@flui-cloud/cli 0.0.1 → 0.1.0

package/oclif.manifest.json

@@ -115,6 +115,39 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "cert-challenge": {
+          "description": "ACME challenge for the app endpoint (kind:CatalogApp). http-01 works without a DNS zone and forces a per-host cert; dns-01 needs a cluster DNS zone with a wildcard issuer. Default: derived from cluster config.",
+          "name": "cert-challenge",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "http-01",
+            "dns-01"
+          ],
+          "type": "option"
+        },
+        "cert-provider": {
+          "description": "Certificate issuer for the app endpoint (kind:CatalogApp). Default: cluster default.",
+          "name": "cert-provider",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "lets-encrypt",
+            "lets-encrypt-staging"
+          ],
+          "type": "option"
+        },
+        "hostname": {
+          "description": "How the app is exposed (kind:CatalogApp): ip (nip.io) or domain (cluster DNS zone). Default: derived from manifest/cluster.",
+          "name": "hostname",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "ip",
+            "domain"
+          ],
+          "type": "option"
+        },
         "no-wait": {
           "description": "Alias for --detach (kind:CatalogApp compat)",
           "name": "no-wait",
@@ -266,6 +299,46 @@
         "update.js"
       ]
     },
+    "version": {
+      "aliases": [],
+      "args": {},
+      "description": "Show the CLI version and the platform release it pins (component image tags + bootstrap ref). Useful for debugging an install.",
+      "examples": [
+        "<%= config.bin %> <%= command.id %>",
+        "<%= config.bin %> <%= command.id %> --latest",
+        "<%= config.bin %> <%= command.id %> --json"
+      ],
+      "flags": {
+        "latest": {
+          "description": "Show what `env create --latest` would resolve to (mobile tags: bootstrap master, :latest images) instead of the pinned release",
+          "name": "latest",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "json": {
+          "description": "Output as JSON",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "version",
+      "pluginAlias": "@flui-cloud/cli",
+      "pluginName": "@flui-cloud/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": false,
+      "relativePath": [
+        "lib",
+        "cli",
+        "src",
+        "commands",
+        "version.js"
+      ]
+    },
     "app:build": {
       "aliases": [],
       "args": {
@@ -650,6 +723,7 @@
       "description": "List all applications in the cluster",
       "examples": [
         "<%= config.bin %> <%= command.id %>",
+        "<%= config.bin %> <%= command.id %> --expanded",
         "<%= config.bin %> <%= command.id %> --output json"
       ],
       "flags": {
@@ -661,6 +735,13 @@
           "multiple": false,
           "type": "option"
         },
+        "expanded": {
+          "char": "x",
+          "description": "Show the individual components of composed apps",
+          "name": "expanded",
+          "allowNo": false,
+          "type": "boolean"
+        },
         "output": {
           "char": "o",
           "description": "Output format",
@@ -1455,7 +1536,7 @@
           "required": true
         }
       },
-      "description": "Permanently destroy a workload cluster and all its nodes. For the observability cluster use `flui env destroy`.",
+      "description": "Permanently destroy a workload cluster and all its nodes. For the control cluster use `flui env destroy`.",
       "examples": [
         "<%= config.bin %> <%= command.id %> my-workload-cluster",
         "<%= config.bin %> <%= command.id %> my-workload-cluster --force",
@@ -1856,7 +1937,7 @@
       "examples": [
         "<%= config.bin %> <%= command.id %>",
         "<%= config.bin %> <%= command.id %> --dry-run",
-        "<%= config.bin %> <%= command.id %> --api-path ../flui.api"
+        "<%= config.bin %> <%= command.id %> --api-path ../flui-core"
       ],
       "flags": {
         "dry-run": {
@@ -1872,7 +1953,7 @@
           "type": "boolean"
         },
         "api-path": {
-          "description": "Override resolved value for the \"apiPath\" preference (Path to the flui.api repo, used to locate the .env file written by env export-config)",
+          "description": "Override resolved value for the \"apiPath\" preference (Path to the flui-core repo, used to locate the .env file written by env export-config)",
           "name": "api-path",
           "hasDynamicHelp": false,
           "multiple": false,
@@ -1906,7 +1987,7 @@
     "dev:tunnel": {
       "aliases": [],
       "args": {},
-      "description": "Open SSH tunnels from localhost to the observability cluster services.\nOn the remote side runs kubectl port-forward against the in-cluster Services,\nso no NodePort or kube-API exposure is required. Stay in foreground; CTRL-C to close.",
+      "description": "Open SSH tunnels from localhost to the control cluster services.\nOn the remote side runs kubectl port-forward against the in-cluster Services,\nso no NodePort or kube-API exposure is required. Stay in foreground; CTRL-C to close.",
       "examples": [
         "<%= config.bin %> <%= command.id %>",
         "<%= config.bin %> <%= command.id %> --ports postgres,redis",
@@ -2003,155 +2084,6 @@
         "cleanup.js"
       ]
     },
-    "node:add": {
-      "aliases": [],
-      "args": {},
-      "description": "Add worker node(s) to the cluster. Provisions new servers and joins them to K3s.",
-      "examples": [
-        "<%= config.bin %> <%= command.id %>",
-        "<%= config.bin %> <%= command.id %> --count 2",
-        "<%= config.bin %> <%= command.id %> --count 3 --no-wait"
-      ],
-      "flags": {
-        "cluster": {
-          "char": "c",
-          "description": "Cluster name or ID (default: auto-detect when only one cluster exists)",
-          "name": "cluster",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "count": {
-          "char": "n",
-          "description": "Number of workers to add (1-5)",
-          "name": "count",
-          "default": 1,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "no-wait": {
-          "description": "Return immediately after queuing the operation",
-          "name": "no-wait",
-          "allowNo": false,
-          "type": "boolean"
-        }
-      },
-      "hasDynamicHelp": false,
-      "hiddenAliases": [],
-      "id": "node:add",
-      "pluginAlias": "@flui-cloud/cli",
-      "pluginName": "@flui-cloud/cli",
-      "pluginType": "core",
-      "strict": true,
-      "enableJsonFlag": false,
-      "isESM": false,
-      "relativePath": [
-        "lib",
-        "cli",
-        "src",
-        "commands",
-        "node",
-        "add.js"
-      ]
-    },
-    "node:list": {
-      "aliases": [],
-      "args": {},
-      "description": "List all nodes in the cluster (master + workers)",
-      "examples": [
-        "<%= config.bin %> <%= command.id %>",
-        "<%= config.bin %> <%= command.id %> --output json"
-      ],
-      "flags": {
-        "cluster": {
-          "char": "c",
-          "description": "Cluster name or ID (default: auto-detect when only one cluster exists)",
-          "name": "cluster",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "output": {
-          "char": "o",
-          "description": "Output format",
-          "name": "output",
-          "default": "table",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "options": [
-            "table",
-            "json"
-          ],
-          "type": "option"
-        }
-      },
-      "hasDynamicHelp": false,
-      "hiddenAliases": [],
-      "id": "node:list",
-      "pluginAlias": "@flui-cloud/cli",
-      "pluginName": "@flui-cloud/cli",
-      "pluginType": "core",
-      "strict": true,
-      "enableJsonFlag": false,
-      "isESM": false,
-      "relativePath": [
-        "lib",
-        "cli",
-        "src",
-        "commands",
-        "node",
-        "list.js"
-      ]
-    },
-    "node:remove": {
-      "aliases": [],
-      "args": {
-        "nodeId": {
-          "description": "Node ID to remove (from `flui node list`)",
-          "name": "nodeId",
-          "required": true
-        }
-      },
-      "description": "Cordon, drain and remove a worker node from the cluster. Cannot remove the master.",
-      "examples": [
-        "<%= config.bin %> <%= command.id %> <node-id>",
-        "<%= config.bin %> <%= command.id %> <node-id> --no-wait"
-      ],
