@flui-cloud/cli 0.0.1

package/lib/cli/src/commands/cluster/destroy.js

@@ -0,0 +1,137 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const chalk_1 = __importDefault(require("chalk"));
+const ora_1 = __importDefault(require("ora"));
+const api_client_1 = require("../../lib/api-client");
+const config_storage_1 = require("../../lib/config-storage");
+const resolve_cluster_1 = require("../../lib/resolve-cluster");
+const prompts_1 = require("../../lib/prompts");
+const POLL_INTERVAL_MS = 5000;
+const MAX_WAIT_MS = 600_000;
+class ClusterDestroy extends core_1.Command {
+    async run() {
+        const { args, flags } = await this.parse(ClusterDestroy);
+        const configStorage = new config_storage_1.ConfigStorage();
+        const apiUrl = configStorage.getApiUrlOrThrow();
+        const apiKey = configStorage.getApiKey();
+        if (!apiKey) {
+            this.error('Not logged in. Run `flui auth login` first.', { exit: 1 });
+        }
+        let resolved;
+        try {
+            resolved = await (0, resolve_cluster_1.resolveCluster)(args.cluster);
+        }
+        catch (error) {
+            this.error(error.message, { exit: 1 });
+        }
+        const { id: clusterId, name: clusterName, entity } = resolved;
+        if (entity.metadata?.isObservabilityCluster) {
+            this.error(`"${clusterName}" is the observability cluster. Use \`flui env destroy\` instead.`, { exit: 1 });
+        }
+        console.log(chalk_1.default.red('\n⚠️  DESTROY Workload Cluster\n'));
+        console.log(`  ${chalk_1.default.bold('Name:')}    ${clusterName}`);
+        console.log(`  ${chalk_1.default.bold('ID:')}      ${clusterId}`);
+        console.log(`  ${chalk_1.default.bold('Status:')}  ${entity.status}`);
+        console.log(`  ${chalk_1.default.bold('Region:')}  ${entity.region}`);
+        console.log(`  ${chalk_1.default.bold('Nodes:')}   ${entity.nodeCount}`);
+        console.log(chalk_1.default.red('\n  ⚠️  ALL DATA WILL BE PERMANENTLY LOST!\n'));
+        if (!flags.force) {
+            console.log(chalk_1.default.yellow(`  To confirm, type the cluster name exactly: ${chalk_1.default.bold(clusterName)}`));
+            const confirmed = await (0, prompts_1.confirmByTypingPrompt)(chalk_1.default.yellow('  Cluster name'), clusterName);
+            if (!confirmed) {
+                console.log(chalk_1.default.green('\n  Deletion cancelled (name did not match)\n'));
+                return;
+            }
+        }
+        const spinner = (0, ora_1.default)('Queuing cluster deletion...').start();
+        const apiClient = new api_client_1.ApiClient({ baseUrl: apiUrl, apiKey: apiKey });
+        let operationId;
+        try {
+            const result = await apiClient.delete(`/infrastructure/clusters/${clusterId}`);
+            operationId = result.operation_id;
+            spinner.succeed('Deletion queued');
+            console.log('');
+            console.log(`  ${chalk_1.default.bold('Operation ID:')} ${operationId}`);
+            console.log(`  ${chalk_1.default.bold('Estimated:')}    ${result.estimated_duration}`);
+            console.log('');
+        }
+        catch (error) {
+            spinner.fail('Failed to queue deletion');
+            const msg = error.response?.data?.message ?? error.message;
