@swovohq/fuel 0.2.2-alpha.9 → 0.2.2-alpha.91

package/dist/commands/infra-init.js

@@ -36,8 +36,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CONFIG_TEMPLATE = void 0;
+exports.CONFIG_TEMPLATE_AZURE = exports.CONFIG_TEMPLATE = void 0;
 exports.applyInfraInitAnswers = applyInfraInitAnswers;
+exports.applyAzureInfraInitAnswers = applyAzureInfraInitAnswers;
 exports.infraInit = infraInit;
 const fs = __importStar(require("fs-extra"));
 const path = __importStar(require("path"));
@@ -47,16 +48,26 @@ const promises_1 = require("readline/promises");
 const child_process_1 = require("child_process");
 const util_1 = require("util");
 const https = __importStar(require("https"));
+const identity_1 = require("@azure/identity");
+const arm_resources_1 = require("@azure/arm-resources");
+const azure_defaults_1 = require("../infra/azure-defaults");
+const github_client_1 = require("../infra/github-client");
+const github_token_link_1 = require("../infra/github-token-link");
 const execAsync = (0, util_1.promisify)(child_process_1.exec);
 function httpsGetJson(url, headers) {
     return new Promise((resolve, reject) => {
         const req = https.get(url, { headers }, (res) => {
             let body = '';
-            res.on('data', (chunk) => { body += chunk.toString(); });
+            res.on('data', (chunk) => {
+                body += chunk.toString();
+            });
             res.on('end', () => resolve({ status: res.statusCode ?? 0, body }));
         });
         req.on('error', reject);
-        req.setTimeout(10000, () => { req.destroy(); reject(new Error('Request timed out')); });
+        req.setTimeout(10000, () => {
+            req.destroy();
+            reject(new Error('Request timed out'));
+        });
     });
 }
 exports.CONFIG_TEMPLATE = {
@@ -80,7 +91,7 @@ exports.CONFIG_TEMPLATE = {
             db_instance_type: 'db.t3.small',
             db_allocated_storage: 30,
             variables: {},
-            workers: [],
+            workers: []
         },
         {
             name: 'my-app-web',
@@ -93,10 +104,59 @@ exports.CONFIG_TEMPLATE = {
             cpu_units: 1024,
             memory_units: 2048,
             build_env: {
-                NEXT_PUBLIC_API_HOST: 'https://api.example.com',
+                NEXT_PUBLIC_API_HOST: 'https://api.example.com'
+            }
+        }
+    ]
+};
+exports.CONFIG_TEMPLATE_AZURE = {
+    name: 'my-app',
+    deployment: 'azure',
+    slack_webhook_url: '',
+    location: 'eastus2',
+    monitor: { daily_data_cap_gb: 1, retention_days: 90, dashboard_count: 0 },
+    front_door: { sku_name: 'Standard_AzureFrontDoor' },
+    storage_account: {
+        account_kind: 'BlockBlobStorage',
+        account_tier: 'Premium',
+        account_replication_type: 'LRS',
+        access_tier: 'Hot'
+    },
+    key_vault: { sku_name: 'standard' },
+    apps: [
+        {
+            name: 'my-app-api',
+            technology: 'nest',
+            dockerfile: 'apps/api/Dockerfile',
+            health_check_path: '/health',
+            domain: 'api.example.com',
+            port: 3000,
+            branch: 'main',
+            database: { enabled: true, engine: 'mssql', sku_name: 'GP_S_Gen5_4' },
+            redis: { enabled: false, sku_name: 'Balanced_B0' },
+            container_app: {
+                cpu: 1,
+                memory: '2Gi',
+                concurrent_requests: 20,
+                min_replicas: 0,
+                max_replicas: 3
             },
+            variables: {},
+            workers: []
         },
-    ],
+        {
+            name: 'my-app-web',
+            technology: 'react',
+            dockerfile: 'apps/web/Dockerfile',
+            health_check_path: '/health',
+            domain: 'app.example.com',
+            port: 3000,
+            branch: 'main',
+            build_env: {
+                NEXT_PUBLIC_API_HOST: 'https://api.example.com'
+            }
+        }
+    ]
 };
 // --- Private prompt helpers ---
 async function ask(rl, label, defaultVal) {
@@ -134,6 +194,14 @@ async function askSelect(rl, label, options, defaultIdx = 1) {
         console.log(`  Please enter a number between 1 and ${options.length}.`);
     }
 }
+/** Prompts which cloud provider to provision infrastructure for. */
+async function askCloudChoice(rl) {
+    console.log('  Cloud provider');
+    console.log('  ────────────────────────────────────────────────────');
+    const choice = await askSelect(rl, 'Deploy to', ['AWS (ECS)', 'Azure (Container Apps)'], 1);
+    console.log('');
+    return choice === 'AWS (ECS)' ? 'aws' : 'azure';
+}
 /** Prompts for KEY=VALUE pairs until the user submits an empty line. */
 async function askKeyValues(rl, label) {
     console.log(`\n  ${label} (KEY=VALUE format, empty line to finish):`);
@@ -152,18 +220,73 @@ async function askKeyValues(rl, label) {
     }
     return result;
 }
+/**
+ * Opens a GitHub token-creation page with the required scope already checked — the user
+ * never has to know or look up which permissions the CLI needs — then collects the pasted
+ * token and validates it immediately so a wrong/incomplete token surfaces right away instead
+ * of deep into a later step (repo creation, push, branch protection).