-      "flags": {
-        "cluster": {
-          "char": "c",
-          "description": "Cluster name or ID (default: auto-detect when only one cluster exists)",
-          "name": "cluster",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "no-wait": {
-          "description": "Return immediately after queuing the operation",
-          "name": "no-wait",
-          "allowNo": false,
-          "type": "boolean"
-        }
-      },
-      "hasDynamicHelp": false,
-      "hiddenAliases": [],
-      "id": "node:remove",
-      "pluginAlias": "@flui-cloud/cli",
-      "pluginName": "@flui-cloud/cli",
-      "pluginType": "core",
-      "strict": true,
-      "enableJsonFlag": false,
-      "isESM": false,
-      "relativePath": [
-        "lib",
-        "cli",
-        "src",
-        "commands",
-        "node",
-        "remove.js"
-      ]
-    },
     "integration:connect": {
       "aliases": [],
       "args": {
@@ -2288,6 +2220,49 @@
         "remove-installation.js"
       ]
     },
+    "integration:reset": {
+      "aliases": [],
+      "args": {
+        "provider": {
+          "description": "Integration provider (currently only `github`)",
+          "name": "provider",
+          "options": [
+            "github"
+          ],
+          "required": true
+        }
+      },
+      "description": "Remove the instance-wide GitHub integration (admin). Clears the stored config plus all per-user tokens and App installations. Users will need to reconnect afterwards.",
+      "examples": [
+        "<%= config.bin %> <%= command.id %> github",
+        "<%= config.bin %> <%= command.id %> github --yes"
+      ],
+      "flags": {
+        "yes": {
+          "description": "Skip the typed confirmation (for scripts / CI)",
+          "name": "yes",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "integration:reset",
+      "pluginAlias": "@flui-cloud/cli",
+      "pluginName": "@flui-cloud/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": false,
+      "relativePath": [
+        "lib",
+        "cli",
+        "src",
+        "commands",
+        "integration",
+        "reset.js"
+      ]
+    },
     "integration:setup-github-app": {
       "aliases": [],
       "args": {},
@@ -2330,14 +2305,92 @@
         "setup-github-app.js"
       ]
     },
-    "env:capacity": {
+    "integration:setup": {
       "aliases": [],
-      "args": {},
-      "description": "Show master node capacity (allocatable/used/free) and a sorted list of server-type upgrade/downgrade candidates with monthly cost delta. Use this to plan `flui env scale-master` for apps that need dedicated placement on the master (e.g. databases).",
+      "args": {
+        "provider": {
+          "description": "Integration provider (currently only `github`)",
+          "name": "provider",
+          "options": [
+            "github"
+          ],
+          "required": true
+        }
+      },
+      "description": "Guided GitHub integration setup (admin). Pick GitHub App (recommended, creates the App on GitHub via manifest flow) or Personal Access Token (validates and saves a token).",
       "examples": [
-        "<%= config.bin %> <%= command.id %>",
-        "<%= config.bin %> <%= command.id %> --top 5",
-        "<%= config.bin %> <%= command.id %> --direction upgrade"
+        "<%= config.bin %> <%= command.id %> github",
+        "<%= config.bin %> <%= command.id %> github --headless"
+      ],
+      "flags": {
+        "headless": {
+          "description": "Print URLs instead of opening a browser",
+          "name": "headless",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "integration:setup",
+      "pluginAlias": "@flui-cloud/cli",
+      "pluginName": "@flui-cloud/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": false,
+      "relativePath": [
+        "lib",
+        "cli",
+        "src",
+        "commands",
+        "integration",
+        "setup.js"
+      ]
+    },
+    "integration:status": {
+      "aliases": [],
+      "args": {
+        "provider": {
+          "description": "Integration provider (currently only `github`)",
+          "name": "provider",
+          "options": [
+            "github"
+          ],
+          "required": true
+        }
+      },
+      "description": "Show the current GitHub integration status: configured mode, live health check, and (in PAT mode) your own connection state.",
+      "examples": [
+        "<%= config.bin %> <%= command.id %> github"
+      ],
+      "flags": {},
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "integration:status",
+      "pluginAlias": "@flui-cloud/cli",
+      "pluginName": "@flui-cloud/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": false,
+      "relativePath": [
+        "lib",
+        "cli",
+        "src",
+        "commands",
+        "integration",
+        "status.js"
+      ]
+    },
+    "env:capacity": {
+      "aliases": [],
+      "args": {},
+      "description": "Show master node capacity (allocatable/used/free) and a sorted list of server-type upgrade/downgrade candidates with monthly cost delta. Use this to plan `flui env scale-master` for apps that need dedicated placement on the master (e.g. databases).",
+      "examples": [
+        "<%= config.bin %> <%= command.id %>",
+        "<%= config.bin %> <%= command.id %> --top 5",
+        "<%= config.bin %> <%= command.id %> --direction upgrade"
       ],
       "flags": {
         "top": {
@@ -2383,7 +2436,7 @@
     "env:create": {
       "aliases": [],
       "args": {},
-      "description": "Create observability cluster infrastructure on K3s",
+      "description": "Create control cluster infrastructure on K3s",
       "examples": [
         "<%= config.bin %> <%= command.id %>",
         "<%= config.bin %> <%= command.id %> --node-size cx32",
@@ -2394,9 +2447,8 @@
       "flags": {
         "provider": {
           "char": "p",
-          "description": "Cloud provider for the observability cluster",
+          "description": "Cloud provider for the control cluster (default: the profile's configured provider)",
           "name": "provider",
-          "default": "hetzner",
           "hasDynamicHelp": false,
           "multiple": false,
           "options": [
@@ -2451,7 +2503,7 @@
         "configure-firewall": {
           "description": "Automatically configure firewall after cluster creation",
           "name": "configure-firewall",
-          "allowNo": false,
+          "allowNo": true,
           "type": "boolean"
         },
         "firewall-ip": {
@@ -2475,6 +2527,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "latest": {
+          "description": "Install mobile dev tags instead of the pinned release: bootstrap scripts from `master` and `:latest` Docker images. Default: every component is pinned to the CLI release version.",
+          "name": "latest",
+          "allowNo": false,
+          "type": "boolean"
+        },
         "no-shared-storage": {
           "description": "Disable Flui shared storage (NFS+fscache). Default: shared storage enabled — master gets a Volume hosting the NFS export, workers mount it. Disable to fall back to local-path on each node bundled disk.",
           "name": "no-shared-storage",
@@ -2511,7 +2569,7 @@
     "env:credentials": {
       "aliases": [],
       "args": {},
-      "description": "Display observability cluster connection information.\nSecrets are hidden by default; pass --show-secrets to print them. To populate\na local .env.local for development use `flui dev creds` instead.",
+      "description": "Display control cluster connection information.\nSecrets are hidden by default; pass --show-secrets to print them. To populate\na local .env.local for development use `flui dev creds` instead.",
       "examples": [
         "<%= config.bin %> <%= command.id %>",
         "<%= config.bin %> <%= command.id %> --format json",
@@ -2571,7 +2629,7 @@
     "env:destroy": {
       "aliases": [],
       "args": {},
-      "description": "Permanently delete observability cluster (WARNING: All data will be lost!)",
+      "description": "Permanently delete control cluster (WARNING: All data will be lost!)",
       "examples": [
         "<%= config.bin %> <%= command.id %>",
         "<%= config.bin %> <%= command.id %> --force"
@@ -2664,14 +2722,14 @@
           "type": "boolean"
         },
         "api-path": {
-          "description": "Override resolved value for the \"apiPath\" preference (Path to the flui.api repo, used to locate the .env file written by env export-config)",
