ -317,9 +448,10 @@ async function collectAnswers(rl) {
         credentials.AWS_ACCESS_KEY_ID = await ask(rl, 'AWS_ACCESS_KEY_ID');
         credentials.AWS_SECRET_ACCESS_KEY = await ask(rl, 'AWS_SECRET_ACCESS_KEY');
         credentials.AWS_REGION = await ask(rl, 'AWS_REGION', 'us-east-1');
-        credentials.GITHUB_TOKEN = await ask(rl, 'GITHUB_TOKEN');
+        const gh = await askGitHubToken(rl);
+        credentials.GITHUB_TOKEN = gh.token;
         credentials.GITHUB_USERNAME = await ask(rl, 'GITHUB_USERNAME');
-        credentials.GITHUB_ORGANIZATION = await ask(rl, 'GITHUB_ORGANIZATION');
+        credentials.GITHUB_ORGANIZATION = await askGitHubOrganizationFor(rl, gh.token);
         console.log('\n  Verifying credentials...');
         const [stsResult, ghUserResult, ghOrgResult] = await Promise.all([
             tryGetAwsAccountId(credentials),
@@ -462,6 +594,178 @@ async function collectAnswers(rl) {
     console.log('');
     return { credentials, projectName, ssl, slackWebhookUrl, appTypes, environments, baseDomain, domains };
 }
+// --- collectAzureAnswers ---
+async function collectAzureAnswers(rl) {
+    // --- Credentials ---
+    console.log('  Credentials');
+    console.log('  ────────────────────────────────────────────────────');
+    let credentials = {};
+    let useExistingCreds = false;
+    const credFilePath = path.resolve('.fuel-credentials');
+    if (await fs.pathExists(credFilePath)) {
+        try {
+            const existing = await fs.readJson(credFilePath);
+            console.log('\n  Found existing .fuel-credentials');
+            const [azResult, ghUserResult, ghOrgResult] = await Promise.all([
+                tryGetAzureAccountInfo(existing),
+                tryGetGithubUser(existing),
+                tryGetGithubOrg(existing),
+            ]);
+            if ('subscriptionId' in azResult) {
+                console.log(`    Azure Subscription: ${chalk_1.default.green(azResult.subscriptionId)}`);
+            }
+            else {
+                console.log('    ' + chalk_1.default.yellow('⚠') + ' Azure credentials invalid:');
+                console.log(`      ${azResult.error}`);
+            }
+            if ('login' in ghUserResult) {
+                console.log(`    GitHub User:        ${chalk_1.default.green(ghUserResult.login)}`);
+            }
+            else {
+                console.log('    ' + chalk_1.default.yellow('⚠') + ' GitHub token invalid:');
+                console.log(`      ${ghUserResult.error}`);
+            }
+            if ('id' in ghOrgResult) {
+                console.log(`    GitHub Org:         ${chalk_1.default.green(ghOrgResult.login)}  (ID: ${ghOrgResult.id})`);
+            }
+            else {
+                console.log('    ' + chalk_1.default.yellow('⚠') + ' Could not verify org:');
+                console.log(`      ${ghOrgResult.error}`);
+            }
+            assertAzureCredentialResults(azResult, ghUserResult, ghOrgResult);
+            console.log('');
+            useExistingCreds = await askYesNo(rl, 'Use these credentials?', true);
+            if (useExistingCreds)
+                credentials = existing;
+        }
+        catch (e) {
+            if (e instanceof Error && e.message.startsWith('Credential verification failed'))
+                throw e;
+            console.log('  Could not read .fuel-credentials — prompting for credentials.');
+        }
+    }
+    if (!useExistingCreds) {
+        credentials.AZURE_SUBSCRIPTION_ID = await ask(rl, 'AZURE_SUBSCRIPTION_ID');
+        credentials.AZURE_TENANT_ID = await ask(rl, 'AZURE_TENANT_ID');
+        credentials.AZURE_CLIENT_ID = await ask(rl, 'AZURE_CLIENT_ID');
+        credentials.AZURE_CLIENT_SECRET = await ask(rl, 'AZURE_CLIENT_SECRET');
