@flui-cloud/cli 0.0.1 → 0.2.0

package/lib/cli/src/commands/version.d.ts

@@ -0,0 +1,18 @@
+import { Command } from '@oclif/core';
+/**
+ * `flui version` — surfaces the CLI version AND the platform release it pins.
+ *
+ * The CLI's npm version is decoupled from the platform release (carried in
+ * RELEASE), so this command makes the mapping explicit: which bootstrap ref and
+ * which component image tags a `flui env create` would install. Handy when
+ * debugging an install ("which versions did this CLI actually use?").
+ */
+export default class Version extends Command {
+    static readonly description = "Show the CLI version and the platform release it pins (component image tags + bootstrap ref). Useful for debugging an install.";
+    static readonly examples: string[];
+    static readonly flags: {
+        latest: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/lib/cli/src/commands/version.js

@@ -0,0 +1,100 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const chalk_1 = __importDefault(require("chalk"));
+const bootstrap_config_1 = require("../config/bootstrap.config");
+const release_override_1 = require("../config/release-override");
+function describePlatform(release) {
+    if (release.source === 'latest') {
+        return chalk_1.default.yellow('latest (mobile tags)');
+    }
+    if (release.source === 'override') {
+        return `${chalk_1.default.yellow(release.version ?? 'override')}${chalk_1.default.dim('  (release override)')}`;
+    }
+    return `${chalk_1.default.cyan(release.version ?? '')}${chalk_1.default.dim('  (pinned release)')}`;
+}
+/**
+ * `flui version` — surfaces the CLI version AND the platform release it pins.
+ *
+ * The CLI's npm version is decoupled from the platform release (carried in
+ * RELEASE), so this command makes the mapping explicit: which bootstrap ref and
+ * which component image tags a `flui env create` would install. Handy when
+ * debugging an install ("which versions did this CLI actually use?").
+ */
+class Version extends core_1.Command {
+    async run() {
+        const { flags } = await this.parse(Version);
+        const useLatest = flags.latest;
+        const release = (0, release_override_1.getEffectiveRelease)(useLatest);
+        const tags = release.images;
+        const bootstrapRef = release.bootstrapRef;
+        const scriptsBaseUrl = (0, bootstrap_config_1.getScriptsBaseUrl)(useLatest);
+        const urlOverride = process.env.BOOTSTRAP_SCRIPTS_URL ?? null;
+        const images = {
+            'flui-api': `ghcr.io/flui-cloud/core:${tags.fluiApi}`,
+            'flui-web': `ghcr.io/flui-cloud/dashboard:${tags.fluiWeb}`,
+            'flui-authz': `ghcr.io/flui-cloud/flui-authz:${tags.fluiAuthz}`,
+        };
+        if (flags.json) {
+            this.log(JSON.stringify({
+                cli: this.config.version,
+                mode: release.source,
+                platform: release.version,
+                bootstrapRef,
+                scriptsBaseUrl,
+                bootstrapUrlOverride: urlOverride,
+                releaseFile: release.filePath,
+                images: tags,
+            }, null, 2));
+            return;
+        }
+        const label = (s) => chalk_1.default.dim(s.padEnd(15));
+        const cliName = chalk_1.default.dim(`(${this.config.name})`);
+        const platformLabel = describePlatform(release);
+        this.log('');
+        this.log(chalk_1.default.bold('Flui CLI'));
+        this.log('');
+        this.log(`  ${label('CLI')}${chalk_1.default.cyan(this.config.version)}  ${cliName}`);
+        this.log(`  ${label('Platform')}${platformLabel}`);
+        this.log(`  ${label('Bootstrap ref')}${chalk_1.default.cyan(bootstrapRef)}`);
+        this.log('');
+        this.log(chalk_1.default.dim('  Component images:'));
+        for (const [name, ref] of Object.entries(images)) {
+            this.log(`    ${chalk_1.default.dim(name.padEnd(12))}${ref}`);
+        }
+        this.log('');
+        this.log(`  ${label('Scripts URL')}${chalk_1.default.dim(scriptsBaseUrl)}`);
+        if (urlOverride) {
+            this.log(`  ${label('')}${chalk_1.default.yellow('↑ overridden via BOOTSTRAP_SCRIPTS_URL')}`);
+        }
+        if (release.source === 'override' && release.filePath) {
+            const rel = (0, release_override_1.displayReleaseFilePath)(release.filePath);
+            this.log(`  ${label('Release file')}${chalk_1.default.yellow(rel)}`);
+        }
+        if (!useLatest && release.source !== 'override') {
+            this.log('');
+            this.log(chalk_1.default.dim('  Tip: `flui version --latest` shows what `env create --latest` would use.'));
+        }
+        this.log('');
+    }
+}
+Version.description = 'Show the CLI version and the platform release it pins (component image tags + bootstrap ref). Useful for debugging an install.';
+Version.examples = [
+    '<%= config.bin %> <%= command.id %>',
+    '<%= config.bin %> <%= command.id %> --latest',
+    '<%= config.bin %> <%= command.id %> --json',
+];
+Version.flags = {
+    latest: core_1.Flags.boolean({
+        description: 'Show what `env create --latest` would resolve to (mobile tags: bootstrap master, :latest images) instead of the pinned release',
+        default: false,
+    }),
+    json: core_1.Flags.boolean({
+        description: 'Output as JSON',
+        default: false,
+    }),
+};
+exports.default = Version;