+ */
+async function askGitHubToken(rl) {
+    const url = (0, github_token_link_1.buildGitHubTokenUrl)();
+    console.log(chalk_1.default.cyan('\n  Create a GitHub Personal Access Token'));
+    console.log(`    ${url}`);
+    console.log('    The "repo" scope is already selected — just click "Generate token" at the bottom of the page.\n');
+    (0, github_token_link_1.openInBrowser)(url);
+    while (true) {
+        const token = await ask(rl, 'Paste the generated token (GITHUB_TOKEN)');
+        try {
+            await (0, github_client_1.validateGitHubToken)(token);
+            console.log(chalk_1.default.green('  ✓') + ' Token has the required permissions');
+            return { token };
+        }
+        catch (err) {
+            console.log(chalk_1.default.yellow(`  ⚠ ${err instanceof Error ? err.message : String(err)}`));
+            const retry = await askYesNo(rl, '  Try pasting the token again?', true);
+            if (!retry) {
+                throw new Error('GitHub token setup aborted — a validated token is required to continue.');
+            }
+        }
+    }
+}
+/** Lists the orgs available to the given token and lets the user pick one, falling back to manual entry. */
+async function askGitHubOrganizationFor(rl, token) {
+    try {
+        const { status, body } = await httpsGetJson('https://api.github.com/user/orgs', {
+            Authorization: `Bearer ${token}`,
+            'User-Agent': 'fuel-cli',
+            Accept: 'application/vnd.github+json'
+        });
+        if (status === 200) {
+            const orgs = JSON.parse(body);
+            if (orgs.length === 1) {
+                console.log(`  GitHub Org:   ${chalk_1.default.green(orgs[0].login)} (only org available to this account)`);
+                return orgs[0].login;
+            }
+            if (orgs.length > 1) {
+                return askSelect(rl, 'GitHub organization', orgs.map((o) => o.login), 1);
+            }
+        }
+    }
+    catch {
+        // fall through to manual entry
+    }
+    return ask(rl, 'GITHUB_ORGANIZATION');
+}
 /** Calls GET /user on the GitHub API to verify the token. Returns login + email on success or `{ error: string }` on failure. */
 async function tryGetGithubUser(credentials) {
     try {
         const { status, body } = await httpsGetJson('https://api.github.com/user', {
             Authorization: `Bearer ${credentials.GITHUB_TOKEN}`,
             'User-Agent': 'fuel-cli',
-            Accept: 'application/vnd.github+json',
+            Accept: 'application/vnd.github+json'
         });
         const data = JSON.parse(body);
         if (status !== 200)
             return { error: data.message ?? `HTTP ${status}` };
-        return { login: data.login ?? '(unknown)', email: data.email ?? '(private)' };
+        return {
+            login: data.login ?? '(unknown)',
+            email: data.email ?? '(private)'
+        };
     }
     catch (err) {
         return { error: err instanceof Error ? err.message : String(err) };
@@ -178,7 +301,7 @@ async function tryGetGithubOrg(credentials) {
         const { status, body } = await httpsGetJson(`https://api.github.com/orgs/${encodeURIComponent(org)}`, {
             Authorization: `Bearer ${credentials.GITHUB_TOKEN}`,
             'User-Agent': 'fuel-cli',
-            Accept: 'application/vnd.github+json',
+            Accept: 'application/vnd.github+json'
         });
         const data = JSON.parse(body);
         if (status !== 200)
@@ -197,9 +320,9 @@ async function tryGetAwsAccountId(credentials) {
                 ...process.env,
                 AWS_ACCESS_KEY_ID: credentials.AWS_ACCESS_KEY_ID,
                 AWS_SECRET_ACCESS_KEY: credentials.AWS_SECRET_ACCESS_KEY,
-                AWS_REGION: credentials.AWS_REGION,
+                AWS_REGION: credentials.AWS_REGION
             },
-            timeout: 10000,
+            timeout: 10000
         });
         const accountId = JSON.parse(stdout).Account ?? '';
         return { accountId };
@@ -207,7 +330,10 @@ async function tryGetAwsAccountId(credentials) {
     catch (err) {
         const e = err;
         const raw = e.stderr ?? e.message ?? String(err);
-        const firstLine = raw.split('\n').map((l) => l.trim()).find((l) => l.length > 0) ?? raw;
+        const firstLine = raw
+            .split('\n')
+            .map((l) => l.trim())
+            .find((l) => l.length > 0) ?? raw;
         return { error: firstLine };
     }
 }
@@ -219,23 +345,39 @@ async function tryGetAcmCertificate(arn, credentials) {
                 ...process.env,
                 AWS_ACCESS_KEY_ID: credentials.AWS_ACCESS_KEY_ID,
                 AWS_SECRET_ACCESS_KEY: credentials.AWS_SECRET_ACCESS_KEY,
-                AWS_REGION: credentials.AWS_REGION,
+                AWS_REGION: credentials.AWS_REGION
             },
-            timeout: 10000,
+            timeout: 10000
         });
         const cert = JSON.parse(stdout).Certificate;
         return {
             domainName: cert?.DomainName ?? '(unknown)',
-            status: cert?.Status ?? '(unknown)',
+            status: cert?.Status ?? '(unknown)'
         };
     }
     catch (err) {
         const e = err;
         const raw = e.stderr ?? e.message ?? String(err);
-        const firstLine = raw.split('\n').map((l) => l.trim()).find((l) => l.length > 0) ?? raw;
+        const firstLine = raw
+            .split('\n')
+            .map((l) => l.trim())
+            .find((l) => l.length > 0) ?? raw;
         return { error: firstLine };
     }
 }
+/** Verifies Azure credentials by acquiring a token and listing resource groups (cheap, works with just Reader access). */
+async function tryGetAzureAccountInfo(credentials) {