+          "description": "Override resolved value for the \"apiPath\" preference (Path to the flui-core repo, used to locate the .env file written by env export-config)",
           "name": "api-path",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
         "dashboard-path": {
-          "description": "Override resolved value for the \"dashboardPath\" preference (Path to the flui.dashboard repo, used when syncing its config.json)",
+          "description": "Override resolved value for the \"dashboardPath\" preference (Path to the flui-dashboard repo, used when syncing its config.json)",
           "name": "dashboard-path",
           "hasDynamicHelp": false,
           "multiple": false,
@@ -2724,7 +2782,7 @@
     "env:force-ready": {
       "aliases": [],
       "args": {},
-      "description": "Force observability cluster status to READY (use when cluster is working but stuck in ERROR or CREATING state)",
+      "description": "Force control cluster status to READY (use when cluster is working but stuck in ERROR or CREATING state)",
       "examples": [
         "<%= config.bin %> <%= command.id %>",
         "<%= config.bin %> <%= command.id %> --force",
@@ -3036,10 +3094,44 @@
         "repair-ssh-ca.js"
       ]
     },
+    "env:repair-storage": {
+      "aliases": [],
+      "args": {},
+      "description": "Backfill the shared-storage volume id into the cluster DB. Repairs clusters whose flui-secrets/DB never received FLUI_SHARED_STORAGE_VOLUME_ID at create — symptom is sharedStorageVolumeId NULL in the DB and \"no Flui-managed shared storage volume\" on storage expand. Reads the volume id from the active profile, patches flui-secrets over SSH, then restarts flui-api so the bootstrap seeder backfills the DB.",
+      "examples": [
+        "<%= config.bin %> <%= command.id %>",
+        "<%= config.bin %> <%= command.id %> --no-restart"
+      ],
+      "flags": {
+        "no-restart": {
+          "description": "Skip the flui-api rolling restart after patching the Secret",
+          "name": "no-restart",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "env:repair-storage",
+      "pluginAlias": "@flui-cloud/cli",
+      "pluginName": "@flui-cloud/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": false,
+      "relativePath": [
+        "lib",
+        "cli",
+        "src",
+        "commands",
+        "env",
+        "repair-storage.js"
+      ]
+    },
     "env:restart": {
       "aliases": [],
       "args": {},
-      "description": "Restart stopped observability cluster servers",
+      "description": "Restart stopped control cluster servers",
       "examples": [
         "<%= config.bin %> <%= command.id %>"
       ],
@@ -3164,10 +3256,49 @@
         "scale-node.js"
       ]
     },
+    "env:set-master-protection": {
+      "aliases": [],
+      "args": {
+        "action": {
+          "description": "on | off | show",
+          "name": "action",
+          "options": [
+            "on",
+            "off",
+            "show"
+          ],
+          "required": true
+        }
+      },
+      "description": "Taint the control-cluster master so new pods schedule on workers (on), remove it (off), or report current state (show).",
+      "examples": [
+        "<%= config.bin %> <%= command.id %> on",
+        "<%= config.bin %> <%= command.id %> off",
+        "<%= config.bin %> <%= command.id %> show"
+      ],
+      "flags": {},
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "env:set-master-protection",
+      "pluginAlias": "@flui-cloud/cli",
+      "pluginName": "@flui-cloud/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": false,
+      "relativePath": [
+        "lib",
+        "cli",
+        "src",
+        "commands",
+        "env",
+        "set-master-protection.js"
+      ]
+    },
     "env:status": {
       "aliases": [],
       "args": {},
-      "description": "Check observability cluster status",
+      "description": "Check control cluster status",
       "examples": [
         "<%= config.bin %> <%= command.id %>"
       ],
@@ -3193,7 +3324,7 @@
     "env:stop": {
       "aliases": [],
       "args": {},
-      "description": "Shutdown observability cluster servers (saves costs while preserving data)",
+      "description": "Shutdown control cluster servers (saves costs while preserving data)",
       "examples": [
         "<%= config.bin %> <%= command.id %>"
       ],
@@ -3261,7 +3392,7 @@
     "env:storage": {
       "aliases": [],
       "args": {},
-      "description": "Show shared storage status (Volume + NFS export + PVC summary) for the current observability cluster",
+      "description": "Show shared storage status (Volume + NFS export + PVC summary) for the current control cluster",
       "examples": [
         "<%= config.bin %> <%= command.id %>"
       ],
@@ -3360,11 +3491,13 @@
     "env:update-firewall": {
       "aliases": [],
       "args": {},
-      "description": "Create or update firewall IP ranges for observability cluster",
+      "description": "Manage SSH access (port 22) on the control cluster firewall. Updates only the SSH source IPs — every other rule is left untouched. Runs directly against the cloud provider, so it works even when your current IP is locked out.",
       "examples": [
         "<%= config.bin %> <%= command.id %>",
         "<%= config.bin %> <%= command.id %> --ip 203.0.113.42",
-        "<%= config.bin %> <%= command.id %> --ip \"203.0.113.0/24,198.51.100.5/32\""
+        "<%= config.bin %> <%= command.id %> --add --ip 203.0.113.42",
+        "<%= config.bin %> <%= command.id %> --remove --ip 198.51.100.5/32",
+        "<%= config.bin %> <%= command.id %> --list"
       ],
       "flags": {
         "ip": {
@@ -3374,6 +3507,36 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
+        },
+        "add": {
+          "description": "Add the IP(s) to the existing SSH allowlist (keeps current entries)",
+          "exclusive": [
+            "remove",
+            "list"
+          ],
+          "name": "add",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "remove": {
+          "description": "Remove the IP(s) from the SSH allowlist",
+          "exclusive": [
+            "add",
+            "list"
+          ],
+          "name": "remove",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "list": {
+          "description": "Show the current SSH allowlist and exit (no changes)",
+          "exclusive": [
+            "add",
+            "remove"
+          ],
+          "name": "list",
+          "allowNo": false,
+          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
@@ -3394,6 +3557,121 @@
         "update-firewall.js"
       ]
     },
+    "repo:connect": {
+      "aliases": [],
+      "args": {
+        "repo": {
+          "description": "Full repository name `owner/repo`. Omit to pick interactively.",
+          "name": "repo",
+          "required": false
+        }
+      },
+      "description": "Connect (import) a GitHub repository into your Flui account so it can be deployed with `flui deploy`. Pass the full name `owner/repo`, or omit it for an interactive picker over the repositories accessible via your GitHub integration.",
+      "examples": [
+        "<%= config.bin %> <%= command.id %> acme/my-app",
+        "<%= config.bin %> <%= command.id %>"
+      ],
+      "flags": {},
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "repo:connect",
+      "pluginAlias": "@flui-cloud/cli",
+      "pluginName": "@flui-cloud/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": false,
+      "relativePath": [
+        "lib",
+        "cli",
+        "src",
+        "commands",
+        "repo",
+        "connect.js"
+      ]
+    },
+    "repo:disconnect": {
+      "aliases": [],
+      "args": {
+        "repo": {
+          "description": "Full repository name `owner/repo`",
+          "name": "repo",
+          "required": true
+        }
+      },
+      "description": "Disconnect a repository from your Flui account. Requires admin privileges. Does not delete the repository on GitHub.",
+      "examples": [
+        "<%= config.bin %> <%= command.id %> acme/my-app",
+        "<%= config.bin %> <%= command.id %> acme/my-app --yes"
+      ],
+      "flags": {
+        "yes": {
+          "char": "y",
+          "description": "Skip the confirmation prompt",
+          "name": "yes",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "repo:disconnect",
+      "pluginAlias": "@flui-cloud/cli",
+      "pluginName": "@flui-cloud/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": false,
+      "relativePath": [