package/lib/cli/src/config/bootstrap.config.d.ts

@@ -2,8 +2,17 @@
  * Bootstrap Scripts Configuration
  *
  * Configuration for downloading initialization scripts from GitHub.
- * Scripts are hosted in the flui-cloud/flui-bootstrap repository.
+ * Scripts are hosted in the flui-cloud/bootstrap-scripts repository.
  */
+/**
+ * Base URL for the bootstrap scripts directory.
+ *
+ * Precedence:
+ *  1. `BOOTSTRAP_SCRIPTS_URL` env — full override (dev/CI escape hatch), wins over all.
+ *  2. Otherwise derived from the release pin: `<repo>/<ref>/scripts`, where the
+ *     ref is the pinned release tag, or `master` when `useLatest`.
+ */
+export declare function getScriptsBaseUrl(useLatest?: boolean): string;
 export interface BootstrapConfig {
     /**
      * Base URL for downloading scripts

package/lib/cli/src/config/bootstrap.config.js

@@ -3,17 +3,37 @@
  * Bootstrap Scripts Configuration
  *
  * Configuration for downloading initialization scripts from GitHub.
- * Scripts are hosted in the flui-cloud/flui-bootstrap repository.
+ * Scripts are hosted in the flui-cloud/bootstrap-scripts repository.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BOOTSTRAP_CONFIG = void 0;
+exports.getScriptsBaseUrl = getScriptsBaseUrl;
 exports.getScriptUrl = getScriptUrl;
+const release_config_1 = require("../../../src/config/release.config");
+const release_override_1 = require("./release-override");
+const BOOTSTRAP_REPO_RAW_BASE = 'https://raw.githubusercontent.com/flui-cloud/bootstrap-scripts';
+/**
+ * Base URL for the bootstrap scripts directory.
+ *
+ * Precedence:
+ *  1. `BOOTSTRAP_SCRIPTS_URL` env — full override (dev/CI escape hatch), wins over all.
+ *  2. Otherwise derived from the release pin: `<repo>/<ref>/scripts`, where the
+ *     ref is the pinned release tag, or `master` when `useLatest`.
+ */
+function getScriptsBaseUrl(useLatest = false) {
+    if (process.env.BOOTSTRAP_SCRIPTS_URL) {
+        return process.env.BOOTSTRAP_SCRIPTS_URL;
+    }
+    return `${BOOTSTRAP_REPO_RAW_BASE}/${(0, release_override_1.resolveEffectiveBootstrapRef)(useLatest)}/scripts`;
+}
 /**
  * Default bootstrap configuration
  */
 exports.BOOTSTRAP_CONFIG = {
-    scriptsBaseUrl: process.env.BOOTSTRAP_SCRIPTS_URL ||
-        'https://raw.githubusercontent.com/flui-cloud/bootstrap-scripts/master/scripts',
+    // Static pinned default; per-install (override-aware) resolution goes through
+    // getScriptsBaseUrl() at runtime — keep this off the override path so importing
+    // the module never reads flui.release.json.
+    scriptsBaseUrl: `${BOOTSTRAP_REPO_RAW_BASE}/${(0, release_config_1.resolveBootstrapRef)(false)}/scripts`,
     scripts: {
         fluiInit: 'flui-init.sh',
         k3sMaster: 'k3s-master-init.sh',
@@ -22,7 +42,7 @@ exports.BOOTSTRAP_CONFIG = {
     repository: {
         org: 'flui-cloud',
         name: 'bootstrap-scripts',
-        branch: 'master',
+        branch: (0, release_config_1.resolveBootstrapRef)(false),
     },
 };
 /**