+        const gh = await askGitHubToken(rl);
+        credentials.GITHUB_TOKEN = gh.token;
+        credentials.GITHUB_USERNAME = await ask(rl, 'GITHUB_USERNAME');
+        credentials.GITHUB_ORGANIZATION = await askGitHubOrganizationFor(rl, gh.token);
+        console.log('\n  Verifying credentials...');
+        const [azResult, ghUserResult, ghOrgResult] = await Promise.all([
+            tryGetAzureAccountInfo(credentials),
+            tryGetGithubUser(credentials),
+            tryGetGithubOrg(credentials),
+        ]);
+        if ('subscriptionId' in azResult) {
+            console.log(`    Azure Subscription: ${chalk_1.default.green(azResult.subscriptionId)}`);
+        }
+        else {
+            console.log('    ' + chalk_1.default.yellow('⚠') + ' Azure credentials invalid:');
+            console.log(`      ${azResult.error}`);
+        }
+        if ('login' in ghUserResult) {
+            console.log(`    GitHub User:        ${chalk_1.default.green(ghUserResult.login)}`);
+        }
+        else {
+            console.log('    ' + chalk_1.default.yellow('⚠') + ' GitHub token invalid:');
+            console.log(`      ${ghUserResult.error}`);
+        }
+        if ('id' in ghOrgResult) {
+            console.log(`    GitHub Org:         ${chalk_1.default.green(ghOrgResult.login)}  (ID: ${ghOrgResult.id})`);
+        }
+        else {
+            console.log('    ' + chalk_1.default.yellow('⚠') + ' Could not verify org:');
+            console.log(`      ${ghOrgResult.error}`);
+        }
+        assertAzureCredentialResults(azResult, ghUserResult, ghOrgResult);
+    }
+    console.log('');
+    // --- Project ---
+    console.log('  Project');
+    console.log('  ────────────────────────────────────────────────────');
+    const projectName = await ask(rl, 'Project name', 'my-app');
+    const location = await ask(rl, 'Azure region', 'eastus2');
+    const slackWebhookUrl = await ask(rl, 'Slack webhook URL for deploy/alarm notifications (leave empty to skip)', '');
+    console.log('');
+    // --- App configuration ---
+    console.log('  App configuration');
+    console.log('  ────────────────────────────────────────────────────');
+    const appChoice = await askSelect(rl, 'Include which apps?', ['API only (NestJS)', 'Web only (React/Next.js)', 'API + Web'], 3);
+    const includeApi = appChoice !== 'Web only (React/Next.js)';
+    const includeWeb = appChoice !== 'API only (NestJS)';
+    const appTypes = [];
+    if (includeApi) {
+        console.log('\n  API (NestJS):');
+        const dockerfile = await ask(rl, 'Dockerfile', 'apps/api/Dockerfile');
+        const port = await askInt(rl, 'Port', 3000);
+        const healthCheckPath = await ask(rl, 'Health check path', '/health');
+        const databaseEnabled = await askYesNo(rl, 'Include a database?', true);
+        let databaseEngine = 'mssql';
+        if (databaseEnabled) {
+            const engineChoice = await askSelect(rl, '  Database engine', ['Azure SQL Database (mssql)', 'PostgreSQL Flexible Server (postgres)'], 1);
+            databaseEngine = engineChoice.includes('mssql') ? 'mssql' : 'postgres';
+        }
+        const redisEnabled = await askYesNo(rl, 'Include Redis?', false);
+        appTypes.push({
+            suffix: 'api', dockerfile, port, healthCheckPath,
+            databaseEnabled, databaseEngine, redisEnabled, variables: {},
+        });
+    }
+    if (includeWeb) {
+        console.log('\n  Web (React/Next.js):');
+        const dockerfile = await ask(rl, 'Dockerfile', 'apps/web/Dockerfile');
+        const port = await askInt(rl, 'Port', 3000);
+        const healthCheckPath = await ask(rl, 'Health check path', '/health');
+        appTypes.push({
+            suffix: 'web', dockerfile, port, healthCheckPath,