+        "lib",
+        "cli",
+        "src",
+        "commands",
+        "repo",
+        "disconnect.js"
+      ]
+    },
+    "repo:list": {
+      "aliases": [],
+      "args": {},
+      "description": "List repositories connected to your Flui account.",
+      "examples": [
+        "<%= config.bin %> <%= command.id %>",
+        "<%= config.bin %> <%= command.id %> --output json"
+      ],
+      "flags": {
+        "output": {
+          "char": "o",
+          "description": "Output format",
+          "name": "output",
+          "default": "text",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "text",
+            "json"
+          ],
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "repo:list",
+      "pluginAlias": "@flui-cloud/cli",
+      "pluginName": "@flui-cloud/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": false,
+      "relativePath": [
+        "lib",
+        "cli",
+        "src",
+        "commands",
+        "repo",
+        "list.js"
+      ]
+    },
     "server-types:list": {
       "aliases": [],
       "args": {},
@@ -3401,6 +3679,11 @@
       "examples": [
         "<%= config.bin %> <%= command.id %> --provider hetzner",
         "<%= config.bin %> <%= command.id %> --provider hetzner --region fsn1",
+        "<%= config.bin %> <%= command.id %> --provider scaleway --memory 16",
+        "<%= config.bin %> <%= command.id %> --provider scaleway --memory 8-32",
+        "<%= config.bin %> <%= command.id %> --provider scaleway --memory -32",
+        "<%= config.bin %> <%= command.id %> --provider scaleway --sort memory",
+        "<%= config.bin %> <%= command.id %> --provider scaleway --sort price --desc",
         "<%= config.bin %> <%= command.id %> --provider hetzner --json",
         "<%= config.bin %> <%= command.id %> --provider hetzner --force-refresh"
       ],
@@ -3426,9 +3709,39 @@
           "multiple": false,
           "type": "option"
         },
-        "json": {
-          "description": "Output as JSON",
-          "name": "json",
+        "memory": {
+          "char": "m",
+          "description": "Filter by RAM in GB: exact \"16\", range \"8-32\", min \"8-\", or max \"-32\"",
+          "name": "memory",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "sort": {
+          "char": "s",
+          "description": "Sort by field",
+          "name": "sort",
+          "default": "price",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "price",
+            "memory",
+            "cores",
+            "disk",
+            "name"
+          ],
+          "type": "option"
+        },
+        "desc": {
+          "description": "Sort in descending order",
+          "name": "desc",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "json": {
+          "description": "Output as JSON",
+          "name": "json",
           "allowNo": false,
           "type": "boolean"
         },
@@ -3586,6 +3899,155 @@
         "install.js"
       ]
     },
+    "node:add": {
+      "aliases": [],
+      "args": {},
+      "description": "Add worker node(s) to the cluster. Provisions new servers and joins them to K3s.",
+      "examples": [
+        "<%= config.bin %> <%= command.id %>",
+        "<%= config.bin %> <%= command.id %> --count 2",
+        "<%= config.bin %> <%= command.id %> --count 3 --no-wait"
+      ],
+      "flags": {
+        "cluster": {
+          "char": "c",
+          "description": "Cluster name or ID (default: auto-detect when only one cluster exists)",
+          "name": "cluster",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "count": {
+          "char": "n",
+          "description": "Number of workers to add (1-5)",
+          "name": "count",
+          "default": 1,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "no-wait": {
+          "description": "Return immediately after queuing the operation",
+          "name": "no-wait",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "node:add",
+      "pluginAlias": "@flui-cloud/cli",
+      "pluginName": "@flui-cloud/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": false,
+      "relativePath": [
+        "lib",
+        "cli",
+        "src",
+        "commands",
+        "node",
+        "add.js"
+      ]
+    },
+    "node:list": {
+      "aliases": [],
+      "args": {},
+      "description": "List all nodes in the cluster (master + workers)",
+      "examples": [
+        "<%= config.bin %> <%= command.id %>",
+        "<%= config.bin %> <%= command.id %> --output json"
+      ],
+      "flags": {
+        "cluster": {
+          "char": "c",
+          "description": "Cluster name or ID (default: auto-detect when only one cluster exists)",
+          "name": "cluster",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "output": {
+          "char": "o",
+          "description": "Output format",
+          "name": "output",
+          "default": "table",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "table",
+            "json"
+          ],
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "node:list",
+      "pluginAlias": "@flui-cloud/cli",
+      "pluginName": "@flui-cloud/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": false,
+      "relativePath": [
+        "lib",
+        "cli",
+        "src",
+        "commands",
+        "node",
+        "list.js"
+      ]
+    },
+    "node:remove": {
+      "aliases": [],
+      "args": {
+        "nodeId": {
+          "description": "Node ID to remove (from `flui node list`)",
+          "name": "nodeId",
+          "required": true
+        }
+      },
+      "description": "Cordon, drain and remove a worker node from the cluster. Cannot remove the master.",
+      "examples": [
+        "<%= config.bin %> <%= command.id %> <node-id>",
+        "<%= config.bin %> <%= command.id %> <node-id> --no-wait"
+      ],
+      "flags": {
+        "cluster": {
+          "char": "c",
+          "description": "Cluster name or ID (default: auto-detect when only one cluster exists)",
+          "name": "cluster",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "no-wait": {
+          "description": "Return immediately after queuing the operation",
+          "name": "no-wait",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "node:remove",
+      "pluginAlias": "@flui-cloud/cli",
+      "pluginName": "@flui-cloud/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": false,
+      "relativePath": [
+        "lib",
+        "cli",
+        "src",
+        "commands",
+        "node",
+        "remove.js"
+      ]
+    },
     "template:use": {
       "aliases": [],
       "args": {
@@ -3858,57 +4320,42 @@
         "delete.js"
       ]
     },
-    "repo:connect": {
-      "aliases": [],
-      "args": {
-        "repo": {
-          "description": "Full repository name `owner/repo`. Omit to pick interactively.",
-          "name": "repo",
-          "required": false
-        }
-      },
-      "description": "Connect (import) a GitHub repository into your Flui account so it can be deployed with `flui deploy`. Pass the full name `owner/repo`, or omit it for an interactive picker over the repositories accessible via your GitHub integration.",
-      "examples": [
-        "<%= config.bin %> <%= command.id %> acme/my-app",
-        "<%= config.bin %> <%= command.id %>"
-      ],
-      "flags": {},
-      "hasDynamicHelp": false,
-      "hiddenAliases": [],
-      "id": "repo:connect",
-      "pluginAlias": "@flui-cloud/cli",
-      "pluginName": "@flui-cloud/cli",
-      "pluginType": "core",
-      "strict": true,
-      "enableJsonFlag": false,
-      "isESM": false,
-      "relativePath": [
-        "lib",
-        "cli",
-        "src",
-        "commands",
-        "repo",
-        "connect.js"
-      ]
-    },
-    "repo:disconnect": {
+    "app:image:delete": {
       "aliases": [],
       "args": {
-        "repo": {
-          "description": "Full repository name `owner/repo`",
-          "name": "repo",
+        "name": {
+          "description": "Application name or slug",
+          "name": "name",
+          "required": true
+        },
+        "versionId": {
+          "description": "GitHub Packages numeric version id (from `flui app versions --output json`)",
+          "name": "versionId",
           "required": true
         }
       },
-      "description": "Disconnect a repository from your Flui account. Requires admin privileges. Does not delete the repository on GitHub.",
+      "description": "Delete a container image version from the registry (GHCR). Refuses to delete the currently deployed version. The latest-release guard can be overridden with --force.",