+    try {
+        const credential = new identity_1.ClientSecretCredential(credentials.AZURE_TENANT_ID, credentials.AZURE_CLIENT_ID, credentials.AZURE_CLIENT_SECRET);
+        const client = new arm_resources_1.ResourceManagementClient(credential, credentials.AZURE_SUBSCRIPTION_ID);
+        const iterator = client.resourceGroups.list();
+        await iterator.next();
+        return { subscriptionId: credentials.AZURE_SUBSCRIPTION_ID };
+    }
+    catch (err) {
+        return { error: err instanceof Error ? err.message : String(err) };
+    }
+}
 /** Displays credential verification results and throws if any check failed. */
 function assertCredentialResults(stsResult, ghUserResult, ghOrgResult) {
     const failures = [];
@@ -250,6 +392,20 @@ function assertCredentialResults(stsResult, ghUserResult, ghOrgResult) {
             failures.map((f) => `  • ${f}`).join('\n'));
     }
 }
+/** Displays Azure credential verification results and throws if any check failed. */
+function assertAzureCredentialResults(azResult, ghUserResult, ghOrgResult) {
+    const failures = [];
+    if ('error' in azResult)
+        failures.push(`Azure credentials: ${azResult.error}`);
+    if ('error' in ghUserResult)
+        failures.push(`GitHub token: ${ghUserResult.error}`);
+    if ('error' in ghOrgResult)
+        failures.push(`GitHub org: ${ghOrgResult.error}`);
+    if (failures.length > 0) {
+        throw new Error('Credential verification failed:\n' +
+            failures.map((f) => `  • ${f}`).join('\n'));
+    }
+}
 /** Derives a sensible domain default: cliswovotest-api.swovo.com (production), cliswovotest-api-dev.swovo.com (others) */
 function defaultDomain(projectName, suffix, env, baseDomain) {
     const label = suffix === 'web' ? 'app' : suffix;
@@ -270,12 +426,12 @@ async function collectAnswers(rl) {
     const credFilePath = path.resolve('.fuel-credentials');
     if (await fs.pathExists(credFilePath)) {
         try {
-            const existing = await fs.readJson(credFilePath);
+            const existing = (await fs.readJson(credFilePath));
             console.log('\n  Found existing .fuel-credentials');
             const [stsResult, ghUserResult, ghOrgResult] = await Promise.all([
                 tryGetAwsAccountId(existing),
                 tryGetGithubUser(existing),
-                tryGetGithubOrg(existing),
+                tryGetGithubOrg(existing)
             ]);
             if ('accountId' in stsResult) {
                 console.log(`    AWS Account:  ${chalk_1.default.green(stsResult.accountId)}`);
@@ -308,7 +464,8 @@ async function collectAnswers(rl) {
                 credentials = existing;
         }
         catch (e) {
-            if (e instanceof Error && e.message.startsWith('Credential verification failed'))
+            if (e instanceof Error &&
+                e.message.startsWith('Credential verification failed'))
                 throw e;
             console.log('  Could not read .fuel-credentials — prompting for credentials.');
         }
@@ -317,14 +474,15 @@ async function collectAnswers(rl) {
         credentials.AWS_ACCESS_KEY_ID = await ask(rl, 'AWS_ACCESS_KEY_ID');
         credentials.AWS_SECRET_ACCESS_KEY = await ask(rl, 'AWS_SECRET_ACCESS_KEY');
         credentials.AWS_REGION = await ask(rl, 'AWS_REGION', 'us-east-1');
-        credentials.GITHUB_TOKEN = await ask(rl, 'GITHUB_TOKEN');
+        const gh = await askGitHubToken(rl);
+        credentials.GITHUB_TOKEN = gh.token;
         credentials.GITHUB_USERNAME = await ask(rl, 'GITHUB_USERNAME');
-        credentials.GITHUB_ORGANIZATION = await ask(rl, 'GITHUB_ORGANIZATION');
+        credentials.GITHUB_ORGANIZATION = await askGitHubOrganizationFor(rl, gh.token);
         console.log('\n  Verifying credentials...');
         const [stsResult, ghUserResult, ghOrgResult] = await Promise.all([
             tryGetAwsAccountId(credentials),
             tryGetGithubUser(credentials),
-            tryGetGithubOrg(credentials),
+            tryGetGithubOrg(credentials)
         ]);
         if ('accountId' in stsResult) {
             console.log(`    AWS Account:  ${chalk_1.default.green(stsResult.accountId)}`);
@@ -401,9 +559,18 @@ async function collectAnswers(rl) {
         const cpuUnits = await askInt(rl, 'CPU units', 1024);
         const memoryUnits = await askInt(rl, 'Memory (MB)', 2048);
         appTypes.push({
-            suffix: 'api', dockerfile, port, healthCheckPath,
-            postgres, redis, cpuUnits, memoryUnits,
-            dbInstanceType, dbAllocatedStorage, redisInstanceType, variables: {},
+            suffix: 'api',
+            dockerfile,
+            port,
+            healthCheckPath,
+            postgres,
+            redis,
+            cpuUnits,
+            memoryUnits,
+            dbInstanceType,
+            dbAllocatedStorage,
+            redisInstanceType,
+            variables: {}
         });
     }
     if (includeWeb) {
@@ -414,10 +581,18 @@ async function collectAnswers(rl) {
         const cpuUnits = await askInt(rl, 'CPU units', 1024);
         const memoryUnits = await askInt(rl, 'Memory (MB)', 2048);
         appTypes.push({
-            suffix: 'web', dockerfile, port, healthCheckPath,
-            postgres: false, redis: false, cpuUnits, memoryUnits,
-            dbInstanceType: 'db.t3.small', dbAllocatedStorage: 30,
-            redisInstanceType: 'cache.t3.small', variables: {},
+            suffix: 'web',
+            dockerfile,
+            port,
+            healthCheckPath,
+            postgres: false,
+            redis: false,
+            cpuUnits,
+            memoryUnits,
+            dbInstanceType: 'db.t3.small',
+            dbAllocatedStorage: 30,
