natureco-cli 5.18.3 → 5.19.0

package/skills/azure-prepare/SKILL.md

@@ -0,0 +1,165 @@
+---
+name: azure-prepare
+description: "Prepare Azure apps for deployment (infra Bicep/Terraform, azure.yaml, Dockerfiles). Use for create/modernize or create+deploy; not cross-cloud migration (use azure-cloud-migrate). DO NOT USE FOR: copilot-sdk apps (use azure-hosted-copilot-sdk), or Python code-only App Service deploys (use python-appservice-deploy). WHEN: \"create app\", \"build web app\", \"create API\", \"modernize application\", \"host on Azure\", \"deploy to Azure\", \"deploy to Azure using Terraform\", \"deploy to Azure App Service\", \"deploy to Azure App Service using Terraform\", \"deploy to Azure Container Apps\", \"generate Terraform\", \"generate Bicep\", \"function app\", \"timer trigger\", \"service bus trigger\", \"event-driven function\", \"managed identity\"."
+license: MIT
+metadata:
+  author: Microsoft
+  version: "1.2.14"
+---
+
+# Azure Prepare
+
+> **AUTHORITATIVE GUIDANCE — MANDATORY COMPLIANCE**
+>
+> This document is the **official, canonical source** for preparing applications for Azure deployment. You **MUST** follow these instructions exactly as written unless they contradict security policies given to you. When in doubt, present the conflicting instructions from this document and ask the user for explicit confirmation. Do not improvise, infer, or substitute steps.
+
+---
+
+## Triggers
+
+Activate this skill when user wants to:
+- Create a new application
+- Add services or components to an existing app
+- Make updates or changes to existing application
+- Modernize or migrate an application
+- Set up Azure infrastructure
+- Deploy to Azure or host on Azure
+- Create and deploy to Azure (including Terraform-based deployment requests)
+
+## Rules
+
+1. **Plan first — MANDATORY** — You MUST physically write an initial `.azure/deployment-plan.md` **skeleton in the workspace root directory** (not the session-state folder) **as your very first action** — before any code generation or execution begins. Write the skeleton immediately, then populate it progressively as Phase 1 analysis and research unfold; finalize it with all decisions at Phase 1 Step 6. This file must exist on disk throughout. azure-validate and azure-deploy depend on it and will fail without it. Do not skip or defer this step.
+2. **Get approval** — Present plan to user before execution
+3. **Research before generating** — Load references and invoke related skills
+4. **Update plan progressively** — Mark steps complete as you go
+5. **Validate before deploy** — Invoke azure-validate before azure-deploy
+6. **Confirm Azure context** — Use `ask_user` for subscription and location per [Azure Context](references/azure-context.md)
+7. ❌ **Destructive actions require `ask_user`** — [Global Rules](references/global-rules.md)
+8. ⛔ **NEVER delete user project or workspace directories** — When adding features to an existing project, MODIFY existing files. `azd init -t <template>` is for NEW projects only; do NOT run `azd init -t` in an existing workspace. Plain `azd init` (without a template argument) may be used in existing workspaces when appropriate. File deletions within a project (e.g., removing build artifacts or temp files) are permitted when appropriate, but NEVER delete the user's project or workspace directory itself. See [Global Rules](references/global-rules.md).
+9. **Scope: preparation only** — This skill generates infrastructure code and configuration files. Deployment execution (`azd up`, `azd deploy`, `terraform apply`) is handled by the **azure-deploy** skill, which provides built-in error recovery and deployment verification.
+10. ⛔ **SQL Server Bicep: NEVER generate `administratorLogin` or `administratorLoginPassword`** — not in direct properties, not in conditional/ternary branches, not anywhere in the file. Always use Entra-only authentication (`azureADOnlyAuthentication: true`) unconditionally. See [references/services/sql-database/bicep.md](references/services/sql-database/bicep.md).