       "examples": [
-        "<%= config.bin %> <%= command.id %> acme/my-app",
-        "<%= config.bin %> <%= command.id %> acme/my-app --yes"
+        "<%= config.bin %> <%= command.id %> my-api 845914920",
+        "<%= config.bin %> <%= command.id %> my-api 845914920 --force"
       ],
       "flags": {
+        "cluster": {
+          "char": "c",
+          "name": "cluster",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "force": {
+          "description": "Override the latest-release guard. The currently-deployed guard is never bypassable.",
+          "name": "force",
+          "allowNo": false,
+          "type": "boolean"
+        },
         "yes": {
           "char": "y",
-          "description": "Skip the confirmation prompt",
+          "description": "Skip confirmation prompt",
           "name": "yes",
           "allowNo": false,
           "type": "boolean"
@@ -3916,7 +4363,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "repo:disconnect",
+      "id": "app:image:delete",
       "pluginAlias": "@flui-cloud/cli",
       "pluginName": "@flui-cloud/cli",
       "pluginType": "core",
@@ -3928,61 +4375,21 @@
         "cli",
         "src",
         "commands",
-        "repo",
-        "disconnect.js"
+        "app",
+        "image",
+        "delete.js"
       ]
     },
-    "repo:list": {
+    "app:snapshot:create": {
       "aliases": [],
-      "args": {},
-      "description": "List repositories connected to your Flui account.",
-      "examples": [
-        "<%= config.bin %> <%= command.id %>",
-        "<%= config.bin %> <%= command.id %> --output json"
-      ],
-      "flags": {
-        "output": {
-          "char": "o",
-          "description": "Output format",
-          "name": "output",
-          "default": "text",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "options": [
-            "text",
-            "json"
-          ],
-          "type": "option"
-        }
-      },
-      "hasDynamicHelp": false,
-      "hiddenAliases": [],
-      "id": "repo:list",
-      "pluginAlias": "@flui-cloud/cli",
-      "pluginName": "@flui-cloud/cli",
-      "pluginType": "core",
-      "strict": true,
-      "enableJsonFlag": false,
-      "isESM": false,
-      "relativePath": [
-        "lib",
-        "cli",
-        "src",
-        "commands",
-        "repo",
-        "list.js"
-      ]
-    },
-    "app:snapshot:create": {
-      "aliases": [],
-      "args": {
-        "name": {
-          "description": "Application name or slug",
-          "name": "name",
-          "required": true
-        }
-      },
-      "description": "Create a snapshot of an application volume. Today on every provider this is a full PVC clone built via the copy-pod export primitive (sink=pvc-clone) because workload PVCs use local-path. Cost: a full Volume per snapshot.",
+      "args": {
+        "name": {
+          "description": "Application name or slug",
+          "name": "name",
+          "required": true
+        }
+      },
+      "description": "Create a snapshot of an application volume. Today on every provider this is a full PVC clone built via the copy-pod export primitive (sink=pvc-clone) because workload PVCs use local-path. Cost: a full Volume per snapshot.",
       "examples": [
         "<%= config.bin %> <%= command.id %> my-app",
         "<%= config.bin %> <%= command.id %> my-app --description before-upgrade",
@@ -4271,188 +4678,116 @@
         "swap.js"
       ]
     },
-    "app:image:delete": {
-      "aliases": [],
-      "args": {
-        "name": {
-          "description": "Application name or slug",
-          "name": "name",
-          "required": true
-        },
-        "versionId": {
-          "description": "GitHub Packages numeric version id (from `flui app versions --output json`)",
-          "name": "versionId",
-          "required": true
-        }
-      },
-      "description": "Delete a container image version from the registry (GHCR). Refuses to delete the currently deployed version. The latest-release guard can be overridden with --force.",
-      "examples": [
-        "<%= config.bin %> <%= command.id %> my-api 845914920",
-        "<%= config.bin %> <%= command.id %> my-api 845914920 --force"
-      ],
-      "flags": {
-        "cluster": {
-          "char": "c",
-          "name": "cluster",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "force": {
-          "description": "Override the latest-release guard. The currently-deployed guard is never bypassable.",
-          "name": "force",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "yes": {
-          "char": "y",
-          "description": "Skip confirmation prompt",
-          "name": "yes",
-          "allowNo": false,
-          "type": "boolean"
-        }
-      },
-      "hasDynamicHelp": false,
-      "hiddenAliases": [],
-      "id": "app:image:delete",
-      "pluginAlias": "@flui-cloud/cli",
-      "pluginName": "@flui-cloud/cli",
-      "pluginType": "core",
-      "strict": true,
-      "enableJsonFlag": false,
-      "isESM": false,
-      "relativePath": [
-        "lib",
-        "cli",
-        "src",
-        "commands",
-        "app",
-        "image",
-        "delete.js"
-      ]
-    },
-    "backup:destination:create": {
+    "backup:policy:create": {
       "aliases": [],
       "args": {},
-      "description": "Create a backup destination (S3-compatible storage target for Velero)",
+      "description": "Create a backup policy",
       "examples": [
-        "<%= config.bin %> <%= command.id %> --name my-s3 --provider hetzner_object_storage --endpoint https://fsn1.your-objectstorage.com --region fsn1 --bucket flui-backups --access-key AK --secret-key SK",
-        "<%= config.bin %> <%= command.id %> --name scw --provider scaleway_object_storage --endpoint https://s3.fr-par.scw.cloud --region fr-par --bucket flui-bkp --access-key AK --secret-key SK"
+        "<%= config.bin %> <%= command.id %> --name daily-all --cluster <id> --scope cluster_all --schedule \"0 2 * * *\" --retention-days 14 --destination <destId>",
+        "<%= config.bin %> <%= command.id %> --name app-snap --cluster <id> --scope applications --scope-namespaces ns1,ns2 --destination <destId>"
       ],
       "flags": {
         "name": {
-          "description": "Display name (≤120 chars)",
           "name": "name",
           "required": true,
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
-        "provider": {
-          "description": "Storage backend provider",
-          "name": "provider",
-          "required": true,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "options": [
-            "hetzner_object_storage",
-            "scaleway_object_storage",
-            "minio",
-            "generic_s3"
-          ],
-          "type": "option"
-        },
-        "endpoint": {
-          "description": "S3 endpoint URL (e.g. https://s3.fr-par.scw.cloud)",
-          "name": "endpoint",
+        "cluster": {
+          "description": "Cluster ID",
+          "name": "cluster",
           "required": true,
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
-        "region": {
-          "name": "region",
+        "scope": {
+          "name": "scope",
           "required": true,
           "hasDynamicHelp": false,
           "multiple": false,
+          "options": [
+            "cluster_all",
+            "namespaces",
+            "applications",
+            "label_selector"
+          ],
           "type": "option"
         },
-        "bucket": {
-          "name": "bucket",
-          "required": true,
+        "scope-namespaces": {
+          "description": "Comma-separated namespaces (for scope=namespaces)",
+          "name": "scope-namespaces",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
-        "access-key": {
-          "name": "access-key",
-          "required": true,
+        "scope-apps": {
+          "description": "Comma-separated application IDs (for scope=applications)",
+          "name": "scope-apps",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
-        "secret-key": {
-          "name": "secret-key",
-          "required": true,
+        "profile": {
+          "name": "profile",
+          "default": "single",
           "hasDynamicHelp": false,
           "multiple": false,
+          "options": [
+            "single",
+            "mirrored",
+            "custom"
+          ],
           "type": "option"
         },
-        "prefix": {
-          "description": "Optional path prefix inside the bucket",