+            redisInstanceType: 'cache.t3.small',
+            variables: {}
         });
     }
     console.log('');
@@ -427,7 +602,7 @@ async function collectAnswers(rl) {
     const envPresets = {
         'production only': ['production'],
         'dev + production': ['dev', 'production'],
-        'dev + staging + production': ['dev', 'staging', 'production'],
+        'dev + staging + production': ['dev', 'staging', 'production']
     };
     const envChoice = await askSelect(rl, 'Environments', Object.keys(envPresets), 3);
     const environments = envPresets[envChoice];
@@ -441,7 +616,9 @@ async function collectAnswers(rl) {
     for (const appType of appTypes) {
         domains[appType.suffix] = {};
         for (const env of environments) {
-            const suggestion = baseDomain ? defaultDomain(projectName, appType.suffix, env, baseDomain) : '';
+            const suggestion = baseDomain
+                ? defaultDomain(projectName, appType.suffix, env, baseDomain)
+                : '';
             const appFullName = `${projectName}-${appType.suffix}-${env}`;
             domains[appType.suffix][env] = await ask(rl, appFullName, suggestion || undefined);
         }
@@ -460,7 +637,212 @@ async function collectAnswers(rl) {
         }
     }
     console.log('');
-    return { credentials, projectName, ssl, slackWebhookUrl, appTypes, environments, baseDomain, domains };
+    return {
+        credentials,
+        projectName,
+        ssl,
+        slackWebhookUrl,
+        appTypes,
+        environments,
+        baseDomain,
+        domains
+    };
+}
+// --- collectAzureAnswers ---
+async function collectAzureAnswers(rl) {
+    // --- Credentials ---
+    console.log('  Credentials');
+    console.log('  ────────────────────────────────────────────────────');
+    let credentials = {};
+    let useExistingCreds = false;
+    const credFilePath = path.resolve('.fuel-credentials');
+    if (await fs.pathExists(credFilePath)) {
+        try {
+            const existing = (await fs.readJson(credFilePath));
+            console.log('\n  Found existing .fuel-credentials');
+            const [azResult, ghUserResult, ghOrgResult] = await Promise.all([
+                tryGetAzureAccountInfo(existing),
+                tryGetGithubUser(existing),
+                tryGetGithubOrg(existing)
+            ]);
+            if ('subscriptionId' in azResult) {
+                console.log(`    Azure Subscription: ${chalk_1.default.green(azResult.subscriptionId)}`);
+            }
+            else {
+                console.log('    ' + chalk_1.default.yellow('⚠') + ' Azure credentials invalid:');
+                console.log(`      ${azResult.error}`);
+            }
+            if ('login' in ghUserResult) {
+                console.log(`    GitHub User:        ${chalk_1.default.green(ghUserResult.login)}`);
+            }
+            else {
+                console.log('    ' + chalk_1.default.yellow('⚠') + ' GitHub token invalid:');
+                console.log(`      ${ghUserResult.error}`);
+            }
+            if ('id' in ghOrgResult) {
+                console.log(`    GitHub Org:         ${chalk_1.default.green(ghOrgResult.login)}  (ID: ${ghOrgResult.id})`);
+            }
+            else {
+                console.log('    ' + chalk_1.default.yellow('⚠') + ' Could not verify org:');
+                console.log(`      ${ghOrgResult.error}`);
+            }
+            assertAzureCredentialResults(azResult, ghUserResult, ghOrgResult);
+            console.log('');
+            useExistingCreds = await askYesNo(rl, 'Use these credentials?', true);
+            if (useExistingCreds)
+                credentials = existing;
+        }
+        catch (e) {
+            if (e instanceof Error &&
+                e.message.startsWith('Credential verification failed'))
+                throw e;
+            console.log('  Could not read .fuel-credentials — prompting for credentials.');
+        }
+    }
+    if (!useExistingCreds) {
+        credentials.AZURE_SUBSCRIPTION_ID = await ask(rl, 'AZURE_SUBSCRIPTION_ID');
+        credentials.AZURE_TENANT_ID = await ask(rl, 'AZURE_TENANT_ID');
+        credentials.AZURE_CLIENT_ID = await ask(rl, 'AZURE_CLIENT_ID');
+        credentials.AZURE_CLIENT_SECRET = await ask(rl, 'AZURE_CLIENT_SECRET');
+        const gh = await askGitHubToken(rl);
+        credentials.GITHUB_TOKEN = gh.token;
+        credentials.GITHUB_USERNAME = await ask(rl, 'GITHUB_USERNAME');
+        credentials.GITHUB_ORGANIZATION = await askGitHubOrganizationFor(rl, gh.token);
+        console.log('\n  Verifying credentials...');
+        const [azResult, ghUserResult, ghOrgResult] = await Promise.all([
+            tryGetAzureAccountInfo(credentials),
+            tryGetGithubUser(credentials),
+            tryGetGithubOrg(credentials)
+        ]);
+        if ('subscriptionId' in azResult) {
+            console.log(`    Azure Subscription: ${chalk_1.default.green(azResult.subscriptionId)}`);
+        }
+        else {
+            console.log('    ' + chalk_1.default.yellow('⚠') + ' Azure credentials invalid:');
+            console.log(`      ${azResult.error}`);
+        }
+        if ('login' in ghUserResult) {
+            console.log(`    GitHub User:        ${chalk_1.default.green(ghUserResult.login)}`);
+        }
+        else {
+            console.log('    ' + chalk_1.default.yellow('⚠') + ' GitHub token invalid:');
+            console.log(`      ${ghUserResult.error}`);
+        }
+        if ('id' in ghOrgResult) {
+            console.log(`    GitHub Org:         ${chalk_1.default.green(ghOrgResult.login)}  (ID: ${ghOrgResult.id})`);
+        }
+        else {