+11. **Remove stale template IaC after conversion** — If you converted Bicep templates from the selected `azd` template into Terraform templates, remove the Bicep templates that were introduced by that `azd` template and are now fully replaced by Terraform equivalents. Do not remove user-authored Bicep files. Only remove those template-provided Bicep files after the Terraform IaC is complete and Terraform has been selected as the deployment path. Before handing off to azure-validate skill, keep only the IaC templates required by the chosen deployment path.
+
+---
+
+## ❌ PLAN-FIRST WORKFLOW — MANDATORY
+
+> **YOU MUST CREATE A PLAN BEFORE DOING ANY WORK**
+>
+> 1. **STOP** — Do not generate any code, infrastructure, or configuration yet
+> 2. **CREATE SKELETON** - Write an initial `.azure/deployment-plan.md` skeleton to disk **immediately** (before any code generation or execution begins), then populate it progressively as Phase 1 steps 1-5 reveal details; finalize it at Step 6
+> 3. **CONFIRM** — Present the completed plan to the user and get approval
+> 4. **EXECUTE** — Only after approval, execute the plan step by step
+>
+> The `.azure/deployment-plan.md` file is the **source of truth** for this workflow and for azure-validate and azure-deploy skills. Without it, those skills will fail.
+>
+> ⚠️ **CRITICAL: `.azure/deployment-plan.md` must be WRITTEN TO DISK inside the workspace root** (e.g., `/tmp/my-project/.azure/deployment-plan.md`), not in the session-state folder. Use a file-write tool to create this file. This is the deployment plan artifact read by azure-validate and azure-deploy. **You MUST create this file — do not proceed without it.** 
+> ⚠️ **CRITICAL: You must create the file with the name `.azure/deployment-plan.md` as is**. You must not use other names such as `.azure/plan.md`.
+>
+> ⛔ **Critical:** Skipping the plan file creation will cause azure-validate and azure-deploy to fail. This requirement has no exceptions.
+
+---
+
+## ❌ STEP 0: Specialized Technology Check — MANDATORY FIRST ACTION
+
+**BEFORE starting Phase 1**, check if the user's prompt OR workspace codebase matches a specialized technology that has a dedicated skill with tested templates. If matched, **invoke that skill FIRST** — then resume azure-prepare for validation and deployment.
+
+### Check 1: Prompt keywords
+
+| Prompt keywords | Invoke FIRST |
+|----------------|-------------|
+| Python + App Service (e.g., "deploy Python to App Service", "Flask on Azure App Service", "publish Python web app to App Service") | **python-appservice-deploy** |
+| Lambda, AWS Lambda, migrate AWS, migrate GCP, Lambda to Functions, migrate from AWS, migrate from GCP | **azure-cloud-migrate** |
+| copilot SDK, copilot app, copilot-powered, @github/copilot-sdk, CopilotClient | **azure-hosted-copilot-sdk** |
+| Azure Functions, function app, serverless function, timer trigger, HTTP trigger, func new | Stay in **azure-prepare** — prefer Azure Functions templates in Step 4 |
+| APIM, API Management, API gateway, deploy APIM | Stay in **azure-prepare** — see [APIM Deployment Guide](references/apim.md) |
+| AI gateway, AI gateway policy, AI gateway backend, AI gateway configuration | **azure-aigateway** |
+| workflow, orchestration, multi-step, pipeline, fan-out/fan-in, saga, long-running process, durable, order processing | Stay in **azure-prepare** — select **durable** recipe in Step 4. **MUST** load [durable.md](references/services/functions/durable.md), [DTS reference](references/services/durable-task-scheduler/README.md), and [DTS Bicep patterns](references/services/durable-task-scheduler/bicep.md). |
+
+### Check 2: Codebase markers (even if prompt is generic like "deploy to Azure")
+
+| Codebase marker | Where | Invoke FIRST |
+|----------------|-------|-------------|
+| `@github/copilot-sdk` in dependencies | `package.json` | **azure-hosted-copilot-sdk** |
+| `copilot-sdk` in name or dependencies | `package.json` | **azure-hosted-copilot-sdk** |
+| `CopilotClient` import | `.ts`/`.js` source files | **azure-hosted-copilot-sdk** |
+| `createSession` + `sendAndWait` calls | `.ts`/`.js` source files | **azure-hosted-copilot-sdk** |
+
+> ⚠️ Check the user's **prompt text** — not just existing code. Critical for greenfield projects with no codebase to scan. See [full routing table](references/specialized-routing.md).