-          "name": "prefix",
+        "schedule": {
+          "description": "Cron schedule (e.g. \"0 2 * * *\" for daily 02:00 UTC)",
+          "name": "schedule",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
-        "encryption-mode": {
-          "description": "Encryption mode (default: flui_managed)",
-          "name": "encryption-mode",
+        "retention-days": {
+          "name": "retention-days",
+          "default": 30,
           "hasDynamicHelp": false,
           "multiple": false,
-          "options": [
-            "flui_managed",
-            "byo_passphrase",
-            "none"
-          ],
           "type": "option"
         },
-        "encryption-passphrase": {
-          "description": "Required when --encryption-mode=byo_passphrase",
-          "name": "encryption-passphrase",
+        "retention-max-copies": {
+          "name": "retention-max-copies",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
-        "force-path-style": {
-          "description": "Force path-style S3 URLs (needed for MinIO/some providers)",
-          "name": "force-path-style",
+        "include-pvcs": {
+          "name": "include-pvcs",
           "allowNo": false,
           "type": "boolean"
         },
-        "use-sse": {
-          "description": "Use server-side encryption (SSE-S3) at the provider",
-          "name": "use-sse",
+        "include-etcd-l1": {
+          "name": "include-etcd-l1",
           "allowNo": false,
           "type": "boolean"
         },
-        "usable-for-etcd-l1": {
-          "description": "Allow this destination to receive L1 etcd snapshots",
-          "name": "usable-for-etcd-l1",
-          "allowNo": false,
+        "enabled": {
+          "name": "enabled",
+          "allowNo": true,
           "type": "boolean"
         },
-        "cost-per-gb-month-cents": {
-          "description": "Provider cost in cents/GB·month (used for billing estimate)",
-          "name": "cost-per-gb-month-cents",
+        "destination": {
+          "description": "Destination spec: <destId>[:primary|replica[:priority]] (repeatable)",
+          "name": "destination",
+          "required": true,
           "hasDynamicHelp": false,
-          "multiple": false,
+          "multiple": true,
           "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "backup:destination:create",
+      "id": "backup:policy:create",
       "pluginAlias": "@flui-cloud/cli",
       "pluginName": "@flui-cloud/cli",
       "pluginType": "core",
@@ -4465,24 +4800,22 @@
         "src",
         "commands",
         "backup",
-        "destination",
+        "policy",
         "create.js"
       ]
     },
-    "backup:destination:delete": {
+    "backup:policy:delete": {
       "aliases": [],
       "args": {
         "id": {
-          "description": "Destination ID",
           "name": "id",
           "required": true
         }
       },
-      "description": "Delete a backup destination",
+      "description": "Delete a backup policy (existing artifacts are retained)",
       "flags": {
         "yes": {
           "char": "y",
-          "description": "Skip confirmation",
           "name": "yes",
           "allowNo": false,
           "type": "boolean"
@@ -4490,7 +4823,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "backup:destination:delete",
+      "id": "backup:policy:delete",
       "pluginAlias": "@flui-cloud/cli",
       "pluginName": "@flui-cloud/cli",
       "pluginType": "core",
@@ -4503,20 +4836,23 @@
         "src",
         "commands",
         "backup",
-        "destination",
+        "policy",
         "delete.js"
       ]
     },
-    "backup:destination:list": {
+    "backup:policy:list": {
       "aliases": [],
       "args": {},
-      "description": "List backup destinations configured in the API",
-      "examples": [
-        "<%= config.bin %> <%= command.id %>"
-      ],
+      "description": "List backup policies",
       "flags": {
+        "cluster": {
+          "description": "Filter by cluster ID",
+          "name": "cluster",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
         "json": {
-          "description": "Output as JSON",
           "name": "json",
           "allowNo": false,
           "type": "boolean"
@@ -4524,7 +4860,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "backup:destination:list",
+      "id": "backup:policy:list",
       "pluginAlias": "@flui-cloud/cli",
       "pluginName": "@flui-cloud/cli",
       "pluginType": "core",
@@ -4537,23 +4873,22 @@
         "src",
         "commands",
         "backup",
-        "destination",
+        "policy",
         "list.js"
       ]
     },
-    "backup:destination:show": {
+    "backup:policy:show": {
       "aliases": [],
       "args": {
         "id": {
-          "description": "Destination ID (UUID)",
+          "description": "Policy ID",
           "name": "id",
           "required": true
         }
       },
-      "description": "Show a backup destination by ID",
+      "description": "Show a backup policy by ID",
       "flags": {
         "json": {
-          "description": "Output as JSON",
           "name": "json",
           "allowNo": false,
           "type": "boolean"
@@ -4561,7 +4896,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "backup:destination:show",
+      "id": "backup:policy:show",
       "pluginAlias": "@flui-cloud/cli",
       "pluginName": "@flui-cloud/cli",
       "pluginType": "core",
@@ -4574,56 +4909,15 @@
         "src",
         "commands",
         "backup",
-        "destination",
+        "policy",
         "show.js"
       ]
     },
-    "backup:destination:test": {
-      "aliases": [],
-      "args": {
-        "id": {
-          "description": "Destination ID",
-          "name": "id",
-          "required": true
-        }
-      },
-      "description": "Test connectivity to a backup destination (S3 PUT/GET/DELETE round-trip)",
-      "flags": {},
-      "hasDynamicHelp": false,
-      "hiddenAliases": [],
-      "id": "backup:destination:test",
-      "pluginAlias": "@flui-cloud/cli",
-      "pluginName": "@flui-cloud/cli",
-      "pluginType": "core",
-      "strict": true,
-      "enableJsonFlag": false,
-      "isESM": false,
-      "relativePath": [
-        "lib",
-        "cli",
-        "src",
-        "commands",
-        "backup",
-        "destination",
-        "test.js"
-      ]
-    },
-    "backup:policy:create": {
+    "backup:job:list": {
       "aliases": [],
       "args": {},
-      "description": "Create a backup policy",
-      "examples": [
-        "<%= config.bin %> <%= command.id %> --name daily-all --cluster <id> --scope cluster_all --schedule \"0 2 * * *\" --retention-days 14 --destination <destId>",
-        "<%= config.bin %> <%= command.id %> --name app-snap --cluster <id> --scope applications --scope-namespaces ns1,ns2 --destination <destId>"
-      ],
+      "description": "List backup jobs for a cluster",
       "flags": {
-        "name": {
-          "name": "name",
-          "required": true,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
         "cluster": {
           "description": "Cluster ID",
           "name": "cluster",
@@ -4632,128 +4926,15 @@
           "multiple": false,
           "type": "option"
         },
-        "scope": {
-          "name": "scope",
-          "required": true,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "options": [
-            "cluster_all",
-            "namespaces",
-            "applications",
-            "label_selector"
-          ],
-          "type": "option"
-        },
-        "scope-namespaces": {
-          "description": "Comma-separated namespaces (for scope=namespaces)",
-          "name": "scope-namespaces",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "scope-apps": {
-          "description": "Comma-separated application IDs (for scope=applications)",
-          "name": "scope-apps",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "profile": {
-          "name": "profile",
-          "default": "single",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "options": [
-            "single",
-            "mirrored",
-            "custom"
-          ],
-          "type": "option"
-        },
-        "schedule": {
-          "description": "Cron schedule (e.g. \"0 2 * * *\" for daily 02:00 UTC)",
-          "name": "schedule",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "retention-days": {
-          "name": "retention-days",
-          "default": 30,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "retention-max-copies": {