+            databaseEnabled: false, databaseEngine: 'mssql', redisEnabled: false, variables: {},
+        });
+    }
+    console.log('');
+    // --- Environments ---
+    console.log('  Environments');
+    console.log('  ────────────────────────────────────────────────────');
+    const envPresets = {
+        'production only': ['production'],
+        'dev + production': ['dev', 'production'],
+        'dev + staging + production': ['dev', 'staging', 'production'],
+    };
+    const envChoice = await askSelect(rl, 'Environments', Object.keys(envPresets), 3);
+    const environments = envPresets[envChoice];
+    console.log('');
+    // --- Base domain + per-app domains ---
+    console.log('  Domains');
+    console.log('  ────────────────────────────────────────────────────');
+    const baseDomain = await ask(rl, 'Base domain');
+    console.log('');
+    const domains = {};
+    for (const appType of appTypes) {
+        domains[appType.suffix] = {};
+        for (const env of environments) {
+            const suggestion = baseDomain ? defaultDomain(projectName, appType.suffix, env, baseDomain) : '';
+            const appFullName = `${projectName}-${appType.suffix}-${env}`;
+            domains[appType.suffix][env] = await ask(rl, appFullName, suggestion || undefined);
+        }
+    }
+    console.log('');
+    // --- Environment variables (per app × per environment) ---
+    console.log('  Environment variables');
+    console.log('  ────────────────────────────────────────────────────');
+    for (const appType of appTypes) {
+        const isApi = appType.suffix === 'api';
+        for (const env of environments) {
+            const label = isApi
+                ? `${projectName}-api-${env} runtime variables (e.g. TWILIO_TOKEN=xxx)`
+                : `${projectName}-web-${env} build variables (NEXT_PUBLIC_API_HOST and NEXT_PUBLIC_APP_HOST are already included)`;
+            appType.variables[env] = await askKeyValues(rl, label);
+        }
+    }
+    console.log('');
+    return { credentials, projectName, slackWebhookUrl, location, appTypes, environments, baseDomain, domains };
+}
 // --- applyInfraInitAnswers ---
 async function applyInfraInitAnswers(answers, opts) {
     // 1. Write .fuel-credentials
@@ -555,96 +859,211 @@ async function applyInfraInitAnswers(answers, opts) {
     console.log('    Review and edit fuel.yml to add workers/variables, then:');
     console.log(`    fuel create:app ${answers.projectName} --config fuel.yml\n`);
 }
-// --- infraInit ---
-async function infraInit(opts) {
-    if (opts.credentialsOnly) {
-        const rl = (0, promises_1.createInterface)({ input: process.stdin, output: process.stdout });
-        try {
-            console.log('\n  Credentials');
-            console.log('  ────────────────────────────────────────────────────');
-            const credentials = {};
-            const credFilePath = path.resolve('.fuel-credentials');
-            if (await fs.pathExists(credFilePath)) {
-                try {
-                    const existing = await fs.readJson(credFilePath);
-                    console.log('\n  Found existing .fuel-credentials');
-                    const [stsResult, ghUserResult, ghOrgResult] = await Promise.all([
-                        tryGetAwsAccountId(existing),
-                        tryGetGithubUser(existing),
-                        tryGetGithubOrg(existing),
-                    ]);
-                    if ('accountId' in stsResult) {
-                        console.log(`    AWS Account:  ${chalk_1.default.green(stsResult.accountId)}`);
-                    }
-                    if ('login' in ghUserResult) {
-                        console.log(`    GitHub User:  ${chalk_1.default.green(ghUserResult.login)}`);