package/lib/cli/src/config/preferences-schema.js

@@ -16,15 +16,15 @@ exports.isPreferenceKey = isPreferenceKey;
 exports.PREFERENCES = {
     email: {
         key: 'email',
-        description: 'Contact email used for ACME/Let\'s Encrypt and operational notifications',
+        description: "Contact email used for ACME/Let's Encrypt and operational notifications",
         envVar: 'FLUI_EMAIL',
         projectOverridable: true,
         required: true,
-        validate: (v) => (/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(v) ? null : 'Not a valid email'),
+        validate: (v) => /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(v) ? null : 'Not a valid email',
     },
     apiPath: {
         key: 'apiPath',
-        description: 'Path to the flui.api repo, used to locate the .env file written by env export-config',
+        description: 'Path to the flui-core repo, used to locate the .env file written by env export-config',
         envVar: 'FLUI_API_PATH',
         projectOverridable: true,
         defaultValue: '.',
@@ -32,10 +32,10 @@ exports.PREFERENCES = {
     },
     dashboardPath: {
         key: 'dashboardPath',
-        description: 'Path to the flui.dashboard repo, used when syncing its config.json',
+        description: 'Path to the flui-dashboard repo, used when syncing its config.json',
         envVar: 'FLUI_DASHBOARD_PATH',
         projectOverridable: true,
-        defaultValue: '../flui.dashboard',
+        defaultValue: '../flui-dashboard',
         required: false,
     },
     certificateMode: {

package/lib/cli/src/config/release-override.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Per-install override of the pinned release manifest.
+ *
+ * Default install pins every component to the built-in RELEASE (see
+ * src/config/release.config.ts). A local `flui.release.json` in the cwd (or the
+ * path in FLUI_RELEASE_FILE) overrides any subset of it — used to install a
+ * dev/staging build from a branch, tag or commit. Omitted fields stay pinned.
+ *
+ * Each value is `branch:<x>` / `tag:<x>` / `commit:<x>` (or a bare literal).
+ * Scripts and images resolve a ref differently: scripts take any git ref
+ * verbatim (raw.githubusercontent serves branch/tag/sha), while an image tag
+ * must match what CI publishes — a branch name sanitized to a tag, or a
+ * short commit sha.
+ */
+import { type ComponentImageTags } from '../../../src/config/release.config';
+declare const IMAGE_KEYS: readonly ["fluiApi", "fluiWeb", "fluiAuthz"];
+type ImageKey = (typeof IMAGE_KEYS)[number];
+export interface ReleaseOverrideFile {
+    version?: string;
+    bootstrapRef?: string;
+    images?: Partial<Record<ImageKey, string>>;
+}
+export interface OverrideEntry {
+    label: string;
+    spec: string;
+    resolved: string;
+}
+export interface EffectiveRelease {
+    version: string | null;
+    bootstrapRef: string;
+    images: ComponentImageTags;
+    source: 'pinned' | 'latest' | 'override';
+    overrides: OverrideEntry[];
+    filePath: string | null;
+}
+export declare function getEffectiveRelease(useLatest: boolean): EffectiveRelease;
+export declare function resolveEffectiveBootstrapRef(useLatest: boolean): string;
+export declare function resolveEffectiveImageTags(useLatest: boolean): ComponentImageTags;
+/** Display path: relative when inside cwd, absolute when it would escape it. */
+export declare function displayReleaseFilePath(filePath: string): string;
+/** Loud banner so a stale override is never installed unnoticed. */
+export declare function formatReleaseOverrideBanner(eff: EffectiveRelease): string | null;
+export {};