-          "name": "retention-max-copies",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "include-pvcs": {
-          "name": "include-pvcs",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "include-etcd-l1": {
-          "name": "include-etcd-l1",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "enabled": {
-          "name": "enabled",
-          "allowNo": true,
-          "type": "boolean"
-        },
-        "destination": {
-          "description": "Destination spec: <destId>[:primary|replica[:priority]] (repeatable)",
-          "name": "destination",
-          "required": true,
-          "hasDynamicHelp": false,
-          "multiple": true,
-          "type": "option"
-        }
-      },
-      "hasDynamicHelp": false,
-      "hiddenAliases": [],
-      "id": "backup:policy:create",
-      "pluginAlias": "@flui-cloud/cli",
-      "pluginName": "@flui-cloud/cli",
-      "pluginType": "core",
-      "strict": true,
-      "enableJsonFlag": false,
-      "isESM": false,
-      "relativePath": [
-        "lib",
-        "cli",
-        "src",
-        "commands",
-        "backup",
-        "policy",
-        "create.js"
-      ]
-    },
-    "backup:policy:delete": {
-      "aliases": [],
-      "args": {
-        "id": {
-          "name": "id",
-          "required": true
-        }
-      },
-      "description": "Delete a backup policy (existing artifacts are retained)",
-      "flags": {
-        "yes": {
-          "char": "y",
-          "name": "yes",
+        "json": {
+          "name": "json",
           "allowNo": false,
           "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "backup:policy:delete",
+      "id": "backup:job:list",
       "pluginAlias": "@flui-cloud/cli",
       "pluginName": "@flui-cloud/cli",
       "pluginType": "core",
@@ -4766,31 +4947,27 @@
         "src",
         "commands",
         "backup",
-        "policy",
-        "delete.js"
+        "job",
+        "list.js"
       ]
     },
-    "backup:policy:list": {
+    "backup:job:run": {
       "aliases": [],
       "args": {},
-      "description": "List backup policies",
+      "description": "Trigger an on-demand backup job for a given policy",
       "flags": {
-        "cluster": {
-          "description": "Filter by cluster ID",
-          "name": "cluster",
+        "policy": {
+          "description": "Policy ID",
+          "name": "policy",
+          "required": true,
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
-        },
-        "json": {
-          "name": "json",
-          "allowNo": false,
-          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "backup:policy:list",
+      "id": "backup:job:run",
       "pluginAlias": "@flui-cloud/cli",
       "pluginName": "@flui-cloud/cli",
       "pluginType": "core",
@@ -4803,20 +4980,19 @@
         "src",
         "commands",
         "backup",
-        "policy",
-        "list.js"
+        "job",
+        "run.js"
       ]
     },
-    "backup:policy:show": {
+    "backup:job:show": {
       "aliases": [],
       "args": {
         "id": {
-          "description": "Policy ID",
           "name": "id",
           "required": true
         }
       },
-      "description": "Show a backup policy by ID",
+      "description": "Show a backup job by ID",
       "flags": {
         "json": {
           "name": "json",
@@ -4826,7 +5002,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "backup:policy:show",
+      "id": "backup:job:show",
       "pluginAlias": "@flui-cloud/cli",
       "pluginName": "@flui-cloud/cli",
       "pluginType": "core",
@@ -4839,79 +5015,132 @@
         "src",
         "commands",
         "backup",
-        "policy",
+        "job",
         "show.js"
       ]
     },
-    "backup:restore:create": {
+    "backup:destination:create": {
       "aliases": [],
       "args": {},
-      "description": "Create a restore job",
+      "description": "Create a backup destination (S3-compatible storage target for Velero)",
+      "examples": [
+        "<%= config.bin %> <%= command.id %> --name my-s3 --provider hetzner_object_storage --endpoint https://fsn1.your-objectstorage.com --region fsn1 --bucket flui-backups --access-key AK --secret-key SK",
+        "<%= config.bin %> <%= command.id %> --name scw --provider scaleway_object_storage --endpoint https://s3.fr-par.scw.cloud --region fr-par --bucket flui-bkp --access-key AK --secret-key SK"
+      ],
       "flags": {
-        "artifact": {
-          "description": "Backup artifact ID",
-          "name": "artifact",
+        "name": {
+          "description": "Display name (≤120 chars)",
+          "name": "name",
           "required": true,
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
-        "source-destination": {
-          "name": "source-destination",
+        "provider": {
+          "description": "Storage backend provider",
+          "name": "provider",
           "required": true,
           "hasDynamicHelp": false,
           "multiple": false,
+          "options": [
+            "hetzner_object_storage",
+            "scaleway_object_storage",
+            "minio",
+            "generic_s3"
+          ],
           "type": "option"
         },
-        "target-cluster": {
-          "description": "Cluster to restore into",
-          "name": "target-cluster",
+        "endpoint": {
+          "description": "S3 endpoint URL (e.g. https://s3.fr-par.scw.cloud)",
+          "name": "endpoint",
           "required": true,
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
-        "target-kind": {
-          "name": "target-kind",
+        "region": {
+          "name": "region",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "bucket": {
+          "name": "bucket",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "access-key": {
+          "name": "access-key",
           "required": true,
           "hasDynamicHelp": false,
           "multiple": false,
+          "type": "option"
+        },
+        "secret-key": {
+          "name": "secret-key",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "prefix": {
+          "description": "Optional path prefix inside the bucket",
+          "name": "prefix",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "encryption-mode": {
+          "description": "Encryption mode (default: flui_managed)",
+          "name": "encryption-mode",
+          "hasDynamicHelp": false,
+          "multiple": false,
           "options": [
-            "cluster",
-            "namespace",
-            "application",
-            "observability"
+            "flui_managed",
+            "byo_passphrase",
+            "none"
           ],
           "type": "option"
         },
-        "target-namespace": {
-          "description": "Required when --target-kind=namespace",
-          "name": "target-namespace",
+        "encryption-passphrase": {
+          "description": "Required when --encryption-mode=byo_passphrase",
+          "name": "encryption-passphrase",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
-        "target-app": {
-          "description": "Required when --target-kind=application",
-          "name": "target-app",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
+        "force-path-style": {
+          "description": "Force path-style S3 URLs (needed for MinIO/some providers)",
+          "name": "force-path-style",
+          "allowNo": false,
+          "type": "boolean"
         },
-        "strategy": {
-          "name": "strategy",
+        "use-sse": {
+          "description": "Use server-side encryption (SSE-S3) at the provider",
+          "name": "use-sse",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "usable-for-etcd-l1": {
+          "description": "Allow this destination to receive L1 etcd snapshots",
+          "name": "usable-for-etcd-l1",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "cost-per-gb-month-cents": {
+          "description": "Provider cost in cents/GB·month (used for billing estimate)",
+          "name": "cost-per-gb-month-cents",
           "hasDynamicHelp": false,
           "multiple": false,
-          "options": [
-            "velero_rebuild",
-            "os_snapshot"
-          ],
           "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "backup:restore:create",
+      "id": "backup:destination:create",
       "pluginAlias": "@flui-cloud/cli",
       "pluginName": "@flui-cloud/cli",
       "pluginType": "core",
@@ -4924,24 +5153,32 @@
         "src",
         "commands",
         "backup",