+            console.log('    ' + chalk_1.default.yellow('⚠') + ' Could not verify org:');
+            console.log(`      ${ghOrgResult.error}`);
+        }
+        assertAzureCredentialResults(azResult, ghUserResult, ghOrgResult);
+    }
+    console.log('');
+    // --- Project ---
+    console.log('  Project');
+    console.log('  ────────────────────────────────────────────────────');
+    const projectName = await ask(rl, 'Project name', 'my-app');
+    const location = await ask(rl, 'Azure region', 'eastus2');
+    const slackWebhookUrl = await ask(rl, 'Slack webhook URL for deploy/alarm notifications (leave empty to skip)', '');
+    console.log('');
+    // --- App configuration ---
+    console.log('  App configuration');
+    console.log('  ────────────────────────────────────────────────────');
+    const appChoice = await askSelect(rl, 'Include which apps?', ['API only (NestJS)', 'Web only (React/Next.js)', 'API + Web'], 3);
+    const includeApi = appChoice !== 'Web only (React/Next.js)';
+    const includeWeb = appChoice !== 'API only (NestJS)';
+    const appTypes = [];
+    if (includeApi) {
+        console.log('\n  API (NestJS):');
+        const dockerfile = await ask(rl, 'Dockerfile', 'apps/api/Dockerfile');
+        const port = await askInt(rl, 'Port', 3000);
+        const healthCheckPath = await ask(rl, 'Health check path', '/health');
+        const databaseEnabled = await askYesNo(rl, 'Include a database?', true);
+        let databaseEngine = 'mssql';
+        if (databaseEnabled) {
+            const engineChoice = await askSelect(rl, '  Database engine', ['Azure SQL Database (mssql)', 'PostgreSQL Flexible Server (postgres)'], 1);
+            databaseEngine = engineChoice.includes('mssql') ? 'mssql' : 'postgres';
+        }
+        const redisEnabled = await askYesNo(rl, 'Include Redis?', false);
+        appTypes.push({
+            suffix: 'api',
+            dockerfile,
+            port,
+            healthCheckPath,
+            databaseEnabled,
+            databaseEngine,
+            redisEnabled,
+            variables: {}
+        });
+    }
+    if (includeWeb) {
+        console.log('\n  Web (React/Next.js):');
+        const dockerfile = await ask(rl, 'Dockerfile', 'apps/web/Dockerfile');
+        const port = await askInt(rl, 'Port', 3000);
+        const healthCheckPath = await ask(rl, 'Health check path', '/health');
+        appTypes.push({
+            suffix: 'web',
+            dockerfile,
+            port,
+            healthCheckPath,
+            databaseEnabled: false,
+            databaseEngine: 'mssql',
+            redisEnabled: false,
+            variables: {}
+        });
+    }
+    console.log('');
+    // --- Environments ---
+    console.log('  Environments');
+    console.log('  ────────────────────────────────────────────────────');
+    const envPresets = {
+        'production only': ['production'],
+        'dev + production': ['dev', 'production'],
+        'dev + staging + production': ['dev', 'staging', 'production']
+    };
+    const envChoice = await askSelect(rl, 'Environments', Object.keys(envPresets), 3);
+    const environments = envPresets[envChoice];
+    console.log('');
+    // --- Base domain + per-app domains ---
+    console.log('  Domains');
+    console.log('  ────────────────────────────────────────────────────');
+    const baseDomain = await ask(rl, 'Base domain');
+    console.log('');
+    const domains = {};
+    for (const appType of appTypes) {
+        domains[appType.suffix] = {};
+        for (const env of environments) {
+            const suggestion = baseDomain
+                ? defaultDomain(projectName, appType.suffix, env, baseDomain)
+                : '';
+            const appFullName = `${projectName}-${appType.suffix}-${env}`;
+            domains[appType.suffix][env] = await ask(rl, appFullName, suggestion || undefined);
+        }
+    }
+    console.log('');
+    // --- Environment variables (per app × per environment) ---
+    console.log('  Environment variables');
+    console.log('  ────────────────────────────────────────────────────');
+    for (const appType of appTypes) {
+        const isApi = appType.suffix === 'api';
+        for (const env of environments) {
+            const label = isApi
+                ? `${projectName}-api-${env} runtime variables (e.g. TWILIO_TOKEN=xxx)`
+                : `${projectName}-web-${env} build variables (NEXT_PUBLIC_API_HOST and NEXT_PUBLIC_APP_HOST are already included)`;
+            appType.variables[env] = await askKeyValues(rl, label);
+        }
+    }
+    console.log('');
+    return {
+        credentials,
+        projectName,
+        slackWebhookUrl,
+        location,
+        appTypes,
+        environments,
+        baseDomain,
+        domains
+    };
 }
 // --- applyInfraInitAnswers ---
 async function applyInfraInitAnswers(answers, opts) {
@@ -504,7 +886,7 @@ async function applyInfraInitAnswers(answers, opts) {
                 memory_units: appType.memoryUnits,
                 variables: {},
                 build_env: {},
-                workers: [],
+                workers: []
             };
             if (isApi) {
                 app.postgres = appType.postgres;
@@ -537,10 +919,12 @@ async function applyInfraInitAnswers(answers, opts) {
         deployment: 'ecs',
         ssl: answers.ssl,
         slack_webhook_url: answers.slackWebhookUrl || '',
-        apps,
+        apps
     };
     // 4. Guard against overwriting existing config
-    const outputPath = opts.output ? path.resolve(opts.output) : path.resolve('fuel.yml');
+    const outputPath = opts.output
+        ? path.resolve(opts.output)
+        : path.resolve('fuel.yml');
     if (await fs.pathExists(outputPath)) {