package/lib/cli/src/config/release-override.js

@@ -0,0 +1,203 @@
+"use strict";
+/**
+ * Per-install override of the pinned release manifest.
+ *
+ * Default install pins every component to the built-in RELEASE (see
+ * src/config/release.config.ts). A local `flui.release.json` in the cwd (or the
+ * path in FLUI_RELEASE_FILE) overrides any subset of it — used to install a
+ * dev/staging build from a branch, tag or commit. Omitted fields stay pinned.
+ *
+ * Each value is `branch:<x>` / `tag:<x>` / `commit:<x>` (or a bare literal).
+ * Scripts and images resolve a ref differently: scripts take any git ref
+ * verbatim (raw.githubusercontent serves branch/tag/sha), while an image tag
+ * must match what CI publishes — a branch name sanitized to a tag, or a
+ * short commit sha.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getEffectiveRelease = getEffectiveRelease;
+exports.resolveEffectiveBootstrapRef = resolveEffectiveBootstrapRef;
+exports.resolveEffectiveImageTags = resolveEffectiveImageTags;
+exports.displayReleaseFilePath = displayReleaseFilePath;
+exports.formatReleaseOverrideBanner = formatReleaseOverrideBanner;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const chalk_1 = __importDefault(require("chalk"));
+const release_config_1 = require("../../../src/config/release.config");
+const OVERRIDE_FILE = 'flui.release.json';
+const IMAGE_KEYS = ['fluiApi', 'fluiWeb', 'fluiAuthz'];
+const COMPONENT_LABELS = {
+    fluiApi: 'flui-api (core)',
+    fluiWeb: 'flui-web (dashboard)',
+    fluiAuthz: 'flui-authz',
+};
+function parseRef(raw) {
+    const idx = raw.indexOf(':');
+    if (idx === -1)
+        return { kind: 'literal', value: raw };
+    const prefix = raw.slice(0, idx);
+    const value = raw.slice(idx + 1);
+    switch (prefix) {
+        case 'branch':
+            return { kind: 'branch', value };
+        case 'tag':
+            return { kind: 'tag', value };
+        case 'commit':
+        case 'sha':
+            return { kind: 'commit', value };
+        default:
+            throw new Error(`Invalid ref "${raw}" in ${OVERRIDE_FILE}: unknown prefix "${prefix}:" — use branch:/tag:/commit:, or a bare tag.`);
+    }
+}
+/** Mirror docker/metadata-action `type=ref,event=branch`: invalid tag chars → "-". */
+function branchToImageTag(branch) {
+    return branch.replace(/[^a-zA-Z0-9._-]+/g, '-');
+}
+function resolveScriptsRef(spec) {
+    return parseRef(spec).value;
+}
+function resolveImageTag(spec) {
+    const ref = parseRef(spec);
+    switch (ref.kind) {
+        case 'branch':
+            return branchToImageTag(ref.value);
+        case 'commit':
+            return ref.value.slice(0, 7); // CI publishes type=sha,format=short
+        default:
+            return ref.value;
+    }
+}
+function loadOverrideFile() {
+    const explicit = process.env.FLUI_RELEASE_FILE;
+    const filePath = explicit
+        ? path.resolve(explicit)
+        : path.join(process.cwd(), OVERRIDE_FILE);
+    if (!fs.existsSync(filePath))
+        return null;
+    let data;
+    try {
+        data = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+    }
+    catch (err) {
+        throw new Error(`Failed to parse ${filePath}: ${err.message}`);
+    }