+
+After the specialized skill completes, **resume azure-prepare** at Phase 1 Step 4 (Select Recipe) for remaining infrastructure, validation, and deployment.
+
+---
+
+## Phase 1: Planning (BLOCKING — Complete Before Any Execution)
+
+Create `.azure/deployment-plan.md` by completing these steps. Do NOT generate any artifacts until the plan is approved.
+
+| # | Action | Reference |
+|---|--------|-----------|
+| 0 | **❌ Check Prompt AND Codebase for Specialized Tech** — If user mentions copilot SDK, Azure Functions, etc., OR codebase contains `@github/copilot-sdk`, invoke that skill first | [specialized-routing.md](references/specialized-routing.md) |
+| 1 | **Analyze Workspace** — Determine mode: NEW, MODIFY, or MODERNIZE | [analyze.md](references/analyze.md) |
+| 2 | **Gather Requirements** — Classification, scale, budget | [requirements.md](references/requirements.md) |
+| 3 | **Scan Codebase** — Identify components, technologies, dependencies | [scan.md](references/scan.md) |
+| 4 | **Select Recipe** — Choose AZD (default), AZCLI, Bicep, or Terraform | [recipe-selection.md](references/recipe-selection.md) |
+| 5 | **Plan Architecture** — Select stack + map components to Azure services | [architecture.md](references/architecture.md) |
+| 6 | **Finalize Plan (MANDATORY)** - Use a file-write tool to finalize `.azure/deployment-plan.md` with all decisions from steps 1-5. Update the skeleton written at the start of Phase 1 with the complete content. The file must be fully populated before you present the plan to the user. | [plan-template.md](references/plan-template.md) |
+| 7 | **Present Plan** — Show plan to user and ask for approval | `.azure/deployment-plan.md` |
+| 8 | **Destructive actions require `ask_user`** | [Global Rules](references/global-rules.md) |
+
+---
+
+> **❌ STOP HERE** — Do NOT proceed to Phase 2 until the user approves the plan.
+
+---
+
+## Phase 2: Execution (Only After Plan Approval)
+
+Execute the approved plan. Update `.azure/deployment-plan.md` status after each step.
+
+| # | Action | Reference |
+|---|--------|-----------|
+| 1 | **Research Components** — Load service references + invoke related skills | [research.md](references/research.md) |
+| 2 | **Confirm Azure Context** — Detect and confirm subscription + location and check the resource provisioning limit | [Azure Context](references/azure-context.md) |
+| 3 | **Generate Artifacts** — Create infrastructure and configuration files | [generate.md](references/generate.md) |
+| 4 | **Harden Security** — Apply security best practices | [security.md](references/security.md) |
+| 5 | **Functional Verification** — Verify the app works (UI + backend), locally if possible | [functional-verification.md](references/functional-verification.md) |
+| 6 | **⛔ Update Plan (MANDATORY before hand-off)** — Use the `edit` tool to change the Status in `.azure/deployment-plan.md` to `Ready for Validation`. You **MUST** complete this edit **BEFORE** invoking azure-validate. Do NOT skip this step. | `.azure/deployment-plan.md` |
+| 7 | **⛔ MANDATORY Hand Off** — Invoke **azure-validate** skill. Your preparation work is done. Do NOT run `azd up`, `azd deploy`, or any deployment command directly — all deployment execution is handled by azure-deploy after azure-validate completes. **PREREQUISITE:** Step 6 must be completed first — `.azure/deployment-plan.md` status must say `Ready for Validation`. | — |
+
+---
+
+## Outputs
+
+| Artifact | Location |
+|----------|----------|
+| **Plan** | `.azure/deployment-plan.md` |
+| Infrastructure | `./infra/` |
+| AZD Config | `azure.yaml` (AZD only) |
+| Dockerfiles | `src/<component>/Dockerfile` |
+
+---
+
+## SDK Quick References
+
+- **Azure Developer CLI**: [azd](references/sdk/azd-deployment.md)
+- **Azure Identity**: [Python](references/sdk/azure-identity-py.md) | [.NET](references/sdk/azure-identity-dotnet.md) | [TypeScript](references/sdk/azure-identity-ts.md) | [Java](references/sdk/azure-identity-java.md)