+            console.log(chalk_1.default.red(`\n  Error: ${msg}\n`));
+            this.exit(1);
+        }
+        if (flags['no-wait']) {
+            console.log(chalk_1.default.dim('  Use `flui node list --cluster <name>` to check status.\n'));
+            return;
+        }
+        await this.waitForDeletion(apiClient, operationId, clusterName);
+    }
+    async waitForDeletion(apiClient, operationId, clusterName) {
+        console.log(chalk_1.default.dim(`  Waiting for deletion to complete (up to ${MAX_WAIT_MS / 60000} min)…`));
+        const waitSpinner = (0, ora_1.default)('Deleting cluster…').start();
+        const started = Date.now();
+        while (Date.now() - started < MAX_WAIT_MS) {
+            await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
+            const done = await this.pollOperation(apiClient, operationId, clusterName, waitSpinner);
+            if (done)
+                return;
+        }
+        waitSpinner.warn('Timed out waiting for deletion');
+        console.log(chalk_1.default.yellow(`\n  Operation is still running. Check status with:`));
+        console.log(chalk_1.default.dim(`    flui node list --cluster ${clusterName}\n`));
+    }
+    async pollOperation(apiClient, operationId, clusterName, waitSpinner) {
+        try {
+            const op = await apiClient.get(`/infrastructure/operations/${operationId}`);
+            const pct = op.totalSteps > 0
+                ? Math.round((op.currentStepIndex / op.totalSteps) * 100)
+                : 0;
+            waitSpinner.text = `Deleting cluster… ${pct}% (step ${op.currentStepIndex}/${op.totalSteps})`;
+            if (op.status === 'COMPLETED') {
+                waitSpinner.succeed(chalk_1.default.green(`Cluster "${clusterName}" destroyed`));
+                console.log('');
+                console.log(chalk_1.default.dim('  All nodes and associated resources have been removed.\n'));
+                return true;
+            }
+            if (op.status === 'FAILED') {
+                waitSpinner.fail('Deletion failed');
+                const msg = op.metadata?.error ?? 'Unknown error';
+                console.log(chalk_1.default.red(`\n  Error: ${msg}\n`));
+                this.exit(1);
+            }
+        }
+        catch {
+            /* polling error — keep trying */
+        }
+        return false;
+    }
+}
+ClusterDestroy.description = 'Permanently destroy a workload cluster and all its nodes. For the observability cluster use `flui env destroy`.';
+ClusterDestroy.examples = [
+    '<%= config.bin %> <%= command.id %> my-workload-cluster',
+    '<%= config.bin %> <%= command.id %> my-workload-cluster --force',
+    '<%= config.bin %> <%= command.id %> my-workload-cluster --no-wait',
+];
+ClusterDestroy.args = {
+    cluster: core_1.Args.string({
+        description: 'Cluster name or ID to destroy',
+        required: true,
+    }),
+};
+ClusterDestroy.flags = {
+    force: core_1.Flags.boolean({
+        char: 'f',
+        description: 'Skip confirmation prompt',
+        default: false,
+    }),
+    'no-wait': core_1.Flags.boolean({
+        description: 'Return immediately after queuing deletion',
+        default: false,
+    }),
+};
+exports.default = ClusterDestroy;