         throw new Error(`${outputPath} already exists. Remove it first or use --output <path>.`);
     }
@@ -555,96 +939,230 @@ async function applyInfraInitAnswers(answers, opts) {
     console.log('    Review and edit fuel.yml to add workers/variables, then:');
     console.log(`    fuel create:app ${answers.projectName} --config fuel.yml\n`);
 }
-// --- infraInit ---
-async function infraInit(opts) {
-    if (opts.credentialsOnly) {
-        const rl = (0, promises_1.createInterface)({ input: process.stdin, output: process.stdout });
-        try {
-            console.log('\n  Credentials');
-            console.log('  ────────────────────────────────────────────────────');
-            const credentials = {};
-            const credFilePath = path.resolve('.fuel-credentials');
-            if (await fs.pathExists(credFilePath)) {
-                try {
-                    const existing = await fs.readJson(credFilePath);
-                    console.log('\n  Found existing .fuel-credentials');
-                    const [stsResult, ghUserResult, ghOrgResult] = await Promise.all([
-                        tryGetAwsAccountId(existing),
-                        tryGetGithubUser(existing),
-                        tryGetGithubOrg(existing),
-                    ]);
-                    if ('accountId' in stsResult) {
-                        console.log(`    AWS Account:  ${chalk_1.default.green(stsResult.accountId)}`);
-                    }
-                    if ('login' in ghUserResult) {
-                        console.log(`    GitHub User:  ${chalk_1.default.green(ghUserResult.login)}`);
-                    }
-                    if ('login' in ghOrgResult) {
-                        console.log(`    GitHub Org:   ${chalk_1.default.green(ghOrgResult.login)}`);
-                    }
-                    assertCredentialResults(stsResult, ghUserResult, ghOrgResult);
-                    console.log('');
-                    const useExisting = await askYesNo(rl, 'Use these credentials?', true);
-                    if (useExisting) {
-                        console.log(chalk_1.default.green('\n  ✓ Existing credentials verified.\n'));
-                        return;
-                    }
-                }
-                catch (e) {
-                    if (e instanceof Error && e.message.startsWith('Credential verification failed'))
-                        throw e;
-                    console.log('  Could not read .fuel-credentials — prompting for credentials.');
-                }
-            }
-            credentials.AWS_ACCESS_KEY_ID = await ask(rl, 'AWS_ACCESS_KEY_ID');
-            credentials.AWS_SECRET_ACCESS_KEY = await ask(rl, 'AWS_SECRET_ACCESS_KEY');
-            credentials.AWS_REGION = await ask(rl, 'AWS_REGION', 'us-east-1');
-            credentials.GITHUB_TOKEN = await ask(rl, 'GITHUB_TOKEN');
-            credentials.GITHUB_USERNAME = await ask(rl, 'GITHUB_USERNAME');
-            credentials.GITHUB_ORGANIZATION = await ask(rl, 'GITHUB_ORGANIZATION');
-            console.log('\n  Verifying credentials...');
-            const [stsResult, ghUserResult, ghOrgResult] = await Promise.all([
-                tryGetAwsAccountId(credentials),
-                tryGetGithubUser(credentials),
-                tryGetGithubOrg(credentials),
-            ]);
-            if ('accountId' in stsResult) {
-                console.log(`    AWS Account:  ${chalk_1.default.green(stsResult.accountId)}`);
-            }
-            if ('login' in ghUserResult) {
-                console.log(`    GitHub User:  ${chalk_1.default.green(ghUserResult.login)}`);
+// --- applyAzureInfraInitAnswers ---
+async function applyAzureInfraInitAnswers(answers, opts) {
+    // 1. Write .fuel-credentials
+    const credPath = path.resolve('.fuel-credentials');
+    await fs.writeFile(credPath, JSON.stringify(answers.credentials, null, 2));
+    console.log(chalk_1.default.green('✓') + ' Credentials written to .fuel-credentials');
+    // 2. Ensure .gitignore contains .fuel-credentials
+    const gitignorePath = path.resolve('.gitignore');
+    const CRED_LINE = '.fuel-credentials';
+    if (await fs.pathExists(gitignorePath)) {
+        const content = await fs.readFile(gitignorePath, 'utf-8');
+        if (!content.split('\n').some((l) => l.trim() === CRED_LINE)) {
+            await fs.appendFile(gitignorePath, `\n${CRED_LINE}\n`);
+            console.log(chalk_1.default.green('✓') + ' .fuel-credentials added to .gitignore');
+        }
+        else {
+            console.log('  .fuel-credentials already in .gitignore');
+        }
+    }
+    else {
+        await fs.writeFile(gitignorePath, `${CRED_LINE}\n`);
+        console.log(chalk_1.default.green('✓') + ' .fuel-credentials added to .gitignore');
+    }
+    // 3. Build config (cartesian product: appTypes × environments)
+    const apps = [];
+    for (const appType of answers.appTypes) {
+        const isApi = appType.suffix === 'api';
+        const technology = isApi ? 'nest' : 'react';
+        for (const env of answers.environments) {
+            const branch = env === 'production' ? 'main' : env;
+            const app = {
+                name: `${answers.projectName}-${appType.suffix}-${env}`,
+                technology,
+                dockerfile: appType.dockerfile,
+                domain: answers.domains[appType.suffix][env],
+                port: appType.port,
+                health_check_path: appType.healthCheckPath,
+                branch,
+                variables: {},
+                build_env: {},
+                workers: []
+            };
+            if (isApi) {
+                app.variables = appType.variables[env] ?? {};
+                app.database = {