+- **App Configuration**: [Python](references/sdk/azure-appconfiguration-py.md) | [TypeScript](references/sdk/azure-appconfiguration-ts.md) | [Java](references/sdk/azure-appconfiguration-java.md)
+
+---
+
+## Next
+
+> **⛔ MANDATORY NEXT STEP — DO NOT SKIP**
+>
+> After completing preparation, you **MUST** invoke **azure-validate** before any deployment attempt. Do NOT skip validation. Do NOT go directly to azure-deploy. Do NOT run `azd up` or any deployment command directly. The workflow is:
+>
+> `azure-prepare` → `azure-validate` → `azure-deploy`
+>
+> **⛔ BEFORE invoking azure-validate**, you MUST use the `edit` tool to update `.azure/deployment-plan.md` status to `Ready for Validation`. If the plan status has not been updated, the validation will fail.
+>
+> This applies to ALL deployment scenarios including containerized apps, Container Apps, App Service, Azure Functions, static sites, and any other Azure target. No exceptions.
+>
+> Skipping validation leads to deployment failures. Be patient and follow the complete workflow for the highest success outcome.
+
+**→ Update plan status to `Ready for Validation`, then invoke azure-validate**

package/skills/azure-quotas/SKILL.md

@@ -0,0 +1,276 @@
+---
+name: azure-quotas
+description: "Check/manage Azure quotas and usage across providers. For deployment planning, capacity validation, region selection. WHEN: \"check quotas\", \"service limits\", \"current usage\", \"request quota increase\", \"quota exceeded\", \"validate capacity\", \"regional availability\", \"provisioning limits\", \"vCPU limit\", \"how many vCPUs available in my subscription\"."
+license: MIT
+metadata:
+  author: Microsoft
+  version: "1.1.2"
+---
+
+
+# Azure Quotas - Service Limits & Capacity Management
+
+> **AUTHORITATIVE GUIDANCE** — Follow these instructions exactly for quota management and capacity validation.
+
+## Overview
+
+**What are Azure Quotas?**
+
+Azure quotas (also called service limits) are the maximum number of resources you can deploy in a subscription. Quotas:
+- Prevent accidental over-provisioning
+- Ensure fair resource distribution across Azure
+- Represent **available capacity** in each region
+- Can be increased (adjustable quotas) or are fixed (non-adjustable)
+
+**Key Concept:** **Quotas = Resource Availability**
+
+If you don't have quota, you cannot deploy resources. Always check quotas when planning deployments or selecting regions.
+
+## When to Use This Skill
+
+Invoke this skill when:
+
+- **Planning a new deployment** - Validate capacity before deployment
+- **Selecting an Azure region** - Compare quota availability across regions
+- **Troubleshooting quota exceeded errors** - Check current usage vs limits
+- **Requesting quota increases** - Submit increase requests via CLI or Portal
+- **Comparing regional capacity** - Find regions with available quota
+- **Validating provisioning limits** - Ensure deployment won't exceed quotas
+
+## Quick Reference
+
+| **Property** | **Details** |
+|--------------|-------------|
+| **Primary Tool** | Azure CLI (`az quota`) - **USE THIS FIRST, ALWAYS** |
+| **Extension Required** | `az extension add --name quota` (MUST install first) |
+| **Key Commands** | `az quota list`, `az quota show`, `az quota usage list`, `az quota usage show` |
+| **Complete CLI Reference** | [commands.md](./references/commands.md) |
+| **Azure Portal** | [My quotas](https://portal.azure.com/#blade/Microsoft_Azure_Capacity/QuotaMenuBlade/myQuotas) - Use only as fallback |
+| **REST API** | Microsoft.Quota provider - **Unreliable, do NOT use first** |
+| **MCP Server** | `azure-quota` MCP server — **NEVER use this. It is unreliable. Always use `az quota` CLI instead.** |
+| **Required Permission** | Reader (view) or Quota Request Operator (manage) |
+
+> **⚠️ ALWAYS USE CLI FIRST**
+>
+> REST API and Portal can show misleading "No Limit" values — this does **not** mean unlimited capacity. It means the quota API doesn't support that resource type. Always start with `az quota` commands; fall back to [Azure service limits docs](https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits) if CLI returns `BadRequest`.