package/lib/cli/src/commands/config/get.d.ts

@@ -0,0 +1,9 @@
+import { Command } from '@oclif/core';
+export default class ConfigGet extends Command {
+    static readonly description = "Print the resolved value of a preference (and the layer it came from). Provider tokens are not printable for security \u2014 use `flui config list` to see which providers are configured.";
+    static readonly examples: string[];
+    static readonly args: {
+        key: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    run(): Promise<void>;
+}

package/lib/cli/src/commands/config/get.js

@@ -0,0 +1,47 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const chalk_1 = __importDefault(require("chalk"));
+const config_storage_1 = require("../../lib/config-storage");
+const key_router_1 = require("../../config/key-router");
+const preferences_resolver_1 = require("../../config/preferences-resolver");
+class ConfigGet extends core_1.Command {
+    async run() {
+        const { args } = await this.parse(ConfigGet);
+        const kind = (0, key_router_1.classifyKey)(args.key);
+        if (kind === 'provider') {
+            console.log(chalk_1.default.yellow(`\n'${args.key}' is a provider token; tokens are encrypted and not printable.`));
+            console.log(chalk_1.default.gray('Use `flui config list --tokens` instead.\n'));
+            return;
+        }
+        if (kind === 'unknown') {
+            console.log(chalk_1.default.red(`\nUnknown configuration key: '${args.key}'\n`));
+            console.log((0, key_router_1.formatKnownKeys)());
+            console.log();
+            this.exit(1);
+        }
+        const resolver = new preferences_resolver_1.PreferencesResolver(new config_storage_1.ConfigStorage());
+        const resolved = resolver.resolve(args.key);
+        if (resolved.value === null) {
+            console.log(chalk_1.default.yellow(`\n'${args.key}' is not set (no value at any layer)\n`));
+            return;
+        }
+        const sourceLabel = chalk_1.default.dim(`(source: ${resolved.source})`);
+        console.log(`${chalk_1.default.bold(args.key)} = ${resolved.value}  ${sourceLabel}`);
+    }
+}
+ConfigGet.description = 'Print the resolved value of a preference (and the layer it came from). Provider tokens are not printable for security — use `flui config list` to see which providers are configured.';
+ConfigGet.examples = [
+    '<%= config.bin %> <%= command.id %> email',
+    '<%= config.bin %> <%= command.id %> certificateMode',
+];
+ConfigGet.args = {
+    key: core_1.Args.string({
+        required: true,
+        description: 'Preference key',
+    }),
+};
+exports.default = ConfigGet;

package/lib/cli/src/commands/config/list.d.ts

@@ -0,0 +1,15 @@
+import { Command } from '@oclif/core';
+export default class ConfigList extends Command {
+    static readonly description = "List configured provider tokens and resolved preferences (with their source).";
+    static readonly examples: string[];
+    static readonly flags: {
+        verbose: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        tokens: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        preferences: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+    private printTokens;
+    private printPreferences;
+    private formatDate;
+    private getTimeAgo;
+}

package/lib/cli/src/commands/config/list.js

@@ -0,0 +1,109 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const chalk_1 = __importDefault(require("chalk"));
+const config_storage_1 = require("../../lib/config-storage");
+const preferences_resolver_1 = require("../../config/preferences-resolver");
+const preferences_echo_1 = require("../../config/preferences-echo");
+class ConfigList extends core_1.Command {
+    async run() {
+        const { flags } = await this.parse(ConfigList);
+        const showAll = !flags.tokens && !flags.preferences;
+        try {
+            const storage = new config_storage_1.ConfigStorage();
