Feature: Cloud Infrastructure Resources
  As a CleverAgents user
  I want to define cloud infrastructure resources (aws, gcp, azure)
  So that I can register and validate cloud provider configurations

  # ── AWS resource type ─────────────────────────────────────

  Scenario: AWS account resource type definition is valid
    Given a cloud resource type definition for "aws-account"
    Then the cloud type name should be "aws-account"
    And the cloud type sandbox_strategy should be "none"
    And the cloud type resource_kind should be "physical"
    And the cloud type should be built_in

  Scenario: AWS account resource type has correct CLI args
    Given a cloud resource type definition for "aws-account"
    Then the cloud type should have 5 cli_args
    And the cloud type cli_args should include "access-key-id"
    And the cloud type cli_args should include "secret-access-key"
    And the cloud type cli_args should include "session-token"
    And the cloud type cli_args should include "region"
    And the cloud type cli_args should include "profile"

  Scenario: AWS account type inherits from cloud-account
    Given a cloud resource type definition for "aws-account"
    Then the cloud type should inherit from "cloud-account"

  Scenario: AWS credential resolution from env vars
    Given AWS environment variables are set
    When I resolve credentials for provider "aws"
    Then the resolved credential "access-key-id" should not be None
    And the resolved credential "secret-access-key" should not be None
    And the resolved credential "region" should not be None

  Scenario: AWS credential validation passes with env vars
    Given AWS environment variables are set
    When I resolve credentials for provider "aws"
    And I validate credentials for provider "aws"
    Then there should be no cloud validation errors

  Scenario: AWS credential validation fails without credentials
    Given no cloud environment variables are set
    When I resolve credentials for provider "aws"
    And I validate credentials for provider "aws"
    Then there should be cloud validation errors
    And the cloud validation errors should mention "access-key-id"
    And the cloud validation errors should mention "secret-access-key"

  Scenario: AWS profile name satisfies credential requirements
    Given AWS profile environment variable is set to "my-profile"
    When I resolve credentials for provider "aws"
    And I validate credentials for provider "aws"
    Then there should be no cloud validation errors

  # ── GCP resource type ─────────────────────────────────────

  Scenario: GCP resource type definition is valid
    Given a cloud resource type definition for "gcp"
    Then the cloud type name should be "gcp"
    And the cloud type sandbox_strategy should be "none"
    And the cloud type resource_kind should be "physical"
    And the cloud type should be built_in

  Scenario: GCP resource type has correct CLI args
    Given a cloud resource type definition for "gcp"
    Then the cloud type should have 3 cli_args
    And the cloud type cli_args should include "service-account-json-path"
    And the cloud type cli_args should include "project-id"
    And the cloud type cli_args should include "region"

  Scenario: GCP credential resolution from env vars
    Given GCP environment variables are set
    When I resolve credentials for provider "gcp"
    Then the resolved credential "service-account-json-path" should not be None
    And the resolved credential "project-id" should not be None

  Scenario: GCP credential validation passes with env vars
    Given GCP environment variables are set
    When I resolve credentials for provider "gcp"
    And I validate credentials for provider "gcp"
    Then there should be no cloud validation errors

  Scenario: GCP credential validation fails without credentials
    Given no cloud environment variables are set
    When I resolve credentials for provider "gcp"
    And I validate credentials for provider "gcp"
    Then there should be cloud validation errors
    And the cloud validation errors should mention "service-account-json-path"
    And the cloud validation errors should mention "project-id"

  # ── Azure resource type ───────────────────────────────────

  Scenario: Azure resource type definition is valid
    Given a cloud resource type definition for "azure"
    Then the cloud type name should be "azure"
    And the cloud type sandbox_strategy should be "none"
    And the cloud type resource_kind should be "physical"
    And the cloud type should be built_in

  Scenario: Azure resource type has correct CLI args
    Given a cloud resource type definition for "azure"
    Then the cloud type should have 5 cli_args
    And the cloud type cli_args should include "subscription-id"
    And the cloud type cli_args should include "tenant-id"
    And the cloud type cli_args should include "client-id"
    And the cloud type cli_args should include "client-secret"
    And the cloud type cli_args should include "region"

  Scenario: Azure credential resolution from env vars
    Given Azure environment variables are set
    When I resolve credentials for provider "azure"
    Then the resolved credential "subscription-id" should not be None
    And the resolved credential "tenant-id" should not be None
    And the resolved credential "client-id" should not be None
    And the resolved credential "client-secret" should not be None

  Scenario: Azure credential validation passes with env vars
    Given Azure environment variables are set
    When I resolve credentials for provider "azure"
    And I validate credentials for provider "azure"
    Then there should be no cloud validation errors