+    if (typeof data !== 'object' || data === null || Array.isArray(data)) {
+        throw new Error(`${filePath} must contain a JSON object.`);
+    }
+    return { data, filePath };
+}
+let cache;
+let cacheKey;
+function applyOverride(base, data) {
+    const images = { ...base.images };
+    const overrides = [];
+    let bootstrapRef = base.bootstrapRef;
+    if (data.bootstrapRef !== undefined) {
+        bootstrapRef = resolveScriptsRef(data.bootstrapRef);
+        overrides.push({
+            label: 'bootstrap scripts',
+            spec: data.bootstrapRef,
+            resolved: bootstrapRef,
+        });
+    }
+    for (const k of IMAGE_KEYS) {
+        const spec = data.images?.[k];
+        if (spec === undefined)
+            continue;
+        const resolved = resolveImageTag(spec);
+        images[k] = resolved;
+        overrides.push({ label: COMPONENT_LABELS[k], spec, resolved });
+    }
+    return {
+        version: data.version ?? base.version,
+        bootstrapRef,
+        images,
+        overrides,
+    };
+}
+function getEffectiveRelease(useLatest) {
+    const key = `${useLatest}|${process.env.FLUI_RELEASE_FILE ?? ''}|${process.cwd()}`;
+    if (cache && cacheKey === key)
+        return cache;
+    const base = {
+        version: useLatest ? null : release_config_1.RELEASE.version,
+        bootstrapRef: (0, release_config_1.resolveBootstrapRef)(useLatest),
+        images: { ...(0, release_config_1.resolveImageTags)(useLatest) },
+        overrides: [],
+    };
+    const loaded = loadOverrideFile();
+    const resolved = loaded ? applyOverride(base, loaded.data) : base;
+    const isOverride = resolved.overrides.length > 0;
+    const pinnedSource = useLatest ? 'latest' : 'pinned';
+    const eff = {
+        version: resolved.version,
+        bootstrapRef: resolved.bootstrapRef,
+        images: resolved.images,
+        source: isOverride ? 'override' : pinnedSource,
+        overrides: resolved.overrides,
+        filePath: isOverride && loaded ? loaded.filePath : null,
+    };
+    cache = eff;
+    cacheKey = key;
+    return eff;
+}
+function resolveEffectiveBootstrapRef(useLatest) {
+    return getEffectiveRelease(useLatest).bootstrapRef;
+}
+function resolveEffectiveImageTags(useLatest) {
+    return getEffectiveRelease(useLatest).images;
+}
+/** Display path: relative when inside cwd, absolute when it would escape it. */
+function displayReleaseFilePath(filePath) {
+    const rel = path.relative(process.cwd(), filePath);
+    return !rel || rel.startsWith('..') ? filePath : rel;
+}
+/** Loud banner so a stale override is never installed unnoticed. */
+function formatReleaseOverrideBanner(eff) {
+    if (eff.source !== 'override' || !eff.filePath)
+        return null;
+    const rel = displayReleaseFilePath(eff.filePath);
+    const lines = eff.overrides.map((o) => {
+        const spec = chalk_1.default.dim(`(${o.spec})`);
+        return `   • ${o.label}: ${chalk_1.default.cyan(o.resolved)} ${spec}`;
+    });
+    return (chalk_1.default.yellow.bold('\n⚠ Release override active') +
+        chalk_1.default.dim(` — ${rel}\n`) +
+        chalk_1.default.dim('  Installing non-default component versions:\n') +
+        `${lines.join('\n')}\n`);
+}