+            if (flags.tokens || showAll) {
+                this.printTokens(storage, flags.verbose);
+            }
+            if (flags.preferences || showAll) {
+                this.printPreferences(storage);
+            }
+            console.log(chalk_1.default.gray(`Storage: ${storage.getConfigPath()}`));
+            console.log(chalk_1.default.gray('Encryption: AES-256-GCM (tokens only)\n'));
+        }
+        catch (error) {
+            console.log(chalk_1.default.red('\nFailed to list configuration'));
+            console.log(chalk_1.default.gray(`Error: ${error instanceof Error ? error.message : String(error)}\n`));
+            this.exit(1);
+        }
+    }
+    printTokens(storage, verbose) {
+        const providers = storage.listProviders();
+        if (providers.length === 0) {
+            console.log(chalk_1.default.yellow('\nNo provider tokens configured'));
+            console.log(chalk_1.default.gray('Configure one: flui config set <provider> <token>'));
+            return;
+        }
+        console.log(chalk_1.default.green(`\nProvider tokens (${providers.length}):\n`));
+        for (const provider of providers) {
+            const meta = storage.getTokenMetadata(provider);
+            if (!meta) {
+                console.log(`  ${chalk_1.default.red('✗')} ${provider} ${chalk_1.default.gray('(no metadata)')}`);
+                continue;
+            }
+            const updatedAgo = this.getTimeAgo(new Date(), new Date(meta.updatedAt));
+            console.log(`  ${chalk_1.default.green('✓')} ${chalk_1.default.bold(provider)}`);
+            if (verbose) {
+                console.log(chalk_1.default.gray(`    Created: ${this.formatDate(new Date(meta.createdAt))}`));
+                console.log(chalk_1.default.gray(`    Updated: ${this.formatDate(new Date(meta.updatedAt))} (${updatedAgo})`));
+            }
+            else {
+                console.log(chalk_1.default.gray(`    Configured ${updatedAgo}`));
+            }
+        }
+    }
+    printPreferences(storage) {
+        const resolver = new preferences_resolver_1.PreferencesResolver(storage);
+        (0, preferences_echo_1.echoPreferences)(resolver.resolveAll(), resolver);
+    }
+    formatDate(date) {
+        return date.toLocaleString('en-US', {
+            year: 'numeric',
+            month: 'short',
+            day: 'numeric',
+            hour: '2-digit',
+            minute: '2-digit',
+        });
+    }
+    getTimeAgo(now, past) {
+        const diffMs = now.getTime() - past.getTime();
+        const minutes = Math.floor(diffMs / 60_000);
+        const hours = Math.floor(minutes / 60);
+        const days = Math.floor(hours / 24);
+        if (minutes < 1)
+            return 'just now';
+        if (minutes < 60)
+            return `${minutes} minute${minutes > 1 ? 's' : ''} ago`;
+        if (hours < 24)
+            return `${hours} hour${hours > 1 ? 's' : ''} ago`;
+        if (days < 30)
+            return `${days} day${days > 1 ? 's' : ''} ago`;
+        const months = Math.floor(days / 30);
+        return `${months} month${months > 1 ? 's' : ''} ago`;
+    }
+}
+ConfigList.description = 'List configured provider tokens and resolved preferences (with their source).';
+ConfigList.examples = [
+    '<%= config.bin %> <%= command.id %>',
+    '<%= config.bin %> <%= command.id %> --tokens',
+    '<%= config.bin %> <%= command.id %> --preferences',
+    '<%= config.bin %> <%= command.id %> --verbose',
+];
+ConfigList.flags = {
+    verbose: core_1.Flags.boolean({
+        char: 'v',
+        description: 'Show detailed information including timestamps',
+        default: false,
+    }),
+    tokens: core_1.Flags.boolean({
+        description: 'Show only provider tokens',
+        default: false,
+    }),
+    preferences: core_1.Flags.boolean({
+        description: 'Show only resolved preferences',
+        default: false,
+    }),
+};
+exports.default = ConfigList;