+                    enabled: appType.databaseEnabled,
+                    engine: appType.databaseEngine
+                };
+                app.redis = { enabled: appType.redisEnabled };
             }
-            if ('login' in ghOrgResult) {
-                console.log(`    GitHub Org:   ${chalk_1.default.green(ghOrgResult.login)}`);
+            else {
+                // Auto-populate build_env from domains; user-provided vars override
+                const autoBuildEnv = {};
+                const webDomain = answers.domains['web']?.[env];
+                if (webDomain)
+                    autoBuildEnv['NEXT_PUBLIC_APP_HOST'] = `https://${webDomain}`;
+                const apiDomain = answers.domains['api']?.[env];
+                if (apiDomain)
+                    autoBuildEnv['NEXT_PUBLIC_API_HOST'] = `https://${apiDomain}`;
+                app.build_env = { ...autoBuildEnv, ...(appType.variables[env] ?? {}) };
+                app.database = {
+                    enabled: false,
+                    engine: azure_defaults_1.AZURE_DEFAULTS.database.engine
+                };
+                app.redis = { enabled: false };
             }
-            assertCredentialResults(stsResult, ghUserResult, ghOrgResult);
-            await fs.writeFile(credFilePath, JSON.stringify(credentials, null, 2));
-            console.log(chalk_1.default.green('\n  ✓') + ' Credentials written to .fuel-credentials');
-            const gitignorePath = path.resolve('.gitignore');
-            const CRED_LINE = '.fuel-credentials';
-            if (await fs.pathExists(gitignorePath)) {
-                const content = await fs.readFile(gitignorePath, 'utf-8');
-                if (!content.split('\n').some((l) => l.trim() === CRED_LINE)) {
-                    await fs.appendFile(gitignorePath, `\n${CRED_LINE}\n`);
-                }
+            app.container_app = {
+                cpu: azure_defaults_1.AZURE_DEFAULTS.containerApp.cpu,
+                memory: azure_defaults_1.AZURE_DEFAULTS.containerApp.memory,
+                concurrent_requests: azure_defaults_1.AZURE_DEFAULTS.containerApp.concurrentRequests,
+                min_replicas: azure_defaults_1.AZURE_DEFAULTS.containerApp.minReplicas,
+                max_replicas: azure_defaults_1.AZURE_DEFAULTS.containerApp.maxReplicas
+            };
+            apps.push(app);
+        }
+    }
+    const config = {
+        name: answers.projectName,
+        deployment: 'azure',
+        location: answers.location,
+        slack_webhook_url: answers.slackWebhookUrl || '',
+        apps
+    };
+    // 4. Guard against overwriting existing config
+    const outputPath = opts.output
+        ? path.resolve(opts.output)
+        : path.resolve('fuel.yml');
+    if (await fs.pathExists(outputPath)) {
+        throw new Error(`${outputPath} already exists. Remove it first or use --output <path>.`);
+    }
+    // 5. Write fuel.yml
+    const schemaComment = '# yaml-language-server: $schema=node_modules/@swovohq/fuel/schema/fuel.schema.json\n';
+    await fs.writeFile(outputPath, schemaComment + YAML.stringify(config));
+    const totalApps = answers.appTypes.length * answers.environments.length;
+    console.log(chalk_1.default.green('✓') +
+        ` fuel.yml written — ${totalApps} apps (${answers.appTypes.length} types × ${answers.environments.length} environments)`);
+    // 6. Next steps
+    console.log('\n  Next steps:');
+    console.log('    Review and edit fuel.yml to add workers/variables, then:');
+    console.log(`    fuel create:app ${answers.projectName} --config fuel.yml\n`);
+}
+// --- infraInit ---
+/** Interactive credentials-only flow (used by `auth:init` and `infra:init --credentials-only`) for the given cloud. */
+async function collectCredentialsOnly(rl, cloud) {
+    console.log('\n  Credentials');
+    console.log('  ────────────────────────────────────────────────────');
+    const credentials = {};
+    const credFilePath = path.resolve('.fuel-credentials');
+    if (await fs.pathExists(credFilePath)) {
+        try {
+            const existing = (await fs.readJson(credFilePath));
+            console.log('\n  Found existing .fuel-credentials');
+            if (cloud === 'aws') {
+                const [stsResult, ghUserResult, ghOrgResult] = await Promise.all([
+                    tryGetAwsAccountId(existing),
+                    tryGetGithubUser(existing),
+                    tryGetGithubOrg(existing)
+                ]);
+                if ('accountId' in stsResult)
+                    console.log(`    AWS Account:  ${chalk_1.default.green(stsResult.accountId)}`);
+                if ('login' in ghUserResult)
+                    console.log(`    GitHub User:  ${chalk_1.default.green(ghUserResult.login)}`);
+                if ('login' in ghOrgResult)
+                    console.log(`    GitHub Org:   ${chalk_1.default.green(ghOrgResult.login)}`);
+                assertCredentialResults(stsResult, ghUserResult, ghOrgResult);
             }
             else {
-                await fs.writeFile(gitignorePath, `${CRED_LINE}\n`);
+                const [azResult, ghUserResult, ghOrgResult] = await Promise.all([
+                    tryGetAzureAccountInfo(existing),
+                    tryGetGithubUser(existing),
+                    tryGetGithubOrg(existing)
+                ]);
+                if ('subscriptionId' in azResult)
+                    console.log(`    Azure Subscription: ${chalk_1.default.green(azResult.subscriptionId)}`);
+                if ('login' in ghUserResult)
+                    console.log(`    GitHub User:        ${chalk_1.default.green(ghUserResult.login)}`);
+                if ('login' in ghOrgResult)