package/lib/cli/src/config/release.config.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Release manifest — single source of truth for the versions Flui pins at
+ * install time. Bumped by hand on each CLI release.
+ *
+ * As long as the installed CLI stays at this version, every component a fresh
+ * cluster receives is pinned: the bootstrap scripts/manifests (a git ref on
+ * flui-cloud/bootstrap-scripts) and the Docker image tags injected into the
+ * cluster. `flui env create --latest` opts back into the mobile dev behaviour
+ * (bootstrap ref `master`, `:latest` image tags).
+ */
+export interface ComponentImageTags {
+    /** ghcr.io/flui-cloud/core */
+    fluiApi: string;
+    /** ghcr.io/flui-cloud/dashboard */
+    fluiWeb: string;
+    /** ghcr.io/flui-cloud/flui-authz */
+    fluiAuthz: string;
+}
+export interface ReleaseManifest {
+    /** Platform release version, recorded on the cluster at install. */
+    version: string;
+    /** Git ref (tag) on flui-cloud/bootstrap-scripts holding scripts + manifests. */
+    bootstrapRef: string;
+    /** Pinned Docker image tags, per Flui component. */
+    images: ComponentImageTags;
+}
+export declare const RELEASE: ReleaseManifest;
+/** Bootstrap-scripts git ref to install from. `--latest` → `master`. */
+export declare function resolveBootstrapRef(useLatest: boolean): string;
+/** Docker image tags to deploy. `--latest` → all `latest`. */
+export declare function resolveImageTags(useLatest: boolean): ComponentImageTags;

package/lib/cli/src/config/release.config.js

@@ -0,0 +1,38 @@
+"use strict";
+/**
+ * Release manifest — single source of truth for the versions Flui pins at
+ * install time. Bumped by hand on each CLI release.
+ *
+ * As long as the installed CLI stays at this version, every component a fresh
+ * cluster receives is pinned: the bootstrap scripts/manifests (a git ref on
+ * flui-cloud/bootstrap-scripts) and the Docker image tags injected into the
+ * cluster. `flui env create --latest` opts back into the mobile dev behaviour
+ * (bootstrap ref `master`, `:latest` image tags).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RELEASE = void 0;
+exports.resolveBootstrapRef = resolveBootstrapRef;
+exports.resolveImageTags = resolveImageTags;
+exports.RELEASE = {
+    version: '0.5.0',
+    bootstrapRef: 'v0.5.0',
+    images: {
+        fluiApi: '0.5.0',
+        fluiWeb: '0.5.0',
+        fluiAuthz: '0.5.0',
+    },
+};
+const LATEST_BOOTSTRAP_REF = 'master';
+const LATEST_IMAGE_TAGS = {
+    fluiApi: 'latest',
+    fluiWeb: 'latest',
+    fluiAuthz: 'latest',
+};
+/** Bootstrap-scripts git ref to install from. `--latest` → `master`. */
+function resolveBootstrapRef(useLatest) {
+    return useLatest ? LATEST_BOOTSTRAP_REF : exports.RELEASE.bootstrapRef;
+}
+/** Docker image tags to deploy. `--latest` → all `latest`. */
+function resolveImageTags(useLatest) {
+    return useLatest ? { ...LATEST_IMAGE_TAGS } : { ...exports.RELEASE.images };
+}

package/lib/cli/src/lib/prompts.d.ts

@@ -15,12 +15,7 @@ export declare function selectWithArrows(title: string, items: ArrowSelectItem[]
  * Supports both typing and paste (Cmd+V), including bracketed paste mode.
  */
 export declare function promptMaskedInput(message: string): Promise<string>;
-/**
- * Interactive provider setup wizard.
- * Shows arrow-key provider selection, prompts for token, saves to ConfigStorage.
- * Returns true if setup completed successfully, false if cancelled.
- */
-export declare function runProviderSetupWizard(): Promise<boolean>;
+export declare function runProviderSetupWizard(preselectedProviderId?: string): Promise<string | null>;
 /**
  * Prompt user for yes/no confirmation
  */