-                    }
-                    if ('login' in ghOrgResult) {
-                        console.log(`    GitHub Org:   ${chalk_1.default.green(ghOrgResult.login)}`);
-                    }
-                    assertCredentialResults(stsResult, ghUserResult, ghOrgResult);
-                    console.log('');
-                    const useExisting = await askYesNo(rl, 'Use these credentials?', true);
-                    if (useExisting) {
-                        console.log(chalk_1.default.green('\n  ✓ Existing credentials verified.\n'));
-                        return;
-                    }
-                }
-                catch (e) {
-                    if (e instanceof Error && e.message.startsWith('Credential verification failed'))
-                        throw e;
-                    console.log('  Could not read .fuel-credentials — prompting for credentials.');
-                }
-            }
-            credentials.AWS_ACCESS_KEY_ID = await ask(rl, 'AWS_ACCESS_KEY_ID');
-            credentials.AWS_SECRET_ACCESS_KEY = await ask(rl, 'AWS_SECRET_ACCESS_KEY');
-            credentials.AWS_REGION = await ask(rl, 'AWS_REGION', 'us-east-1');
-            credentials.GITHUB_TOKEN = await ask(rl, 'GITHUB_TOKEN');
-            credentials.GITHUB_USERNAME = await ask(rl, 'GITHUB_USERNAME');
-            credentials.GITHUB_ORGANIZATION = await ask(rl, 'GITHUB_ORGANIZATION');
-            console.log('\n  Verifying credentials...');
-            const [stsResult, ghUserResult, ghOrgResult] = await Promise.all([
-                tryGetAwsAccountId(credentials),
-                tryGetGithubUser(credentials),
-                tryGetGithubOrg(credentials),
-            ]);
-            if ('accountId' in stsResult) {
-                console.log(`    AWS Account:  ${chalk_1.default.green(stsResult.accountId)}`);
-            }
-            if ('login' in ghUserResult) {
-                console.log(`    GitHub User:  ${chalk_1.default.green(ghUserResult.login)}`);
+// --- applyAzureInfraInitAnswers ---
+async function applyAzureInfraInitAnswers(answers, opts) {
+    // 1. Write .fuel-credentials
+    const credPath = path.resolve('.fuel-credentials');
+    await fs.writeFile(credPath, JSON.stringify(answers.credentials, null, 2));
+    console.log(chalk_1.default.green('✓') + ' Credentials written to .fuel-credentials');
+    // 2. Ensure .gitignore contains .fuel-credentials
+    const gitignorePath = path.resolve('.gitignore');
+    const CRED_LINE = '.fuel-credentials';
+    if (await fs.pathExists(gitignorePath)) {
+        const content = await fs.readFile(gitignorePath, 'utf-8');
+        if (!content.split('\n').some((l) => l.trim() === CRED_LINE)) {
+            await fs.appendFile(gitignorePath, `\n${CRED_LINE}\n`);
+            console.log(chalk_1.default.green('✓') + ' .fuel-credentials added to .gitignore');
+        }
+        else {
+            console.log('  .fuel-credentials already in .gitignore');
+        }
+    }
+    else {
+        await fs.writeFile(gitignorePath, `${CRED_LINE}\n`);
+        console.log(chalk_1.default.green('✓') + ' .fuel-credentials added to .gitignore');
+    }
+    // 3. Build config (cartesian product: appTypes × environments)
+    const apps = [];
+    for (const appType of answers.appTypes) {
+        const isApi = appType.suffix === 'api';
+        const technology = isApi ? 'nest' : 'react';
+        for (const env of answers.environments) {
+            const branch = env === 'production' ? 'main' : env;
+            const app = {
+                name: `${answers.projectName}-${appType.suffix}-${env}`,
+                technology,
+                dockerfile: appType.dockerfile,
+                domain: answers.domains[appType.suffix][env],
+                port: appType.port,