-        "restore",
+        "destination",
         "create.js"
       ]
     },
-    "backup:restore:list": {
+    "backup:destination:delete": {
       "aliases": [],
-      "args": {},
-      "description": "List restore jobs",
+      "args": {
+        "id": {
+          "description": "Destination ID",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Delete a backup destination",
       "flags": {
-        "json": {
-          "name": "json",
+        "yes": {
+          "char": "y",
+          "description": "Skip confirmation",
+          "name": "yes",
           "allowNo": false,
           "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "backup:restore:list",
+      "id": "backup:destination:delete",
       "pluginAlias": "@flui-cloud/cli",
       "pluginName": "@flui-cloud/cli",
       "pluginType": "core",
@@ -4954,35 +5191,28 @@
         "src",
         "commands",
         "backup",
-        "restore",
-        "list.js"
+        "destination",
+        "delete.js"
       ]
     },
-    "backup:restore:preview": {
+    "backup:destination:list": {
       "aliases": [],
       "args": {},
-      "description": "Preview what a restore would touch (resources to be created/replaced)",
+      "description": "List backup destinations configured in the API",
+      "examples": [
+        "<%= config.bin %> <%= command.id %>"
+      ],
       "flags": {
-        "artifact": {
-          "description": "Backup artifact ID",
-          "name": "artifact",
-          "required": true,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "source-destination": {
-          "description": "Source destination ID (where the artifact lives)",
-          "name": "source-destination",
-          "required": true,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
+        "json": {
+          "description": "Output as JSON",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "backup:restore:preview",
+      "id": "backup:destination:list",
       "pluginAlias": "@flui-cloud/cli",
       "pluginName": "@flui-cloud/cli",
       "pluginType": "core",
@@ -4995,21 +5225,23 @@
         "src",
         "commands",
         "backup",
-        "restore",
-        "preview.js"
+        "destination",
+        "list.js"
       ]
     },
-    "backup:restore:show": {
+    "backup:destination:show": {
       "aliases": [],
       "args": {
         "id": {
+          "description": "Destination ID (UUID)",
           "name": "id",
           "required": true
         }
       },
-      "description": "Show a restore job by ID",
+      "description": "Show a backup destination by ID",
       "flags": {
         "json": {
+          "description": "Output as JSON",
           "name": "json",
           "allowNo": false,
           "type": "boolean"
@@ -5017,7 +5249,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "backup:restore:show",
+      "id": "backup:destination:show",
       "pluginAlias": "@flui-cloud/cli",
       "pluginName": "@flui-cloud/cli",
       "pluginType": "core",
@@ -5030,10 +5262,40 @@
         "src",
         "commands",
         "backup",
-        "restore",
+        "destination",
         "show.js"
       ]
     },
+    "backup:destination:test": {
+      "aliases": [],
+      "args": {
+        "id": {
+          "description": "Destination ID",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Test connectivity to a backup destination (S3 PUT/GET/DELETE round-trip)",
+      "flags": {},
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "backup:destination:test",
+      "pluginAlias": "@flui-cloud/cli",
+      "pluginName": "@flui-cloud/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": false,
+      "relativePath": [
+        "lib",
+        "cli",
+        "src",
+        "commands",
+        "backup",
+        "destination",
+        "test.js"
+      ]
+    },
     "integration:ghcr-pat:revoke": {
       "aliases": [],
       "args": {},
@@ -5132,19 +5394,96 @@
         "status.js"
       ]
     },
-    "backup:job:list": {
+    "backup:restore:create": {
       "aliases": [],
       "args": {},
-      "description": "List backup jobs for a cluster",
+      "description": "Create a restore job",
       "flags": {
-        "cluster": {
-          "description": "Cluster ID",
-          "name": "cluster",
+        "artifact": {
+          "description": "Backup artifact ID",
+          "name": "artifact",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "source-destination": {
+          "name": "source-destination",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "target-cluster": {
+          "description": "Cluster to restore into",
+          "name": "target-cluster",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "target-kind": {
+          "name": "target-kind",
           "required": true,
           "hasDynamicHelp": false,
           "multiple": false,
+          "options": [
+            "cluster",
+            "namespace",
+            "application",
+            "observability"
+          ],
+          "type": "option"
+        },
+        "target-namespace": {
+          "description": "Required when --target-kind=namespace",
+          "name": "target-namespace",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "target-app": {
+          "description": "Required when --target-kind=application",
+          "name": "target-app",
+          "hasDynamicHelp": false,
+          "multiple": false,
           "type": "option"
         },
+        "strategy": {
+          "name": "strategy",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "velero_rebuild",
+            "os_snapshot"
+          ],
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "backup:restore:create",
+      "pluginAlias": "@flui-cloud/cli",
+      "pluginName": "@flui-cloud/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": false,
+      "relativePath": [
+        "lib",
+        "cli",
+        "src",
+        "commands",
+        "backup",
+        "restore",
+        "create.js"
+      ]
+    },
+    "backup:restore:list": {
+      "aliases": [],
+      "args": {},
+      "description": "List restore jobs",
+      "flags": {
         "json": {
           "name": "json",
           "allowNo": false,
@@ -5153,7 +5492,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "backup:job:list",
+      "id": "backup:restore:list",
       "pluginAlias": "@flui-cloud/cli",
       "pluginName": "@flui-cloud/cli",
       "pluginType": "core",
@@ -5166,18 +5505,26 @@
         "src",
         "commands",
         "backup",
-        "job",
+        "restore",
         "list.js"
       ]
     },
-    "backup:job:run": {
+    "backup:restore:preview": {
       "aliases": [],
       "args": {},
-      "description": "Trigger an on-demand backup job for a given policy",
+      "description": "Preview what a restore would touch (resources to be created/replaced)",
       "flags": {
-        "policy": {
-          "description": "Policy ID",
-          "name": "policy",
+        "artifact": {
+          "description": "Backup artifact ID",
+          "name": "artifact",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "source-destination": {
+          "description": "Source destination ID (where the artifact lives)",
+          "name": "source-destination",
           "required": true,
           "hasDynamicHelp": false,
           "multiple": false,
@@ -5186,7 +5533,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "backup:job:run",
+      "id": "backup:restore:preview",
       "pluginAlias": "@flui-cloud/cli",
       "pluginName": "@flui-cloud/cli",
       "pluginType": "core",
@@ -5199,11 +5546,11 @@
         "src",
         "commands",
         "backup",
-        "job",
-        "run.js"
+        "restore",
+        "preview.js"
       ]
     },
-    "backup:job:show": {
+    "backup:restore:show": {
       "aliases": [],
       "args": {
         "id": {
@@ -5211,7 +5558,7 @@
           "required": true
         }
       },
-      "description": "Show a backup job by ID",
+      "description": "Show a restore job by ID",
       "flags": {
         "json": {
           "name": "json",
@@ -5221,7 +5568,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "backup:job:show",
+      "id": "backup:restore:show",
       "pluginAlias": "@flui-cloud/cli",
       "pluginName": "@flui-cloud/cli",
       "pluginType": "core",
@@ -5234,10 +5581,10 @@
         "src",
         "commands",
         "backup",
-        "job",
+        "restore",
         "show.js"
       ]
     }
   },
-  "version": "0.0.1"
+  "version": "0.1.0"
 }