+>
+> For complete CLI reference, see [commands.md](./references/commands.md).
+
+## Quota Types
+
+| **Type** | **Adjustability** | **Approval** | **Examples** |
+|----------|-------------------|--------------|--------------|
+| **Adjustable** | Can increase via Portal/CLI/API | Usually auto-approved | VM vCPUs, Public IPs, Storage accounts |
+| **Non-adjustable** | Fixed limits | Cannot be changed | Subscription-wide hard limits |
+
+**Important:** Requesting quota increases is **free**. You only pay for resources you actually use, not for quota allocation.
+
+## Understanding Resource Name Mapping
+
+**⚠️ CRITICAL:** There is **NO 1:1 mapping** between ARM resource types and quota resource names.
+
+### Example Mappings
+
+| ARM Resource Type | Quota Resource Name |
+|-------------------|---------------------|
+| `Microsoft.App/managedEnvironments` | `ManagedEnvironmentCount` |
+| `Microsoft.Compute/virtualMachines` | `standardDSv3Family`, `cores`, `virtualMachines` |
+| `Microsoft.Network/publicIPAddresses` | `PublicIPAddresses`, `IPv4StandardSkuPublicIpAddresses` |
+
+### Discovery Workflow
+
+**Never assume the quota resource name from the ARM type.** Always use this workflow:
+
+1. **List all quotas** for the resource provider:
+   ```bash
+   az quota list --scope /subscriptions/<id>/providers/<ProviderNamespace>/locations/<region>
+   ```
+
+2. **Match by `localizedValue`** (human-readable description) to find the relevant quota
+
+3. **Use the `name` field** (not ARM resource type) in subsequent commands:
+   ```bash
+   az quota show --resource-name ManagedEnvironmentCount --scope ...
+   az quota usage show --resource-name ManagedEnvironmentCount --scope ...
+   ```
+
+> **📖 Detailed mapping examples and workflow:** See [commands.md - Resource Name Mapping](./references/commands.md#resource-name-mapping)
+
+## Scripts
+
+Pre-built scripts handle quota extension installation, usage queries, and capacity calculation. Use these instead of constructing commands manually. A single call returns limits, usage, and available capacity.
+
+| Script | Purpose | Usage |
+|--------|---------|-------|
+| `scripts/check-quota.ps1` | Returns limit, usage, and available capacity for all quotas (or a single quota when resource name is provided) | Primary script for quota checks |
+| `scripts/check-quota.sh` | Same as above (bash) | Primary script for quota checks |
+
+## Core Workflows
+
+### Workflow 1: Check Quota for a Specific Resource
+
+**Scenario:** Verify quota limits and current usage before deployment
+
+Run the script with the resource provider and region. It returns a table of **all** quotas with their limit, current usage, and available capacity in a single call:
+
+```powershell
+.\scripts\check-quota.ps1 -ResourceProvider <provider> -Region <region>
+```
+```bash
+./scripts/check-quota.sh <provider> <region>
+```
+
+To check a single resource, add the resource name:
+
+```powershell
+.\scripts\check-quota.ps1 -ResourceProvider <provider> -Region <region> -ResourceName <resource-name>
+```
+```bash
+./scripts/check-quota.sh <provider> <region> <resource-name>
+```
+
+**Example:**
+
+```powershell
+.\scripts\check-quota.ps1 -ResourceProvider Microsoft.Compute -Region eastus
+```
+
+**Example Output:**
+
+| Resource | Region | Limit | Usage | Available |
+|----------|--------|-------|-------|-----------|
+| cores | eastus | 100 | 50 | 50 |
+| standardDSv3Family | eastus | 350 | 50 | 300 |
+| virtualMachines | eastus | 25000 | 5 | 24995 |
+| ... | ... | ... | ... | ... |
+
+> **📖 See also:** [az quota show](./references/commands.md#az-quota-show), [az quota usage show](./references/commands.md#az-quota-usage-show)