+                health_check_path: appType.healthCheckPath,
+                branch,
+                variables: {},
+                build_env: {},
+                workers: [],
+            };
+            if (isApi) {
+                app.variables = appType.variables[env] ?? {};
+                app.database = { enabled: appType.databaseEnabled, engine: appType.databaseEngine };
+                app.redis = { enabled: appType.redisEnabled };
             }
-            if ('login' in ghOrgResult) {
-                console.log(`    GitHub Org:   ${chalk_1.default.green(ghOrgResult.login)}`);
+            else {
+                // Auto-populate build_env from domains; user-provided vars override
+                const autoBuildEnv = {};
+                const webDomain = answers.domains['web']?.[env];
+                if (webDomain)
+                    autoBuildEnv['NEXT_PUBLIC_APP_HOST'] = `https://${webDomain}`;
+                const apiDomain = answers.domains['api']?.[env];
+                if (apiDomain)
+                    autoBuildEnv['NEXT_PUBLIC_API_HOST'] = `https://${apiDomain}`;
+                app.build_env = { ...autoBuildEnv, ...(appType.variables[env] ?? {}) };
+                app.database = { enabled: false, engine: azure_defaults_1.AZURE_DEFAULTS.database.engine };
+                app.redis = { enabled: false };
             }
-            assertCredentialResults(stsResult, ghUserResult, ghOrgResult);
-            await fs.writeFile(credFilePath, JSON.stringify(credentials, null, 2));
-            console.log(chalk_1.default.green('\n  ✓') + ' Credentials written to .fuel-credentials');
-            const gitignorePath = path.resolve('.gitignore');
-            const CRED_LINE = '.fuel-credentials';
-            if (await fs.pathExists(gitignorePath)) {
-                const content = await fs.readFile(gitignorePath, 'utf-8');
-                if (!content.split('\n').some((l) => l.trim() === CRED_LINE)) {
-                    await fs.appendFile(gitignorePath, `\n${CRED_LINE}\n`);
-                }
+            app.container_app = {
+                cpu: azure_defaults_1.AZURE_DEFAULTS.containerApp.cpu,
+                memory: azure_defaults_1.AZURE_DEFAULTS.containerApp.memory,
+                concurrent_requests: azure_defaults_1.AZURE_DEFAULTS.containerApp.concurrentRequests,
+                min_replicas: azure_defaults_1.AZURE_DEFAULTS.containerApp.minReplicas,
+                max_replicas: azure_defaults_1.AZURE_DEFAULTS.containerApp.maxReplicas,
+            };
+            apps.push(app);
+        }
+    }
+    const config = {
+        name: answers.projectName,
+        deployment: 'azure',
+        location: answers.location,
+        slack_webhook_url: answers.slackWebhookUrl || '',
+        apps,
+    };
+    // 4. Guard against overwriting existing config
+    const outputPath = opts.output ? path.resolve(opts.output) : path.resolve('fuel.yml');
+    if (await fs.pathExists(outputPath)) {
+        throw new Error(`${outputPath} already exists. Remove it first or use --output <path>.`);
+    }
+    // 5. Write fuel.yml
+    const schemaComment = '# yaml-language-server: $schema=node_modules/@swovohq/fuel/schema/fuel.schema.json\n';
+    await fs.writeFile(outputPath, schemaComment + YAML.stringify(config));
+    const totalApps = answers.appTypes.length * answers.environments.length;
+    console.log(chalk_1.default.green('✓') +
+        ` fuel.yml written — ${totalApps} apps (${answers.appTypes.length} types × ${answers.environments.length} environments)`);
+    // 6. Next steps
+    console.log('\n  Next steps:');
+    console.log('    Review and edit fuel.yml to add workers/variables, then:');
+    console.log(`    fuel create:app ${answers.projectName} --config fuel.yml\n`);