package/lib/cli/src/lib/prompts.js

@@ -226,7 +226,16 @@ async function promptMaskedInput(message) {
  * Shows arrow-key provider selection, prompts for token, saves to ConfigStorage.
  * Returns true if setup completed successfully, false if cancelled.
  */
-async function runProviderSetupWizard() {
+async function pickProviderToConfigure(preselectedProviderId) {
+    // When the target provider is already known (explicit --provider, or a
+    // single-provider profile with missing creds), configure it directly.
+    const preselected = preselectedProviderId
+        ? SUPPORTED_PROVIDERS.find((p) => p.id === preselectedProviderId && p.available)
+        : undefined;
+    if (preselected) {
+        console.log(chalk_1.default.yellow(`\n⚠  No ${preselected.label} API token configured.`));
+        return preselected;
+    }
     console.log(chalk_1.default.yellow('\n⚠  No cloud provider API token configured.'));
     const items = SUPPORTED_PROVIDERS.map((p) => ({
         label: p.label,
@@ -236,15 +245,11 @@ async function runProviderSetupWizard() {
     const index = await selectWithArrows('Select a provider to configure:', items);
     if (index === -1) {
         console.log(chalk_1.default.dim('\n   Cancelled. Run: flui config set hetzner YOUR_TOKEN\n'));
-        return false;
-    }
-    const selectedProvider = SUPPORTED_PROVIDERS[index];
-    const schema = (0, provider_credential_schemas_1.getCredentialSchema)(selectedProvider.id);
-    if (!schema) {
-        console.log(chalk_1.default.red(`\n   Missing credential schema for ${selectedProvider.label}\n`));
-        return false;
+        return null;
     }
-    console.log(chalk_1.default.dim(`\n   Enter your ${selectedProvider.label} credentials below.\n   They will be stored encrypted on disk.\n`));
+    return SUPPORTED_PROVIDERS[index];
+}
+async function collectProviderCredentials(schema) {
     const collected = {};
     for (const field of schema.fields) {
         const label = `   ${field.label}`;
@@ -255,17 +260,32 @@ async function runProviderSetupWizard() {
             })).trim();
         if (!value.trim()) {
             console.log(chalk_1.default.red(`\n   ${field.label} is required. Setup cancelled.\n`));
-            return false;
+            return null;
         }
         collected[field.key] = value.trim();
     }
+    return collected;
+}
+async function runProviderSetupWizard(preselectedProviderId) {
+    const selectedProvider = await pickProviderToConfigure(preselectedProviderId);
+    if (!selectedProvider)
+        return null;
+    const schema = (0, provider_credential_schemas_1.getCredentialSchema)(selectedProvider.id);
+    if (!schema) {
+        console.log(chalk_1.default.red(`\n   Missing credential schema for ${selectedProvider.label}\n`));
+        return null;
+    }
+    console.log(chalk_1.default.dim(`\n   Enter your ${selectedProvider.label} credentials below.\n   They will be stored encrypted on disk.\n`));
+    const collected = await collectProviderCredentials(schema);
+    if (!collected)
+        return null;
     if (selectedProvider.id === 'scaleway') {
         process.stdout.write(chalk_1.default.dim('\n   Validating credentials with Scaleway IAM...'));
         const result = await (0, scaleway_validator_1.validateScalewayCredentials)(collected.accessKey, collected.secretKey);
         process.stdout.write('\r\u001B[2K');
         if (!result.success) {
             console.log(chalk_1.default.red(`   ✖ ${result.message}\n`));
-            return false;
+            return null;
         }
         console.log(chalk_1.default.green(`   ✔ ${result.message}`));
     }
@@ -278,11 +298,11 @@ async function runProviderSetupWizard() {
             storage.saveToken(selectedProvider.id, collected[schema.fields[0].key]);
         }
         console.log(chalk_1.default.green(`\n   ✔ ${selectedProvider.label} credentials saved (AES-256-GCM encrypted)\n`));
-        return true;
+        return selectedProvider.id;
     }
     catch (err) {
         console.log(chalk_1.default.red(`\n   Failed to save credentials: ${err instanceof Error ? err.message : String(err)}\n`));
-        return false;
+        return null;
     }
 }
 /**