+
+### Workflow 2: Compare Quotas Across Regions
+
+**Scenario:** Find the best region for deployment based on available capacity
+
+```bash
+# Define candidate regions
+REGIONS=("eastus" "eastus2" "westus2" "centralus")
+VM_FAMILY="standardDSv3Family"
+SUBSCRIPTION_ID="<subscription-id>"
+
+# Check quota availability across regions
+for region in "${REGIONS[@]}"; do
+  echo "=== Checking $region ==="
+  
+  # Get limit
+  LIMIT=$(az quota show \
+    --resource-name $VM_FAMILY \
+    --scope "/subscriptions/$SUBSCRIPTION_ID/providers/Microsoft.Compute/locations/$region" \
+    --query "properties.limit.value" -o tsv)
+  
+  # Get current usage
+  USAGE=$(az quota usage show \
+    --resource-name $VM_FAMILY \
+    --scope "/subscriptions/$SUBSCRIPTION_ID/providers/Microsoft.Compute/locations/$region" \
+    --query "properties.usages.value" -o tsv)
+  
+  # Calculate available
+  AVAILABLE=$((LIMIT - USAGE))
+  
+  echo "Region: $region | Limit: $LIMIT | Usage: $USAGE | Available: $AVAILABLE"
+done
+```
+
+> **📖 See also:** [commands.md](./references/commands.md#az-quota-show) for full scripted multi-region loop patterns
+
+### Workflow 3: Request Quota Increase
+
+**Scenario:** Current quota is insufficient for deployment
+
+```bash
+# Request increase for VM quota
+az quota update \
+  --resource-name standardDSv3Family \
+  --scope /subscriptions/<subscription-id>/providers/Microsoft.Compute/locations/eastus \
+  --limit-object value=500 \
+  --resource-type dedicated
+
+# Check request status
+az quota request status list \
+  --scope /subscriptions/<subscription-id>/providers/Microsoft.Compute/locations/eastus
+```
+
+**Approval Process:**
+- Most adjustable quotas are auto-approved within minutes
+- Some requests require manual review (hours to days)
+- Non-adjustable quotas require Azure Support ticket
+
+> **📖 See also:** [az quota update](./references/commands.md#az-quota-update), [az quota request status](./references/advanced-commands.md#az-quota-request-status-list)
+
+### Workflow 4: List All Quotas for Planning
+
+**Scenario:** Understand all quotas for a resource provider in a region
+
+```bash
+# List all compute quotas in East US (table format)
+az quota list \
+  --scope /subscriptions/<subscription-id>/providers/Microsoft.Compute/locations/eastus \
+  --output table
+
+# List all network quotas
+az quota list \
+  --scope /subscriptions/<subscription-id>/providers/Microsoft.Network/locations/eastus \
+  --output table
+
+# List all Container Apps quotas
+az quota list \
+  --scope /subscriptions/<subscription-id>/providers/Microsoft.App/locations/eastus \
+  --output table
+```
+
+> **📖 See also:** [az quota list](./references/commands.md#az-quota-list)
+
+## Troubleshooting
+
+### Common Errors
+
+| **Error** | **Cause** | **Solution** |
+|-----------|-----------|--------------|
+| REST API "No Limit" | Misleading — not unlimited | Use CLI instead; see warning in Quick Reference |
+| `ExtensionNotFound` | Quota extension not installed | `az extension add --name quota` |
+| `BadRequest` | Resource provider not supported by quota API | Check [service limits docs](https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits) |
+| `MissingRegistration` | Microsoft.Quota provider not registered | `az provider register --namespace Microsoft.Quota` |
+| `QuotaExceeded` | Deployment would exceed quota | Request increase or choose different region |
+| `InvalidScope` | Incorrect scope format | Use pattern: `/subscriptions/<id>/providers/<namespace>/locations/<region>` |