+}
+// --- infraInit ---
+/** Interactive credentials-only flow (used by `auth:init` and `infra:init --credentials-only`) for the given cloud. */
+async function collectCredentialsOnly(rl, cloud) {
+    console.log('\n  Credentials');
+    console.log('  ────────────────────────────────────────────────────');
+    const credentials = {};
+    const credFilePath = path.resolve('.fuel-credentials');
+    if (await fs.pathExists(credFilePath)) {
+        try {
+            const existing = await fs.readJson(credFilePath);
+            console.log('\n  Found existing .fuel-credentials');
+            if (cloud === 'aws') {
+                const [stsResult, ghUserResult, ghOrgResult] = await Promise.all([
+                    tryGetAwsAccountId(existing), tryGetGithubUser(existing), tryGetGithubOrg(existing),
+                ]);
+                if ('accountId' in stsResult)
+                    console.log(`    AWS Account:  ${chalk_1.default.green(stsResult.accountId)}`);
+                if ('login' in ghUserResult)
+                    console.log(`    GitHub User:  ${chalk_1.default.green(ghUserResult.login)}`);
+                if ('login' in ghOrgResult)
+                    console.log(`    GitHub Org:   ${chalk_1.default.green(ghOrgResult.login)}`);
+                assertCredentialResults(stsResult, ghUserResult, ghOrgResult);
             }
             else {
-                await fs.writeFile(gitignorePath, `${CRED_LINE}\n`);
+                const [azResult, ghUserResult, ghOrgResult] = await Promise.all([
+                    tryGetAzureAccountInfo(existing), tryGetGithubUser(existing), tryGetGithubOrg(existing),
+                ]);
+                if ('subscriptionId' in azResult)
+                    console.log(`    Azure Subscription: ${chalk_1.default.green(azResult.subscriptionId)}`);
+                if ('login' in ghUserResult)
+                    console.log(`    GitHub User:        ${chalk_1.default.green(ghUserResult.login)}`);
+                if ('login' in ghOrgResult)
+                    console.log(`    GitHub Org:         ${chalk_1.default.green(ghOrgResult.login)}`);
+                assertAzureCredentialResults(azResult, ghUserResult, ghOrgResult);
             }
             console.log('');
+            const useExisting = await askYesNo(rl, 'Use these credentials?', true);
+            if (useExisting) {
+                console.log(chalk_1.default.green('\n  ✓ Existing credentials verified.\n'));
+                return;
+            }
         }
-        finally {
-            rl.close();
+        catch (e) {
+            if (e instanceof Error && e.message.startsWith('Credential verification failed'))
+                throw e;
+            console.log('  Could not read .fuel-credentials — prompting for credentials.');
         }
-        return;
     }
+    if (cloud === 'aws') {
+        credentials.AWS_ACCESS_KEY_ID = await ask(rl, 'AWS_ACCESS_KEY_ID');
+        credentials.AWS_SECRET_ACCESS_KEY = await ask(rl, 'AWS_SECRET_ACCESS_KEY');
+        credentials.AWS_REGION = await ask(rl, 'AWS_REGION', 'us-east-1');
+    }
+    else {
+        credentials.AZURE_SUBSCRIPTION_ID = await ask(rl, 'AZURE_SUBSCRIPTION_ID');
+        credentials.AZURE_TENANT_ID = await ask(rl, 'AZURE_TENANT_ID');
+        credentials.AZURE_CLIENT_ID = await ask(rl, 'AZURE_CLIENT_ID');
+        credentials.AZURE_CLIENT_SECRET = await ask(rl, 'AZURE_CLIENT_SECRET');
+    }
+    const gh = await askGitHubToken(rl);
+    credentials.GITHUB_TOKEN = gh.token;
+    credentials.GITHUB_USERNAME = await ask(rl, 'GITHUB_USERNAME');
+    credentials.GITHUB_ORGANIZATION = await askGitHubOrganizationFor(rl, gh.token);
+    console.log('\n  Verifying credentials...');
+    if (cloud === 'aws') {