  Scenario: Azure credential validation fails without credentials
    Given no cloud environment variables are set
    When I resolve credentials for provider "azure"
    And I validate credentials for provider "azure"
    Then there should be cloud validation errors
    And the cloud validation errors should mention "subscription-id"
    And the cloud validation errors should mention "tenant-id"
    And the cloud validation errors should mention "client-id"
    And the cloud validation errors should mention "client-secret"

  # ── Cloud hierarchy types ────────────────────────────────

  Scenario: Generic cloud-account base type exists
    Given a cloud resource type definition for "cloud-account"
    Then the cloud type name should be "cloud-account"
    And the cloud type should be built_in
    And the cloud type should not be user_addable

  Scenario: AWS VPC inherits from cloud-network
    Given a cloud resource type definition for "aws-vpc"
    Then the cloud type should inherit from "cloud-network"
    And the cloud type should not be user_addable

  Scenario: AWS S3 bucket inherits from cloud-object-store
    Given a cloud resource type definition for "aws-s3-bucket"
    Then the cloud type should inherit from "cloud-object-store"
    And the cloud type should not be user_addable

  Scenario: AWS ECS cluster inherits from cloud-container-cluster
    Given a cloud resource type definition for "aws-ecs-cluster"
    Then the cloud type should inherit from "cloud-container-cluster"

  Scenario: GCP type inherits from cloud-account
    Given a cloud resource type definition for "gcp"
    Then the cloud type should inherit from "cloud-account"

  Scenario: Azure type inherits from cloud-account
    Given a cloud resource type definition for "azure"
    Then the cloud type should inherit from "cloud-account"

  # ── Credential masking ────────────────────────────────────

  Scenario: Credential values are masked in error messages
    Given no cloud environment variables are set
    When I resolve credentials for provider "aws"
    And I validate credentials for provider "aws"
    Then the cloud validation errors should not contain secrets

  # ── Stub execution ────────────────────────────────────────

  Scenario: Cloud handler resolve raises NotImplementedError for AWS
    Given a valid AWS cloud resource
    When I call resolve on the cloud handler
    Then a cloud NotImplementedError should be raised
    And the cloud error message should mention "aws"

  Scenario: Cloud handler resolve raises NotImplementedError for GCP
    Given a valid GCP cloud resource
    When I call resolve on the cloud handler
    Then a cloud NotImplementedError should be raised
    And the cloud error message should mention "gcp"

  Scenario: Cloud handler resolve raises NotImplementedError for Azure
    Given a valid Azure cloud resource
    When I call resolve on the cloud handler
    Then a cloud NotImplementedError should be raised
    And the cloud error message should mention "azure"

  # ── Missing credential error ──────────────────────────────

  Scenario: Cloud handler raises ValueError for missing AWS credentials
    Given an AWS cloud resource without credentials
    When I call resolve on the cloud handler
    Then a cloud ValueError should be raised
    And the cloud error message should mention "access-key-id"

  Scenario: Cloud handler raises ValueError for missing GCP credentials
    Given a GCP cloud resource without credentials
    When I call resolve on the cloud handler
    Then a cloud ValueError should be raised
    And the cloud error message should mention "service-account-json-path"

  Scenario: Cloud handler raises ValueError for missing Azure credentials
    Given an Azure cloud resource without credentials
    When I call resolve on the cloud handler
    Then a cloud ValueError should be raised
    And the cloud error message should mention "subscription-id"

  # ── Cloud sandbox strategy stubs ──────────────────────────

  Scenario: Cloud sandbox create raises NotImplementedError
    Given a cloud sandbox strategy for "aws"
    When I call create on the sandbox strategy
    Then a cloud NotImplementedError should be raised

  Scenario: Cloud sandbox commit raises NotImplementedError
    Given a cloud sandbox strategy for "gcp"
    When I call commit on the sandbox strategy
    Then a cloud NotImplementedError should be raised

  Scenario: Cloud sandbox rollback raises NotImplementedError
    Given a cloud sandbox strategy for "azure"
    When I call rollback on the sandbox strategy
    Then a cloud NotImplementedError should be raised

  Scenario: Cloud sandbox validate returns no errors with valid config
    Given a cloud sandbox strategy for "aws"
    And AWS environment variables are set
    When I validate the cloud sandbox strategy
    Then there should be no cloud validation errors

  # ── Unknown provider ──────────────────────────────────────

  Scenario: Unknown provider raises ValueError
    When I try to resolve credentials for provider "alibaba"
    Then a cloud ValueError should be raised
    And the cloud error message should mention "alibaba"

  # ── Handler protocol conformance ──────────────────────────

  Scenario: CloudResourceHandler satisfies ResourceHandler protocol
    Given a CloudResourceHandler instance
    Then the cloud handler should satisfy the ResourceHandler protocol