+| CLI commands fail entirely | Auth, extension, or environment issue | Verify Azure CLI login (`az account show`), reinstall quota extension, check network. Do NOT use the `azure-quota` MCP server — it is unreliable. |
+
+### Unsupported Resource Providers
+
+**Known unsupported providers:**
+- ❌ Microsoft.DocumentDB (Cosmos DB) - Use Portal or [Cosmos DB limits docs](https://learn.microsoft.com/en-us/azure/cosmos-db/concepts-limits)
+
+**Confirmed working providers:**
+- ✅ Microsoft.Compute (VMs, disks, cores)
+- ✅ Microsoft.Network (VNets, IPs, load balancers)
+- ✅ Microsoft.App (Container Apps)
+- ✅ Microsoft.Storage (storage accounts)
+- ✅ Microsoft.MachineLearningServices (ML compute)
+
+> **📖 See also:** [Troubleshooting Guide](./references/commands.md#troubleshooting)
+
+## Additional Resources
+
+| Resource | Link |
+|----------|------|
+| **CLI Commands Reference** | [commands.md](./references/commands.md) - Complete syntax, parameters, examples |
+| **Azure Quotas Overview** | [Microsoft Learn](https://learn.microsoft.com/en-us/azure/quotas/quotas-overview) |
+| **Service Limits Documentation** | [Azure subscription limits](https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits) |
+| **Azure Portal - My Quotas** | [Portal Link](https://portal.azure.com/#blade/Microsoft_Azure_Capacity/QuotaMenuBlade/myQuotas) |
+| **Request Quota Increases** | [How to request increases](https://learn.microsoft.com/en-us/azure/quotas/quickstart-increase-quota-portal) |
+
+## Best Practices
+
+1. ✅ **Always check quotas before deployment** - Prevent quota exceeded errors
+2. ✅ **Run `az quota list` first** - Discover correct quota resource names
+3. ✅ **Compare regions** - Find regions with available capacity
+4. ✅ **Account for growth** - Request 20% buffer above immediate needs
+5. ✅ **Use table output for overview** - `--output table` for quick scanning
+6. ✅ **Monitor usage trends** - Set up alerts at 80% threshold (via Portal)

package/skills/azure-rbac/SKILL.md

@@ -0,0 +1,17 @@
+---
+name: azure-rbac
+description: "Helps users find the right Azure RBAC role for an identity with least privilege access, then generate CLI commands and Bicep code to assign it. Also provides guidance on permissions required to grant roles. WHEN: bicep for role assignment, what role should I assign, least privilege role, RBAC role for, role to read blobs, role for managed identity, custom role definition, assign role to identity, what role do I need to grant access, permissions to assign roles."
+license: MIT
+metadata:
+  author: Microsoft
+  version: "1.1.1"
+---
+Use the 'azure__documentation' tool to find the minimal role definition that matches the desired permissions the user wants to assign to an identity. If no built-in role matches the desired permissions, use the 'azure__extension_cli_generate' tool to create a custom role definition with the desired permissions. Then use the 'azure__extension_cli_generate' tool to generate the CLI commands needed to assign that role to the identity. Finally, use the 'azure__bicepschema' and 'azure__get_azure_bestpractices' tools to provide a Bicep code snippet for adding the role assignment. If user is asking about role necessary to set access, refer to Prerequisites for Granting Roles down below:
+
+## Prerequisites for Granting Roles
+
+To assign RBAC roles to identities, you need a role that includes the `Microsoft.Authorization/roleAssignments/write` permission. The most common roles with this permission are:
+
+- **User Access Administrator** (least privilege - recommended for role assignment only)
+- **Owner** (full access including role assignment)
+- **Custom Role** with `Microsoft.Authorization/roleAssignments/write`