+        const [stsResult, ghUserResult, ghOrgResult] = await Promise.all([
+            tryGetAwsAccountId(credentials), tryGetGithubUser(credentials), tryGetGithubOrg(credentials),
+        ]);
+        if ('accountId' in stsResult)
+            console.log(`    AWS Account:  ${chalk_1.default.green(stsResult.accountId)}`);
+        if ('login' in ghUserResult)
+            console.log(`    GitHub User:  ${chalk_1.default.green(ghUserResult.login)}`);
+        if ('login' in ghOrgResult)
+            console.log(`    GitHub Org:   ${chalk_1.default.green(ghOrgResult.login)}`);
+        assertCredentialResults(stsResult, ghUserResult, ghOrgResult);
+    }
+    else {
+        const [azResult, ghUserResult, ghOrgResult] = await Promise.all([
+            tryGetAzureAccountInfo(credentials), tryGetGithubUser(credentials), tryGetGithubOrg(credentials),
+        ]);
+        if ('subscriptionId' in azResult)
+            console.log(`    Azure Subscription: ${chalk_1.default.green(azResult.subscriptionId)}`);
+        if ('login' in ghUserResult)
+            console.log(`    GitHub User:        ${chalk_1.default.green(ghUserResult.login)}`);
+        if ('login' in ghOrgResult)
+            console.log(`    GitHub Org:         ${chalk_1.default.green(ghOrgResult.login)}`);
+        assertAzureCredentialResults(azResult, ghUserResult, ghOrgResult);
+    }
+    await fs.writeFile(credFilePath, JSON.stringify(credentials, null, 2));
+    console.log(chalk_1.default.green('\n  ✓') + ' Credentials written to .fuel-credentials');
+    const gitignorePath = path.resolve('.gitignore');
+    const CRED_LINE = '.fuel-credentials';
+    if (await fs.pathExists(gitignorePath)) {
+        const content = await fs.readFile(gitignorePath, 'utf-8');
+        if (!content.split('\n').some((l) => l.trim() === CRED_LINE)) {
+            await fs.appendFile(gitignorePath, `\n${CRED_LINE}\n`);
+        }
+    }
+    else {
+        await fs.writeFile(gitignorePath, `${CRED_LINE}\n`);
+    }
+    console.log('');
+}
+async function infraInit(opts) {
     if (opts.template) {
         const outputPath = opts.output ? path.resolve(opts.output) : path.resolve('fuel.yml');
         if (await fs.pathExists(outputPath)) {
             throw new Error(`${outputPath} already exists. Remove it first or use --output <path>.`);
         }
         const schemaComment = '# yaml-language-server: $schema=node_modules/@swovohq/fuel/schema/fuel.schema.json\n';
-        await fs.writeFile(outputPath, schemaComment + YAML.stringify(exports.CONFIG_TEMPLATE));
+        const template = opts.azure ? exports.CONFIG_TEMPLATE_AZURE : exports.CONFIG_TEMPLATE;
+        await fs.writeFile(outputPath, schemaComment + YAML.stringify(template));
         console.log(chalk_1.default.green('✓') + ` Config template written to ${outputPath}`);
         console.log('\nEdit the file with your project details, then run:\n' +
             '  fuel create:app my-app --config fuel.yml\n');
@@ -652,8 +1071,19 @@ async function infraInit(opts) {
     }
     const rl = (0, promises_1.createInterface)({ input: process.stdin, output: process.stdout });
     try {
-        const answers = await collectAnswers(rl);
-        await applyInfraInitAnswers(answers, opts);
+        const cloud = opts.azure ? 'azure' : await askCloudChoice(rl);
+        if (opts.credentialsOnly) {
+            await collectCredentialsOnly(rl, cloud);
+            return;
+        }
+        if (cloud === 'azure') {
+            const answers = await collectAzureAnswers(rl);
+            await applyAzureInfraInitAnswers(answers, opts);
+        }
+        else {
+            const answers = await collectAnswers(rl);
+            await applyInfraInitAnswers(answers, opts);
+        }
     }
     finally {
         rl.close();