+                    console.log(`    GitHub Org:         ${chalk_1.default.green(ghOrgResult.login)}`);
+                assertAzureCredentialResults(azResult, ghUserResult, ghOrgResult);
             }
             console.log('');
+            const useExisting = await askYesNo(rl, 'Use these credentials?', true);
+            if (useExisting) {
+                console.log(chalk_1.default.green('\n  ✓ Existing credentials verified.\n'));
+                return;
+            }
         }
-        finally {
-            rl.close();
+        catch (e) {
+            if (e instanceof Error &&
+                e.message.startsWith('Credential verification failed'))
+                throw e;
+            console.log('  Could not read .fuel-credentials — prompting for credentials.');
         }
-        return;
     }
+    if (cloud === 'aws') {
+        credentials.AWS_ACCESS_KEY_ID = await ask(rl, 'AWS_ACCESS_KEY_ID');
+        credentials.AWS_SECRET_ACCESS_KEY = await ask(rl, 'AWS_SECRET_ACCESS_KEY');
+        credentials.AWS_REGION = await ask(rl, 'AWS_REGION', 'us-east-1');
+    }
+    else {
+        credentials.AZURE_SUBSCRIPTION_ID = await ask(rl, 'AZURE_SUBSCRIPTION_ID');
+        credentials.AZURE_TENANT_ID = await ask(rl, 'AZURE_TENANT_ID');
+        credentials.AZURE_CLIENT_ID = await ask(rl, 'AZURE_CLIENT_ID');
+        credentials.AZURE_CLIENT_SECRET = await ask(rl, 'AZURE_CLIENT_SECRET');
+    }
+    const gh = await askGitHubToken(rl);
+    credentials.GITHUB_TOKEN = gh.token;
+    credentials.GITHUB_USERNAME = await ask(rl, 'GITHUB_USERNAME');
+    credentials.GITHUB_ORGANIZATION = await askGitHubOrganizationFor(rl, gh.token);
+    console.log('\n  Verifying credentials...');
+    if (cloud === 'aws') {
+        const [stsResult, ghUserResult, ghOrgResult] = await Promise.all([
+            tryGetAwsAccountId(credentials),
+            tryGetGithubUser(credentials),
+            tryGetGithubOrg(credentials)
+        ]);
+        if ('accountId' in stsResult)
+            console.log(`    AWS Account:  ${chalk_1.default.green(stsResult.accountId)}`);
+        if ('login' in ghUserResult)
+            console.log(`    GitHub User:  ${chalk_1.default.green(ghUserResult.login)}`);
+        if ('login' in ghOrgResult)
+            console.log(`    GitHub Org:   ${chalk_1.default.green(ghOrgResult.login)}`);
+        assertCredentialResults(stsResult, ghUserResult, ghOrgResult);
+    }
+    else {
+        const [azResult, ghUserResult, ghOrgResult] = await Promise.all([
+            tryGetAzureAccountInfo(credentials),
+            tryGetGithubUser(credentials),
+            tryGetGithubOrg(credentials)
+        ]);
+        if ('subscriptionId' in azResult)
+            console.log(`    Azure Subscription: ${chalk_1.default.green(azResult.subscriptionId)}`);
+        if ('login' in ghUserResult)
+            console.log(`    GitHub User:        ${chalk_1.default.green(ghUserResult.login)}`);
+        if ('login' in ghOrgResult)
+            console.log(`    GitHub Org:         ${chalk_1.default.green(ghOrgResult.login)}`);
+        assertAzureCredentialResults(azResult, ghUserResult, ghOrgResult);
+    }
+    await fs.writeFile(credFilePath, JSON.stringify(credentials, null, 2));
+    console.log(chalk_1.default.green('\n  ✓') + ' Credentials written to .fuel-credentials');
+    const gitignorePath = path.resolve('.gitignore');
+    const CRED_LINE = '.fuel-credentials';
+    if (await fs.pathExists(gitignorePath)) {
+        const content = await fs.readFile(gitignorePath, 'utf-8');
+        if (!content.split('\n').some((l) => l.trim() === CRED_LINE)) {
+            await fs.appendFile(gitignorePath, `\n${CRED_LINE}\n`);
+        }
+    }
+    else {
+        await fs.writeFile(gitignorePath, `${CRED_LINE}\n`);
+    }
+    console.log('');
+}
+async function infraInit(opts) {
     if (opts.template) {
-        const outputPath = opts.output ? path.resolve(opts.output) : path.resolve('fuel.yml');
+        const outputPath = opts.output
+            ? path.resolve(opts.output)
+            : path.resolve('fuel.yml');
         if (await fs.pathExists(outputPath)) {
             throw new Error(`${outputPath} already exists. Remove it first or use --output <path>.`);
         }
         const schemaComment = '# yaml-language-server: $schema=node_modules/@swovohq/fuel/schema/fuel.schema.json\n';
-        await fs.writeFile(outputPath, schemaComment + YAML.stringify(exports.CONFIG_TEMPLATE));
+        const template = opts.azure ? exports.CONFIG_TEMPLATE_AZURE : exports.CONFIG_TEMPLATE;
+        await fs.writeFile(outputPath, schemaComment + YAML.stringify(template));
         console.log(chalk_1.default.green('✓') + ` Config template written to ${outputPath}`);
         console.log('\nEdit the file with your project details, then run:\n' +
             '  fuel create:app my-app --config fuel.yml\n');
@@ -652,8 +1170,21 @@ async function infraInit(opts) {
     }
     const rl = (0, promises_1.createInterface)({ input: process.stdin, output: process.stdout });
     try {
-        const answers = await collectAnswers(rl);
-        await applyInfraInitAnswers(answers, opts);
+        const cloud = opts.azure
+            ? 'azure'
+            : await askCloudChoice(rl);
+        if (opts.credentialsOnly) {
+            await collectCredentialsOnly(rl, cloud);
+            return;
+        }
+        if (cloud === 'azure') {
+            const answers = await collectAzureAnswers(rl);
+            await applyAzureInfraInitAnswers(answers, opts);
+        }
+        else {
+            const answers = await collectAnswers(rl);
+            await applyInfraInitAnswers(answers, opts);
+        }
     }
     finally {
         rl.close();