package/lib/cli/src/commands/config/remove.d.ts

@@ -0,0 +1,12 @@
+import { Command } from '@oclif/core';
+export default class ConfigRemove extends Command {
+    static readonly description = "Remove a stored preference or an encrypted provider token. Dispatch is schema-driven by key name.";
+    static readonly examples: string[];
+    static readonly args: {
+        key: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static readonly flags: {
+        force: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/lib/cli/src/commands/config/remove.js

@@ -0,0 +1,92 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const chalk_1 = __importDefault(require("chalk"));
+const config_storage_1 = require("../../lib/config-storage");
+const prompts_1 = require("../../lib/prompts");
+const key_router_1 = require("../../config/key-router");
+class ConfigRemove extends core_1.Command {
+    async run() {
+        const { args, flags } = await this.parse(ConfigRemove);
+        try {
+            const storage = new config_storage_1.ConfigStorage();
+            const kind = (0, key_router_1.classifyKey)(args.key);
+            if (kind === 'unknown') {
+                console.log(chalk_1.default.red(`\nUnknown configuration key: '${args.key}'\n`));
+                console.log((0, key_router_1.formatKnownKeys)());
+                console.log();
+                this.exit(1);
+            }
+            if (kind === 'system') {
+                if (args.key.toLowerCase() === 'api-url') {
+                    storage.removeApiUrl();
+                    console.log(chalk_1.default.green(`\nAPI URL removed`));
+                    console.log(chalk_1.default.gray(`Location: ${storage.getConfigPath()}\n`));
+                }
+                return;
+            }
+            if (kind === 'preference') {
+                const key = args.key;
+                if (storage.getPreference(key) === null) {
+                    console.log(chalk_1.default.yellow(`\nPreference '${key}' is not set\n`));
+                    return;
+                }
+                storage.removePreference(key);
+                console.log(chalk_1.default.green(`\nRemoved preference: ${key}`));
+                console.log(chalk_1.default.gray(`Location: ${storage.getConfigPath()}\n`));
+                return;
+            }
+            // provider
+            const provider = args.key.toLowerCase();
+            const hasToken = storage.hasToken(provider);
+            const hasCreds = storage.hasCredentials(provider);
+            if (!hasToken && !hasCreds) {
+                console.log(chalk_1.default.yellow(`\nProvider '${provider}' is not configured`));
+                console.log(chalk_1.default.gray("Use 'flui config list' to see configured providers\n"));
+                return;
+            }
+            if (!flags.force) {
+                console.log(chalk_1.default.yellow(`\nWarning: This will remove the credentials for '${provider}'`));
+                const confirmed = await (0, prompts_1.confirmByTypingPrompt)(chalk_1.default.gray(`Type '${provider}' to confirm`), provider);
+                if (!confirmed) {
+                    console.log(chalk_1.default.gray('\nCancelled\n'));
+                    return;
+                }
+            }
+            if (hasToken)
+                storage.removeToken(provider);
+            if (hasCreds)
+                storage.removeCredentials(provider);
+            console.log(chalk_1.default.green(`\nRemoved configuration for: ${provider}`));
+            console.log(chalk_1.default.gray(`Location: ${storage.getConfigPath()}\n`));
+        }
+        catch (error) {
+            console.log(chalk_1.default.red('\nFailed to remove configuration'));
+            console.log(chalk_1.default.gray(`Error: ${error instanceof Error ? error.message : String(error)}\n`));
+            this.exit(1);
+        }
+    }
+}
+ConfigRemove.description = 'Remove a stored preference or an encrypted provider token. Dispatch is schema-driven by key name.';
+ConfigRemove.examples = [
+    '<%= config.bin %> <%= command.id %> hetzner',
+    '<%= config.bin %> <%= command.id %> email',
+    '<%= config.bin %> <%= command.id %> scaleway --force',
+];
+ConfigRemove.args = {
+    key: core_1.Args.string({
+        required: true,
+        description: 'Configuration key (preference name or provider name)',
+    }),
+};
+ConfigRemove.flags = {
+    force: core_1.Flags.boolean({
+        char: 'f',
+        description: 'Skip confirmation prompt',
+        default: false,
+    }),
+};
+exports.default = ConfigRemove;

package/lib/cli/src/commands/config/set.d.ts

@@ -0,0 +1,15 @@
+import { Command } from '@oclif/core';
+export default class ConfigSet extends Command {
+    static readonly description = "Set a configuration value. The key determines whether it is stored as a non-secret preference (e.g. email, certificateMode) or as an encrypted provider token (e.g. hetzner).";
+    static readonly examples: string[];
+    static readonly args: {
+        key: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        value: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    run(): Promise<void>;
+    private setPreference;
+    private setProvider;
+    private setCompoundProvider;
+    private setSystem;
+    private failUnknown;
+}

package/lib/cli/src/commands/config/set.js

@@ -0,0 +1,152 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const chalk_1 = __importDefault(require("chalk"));
+const config_storage_1 = require("../../lib/config-storage");
+const key_router_1 = require("../../config/key-router");
+const preferences_schema_1 = require("../../config/preferences-schema");
+const preferences_resolver_1 = require("../../config/preferences-resolver");
+const provider_credential_schemas_1 = require("../../lib/provider-credential-schemas");
+const prompts_1 = require("../../lib/prompts");
+const scaleway_validator_1 = require("../../lib/scaleway-validator");
+class ConfigSet extends core_1.Command {
+    async run() {
+        const { args } = await this.parse(ConfigSet);
+        try {
+            const storage = new config_storage_1.ConfigStorage();
+            const kind = (0, key_router_1.classifyKey)(args.key);
+            switch (kind) {
+                case 'preference':
+                    if (!args.value) {
+                        console.log(chalk_1.default.red(`\nMissing value for preference '${args.key}'\n`));
+                        this.exit(1);
+                    }
+                    this.setPreference(storage, args.key, args.value);
+                    return;
+                case 'provider':
+                    await this.setProvider(storage, args.key.toLowerCase(), args.value);
+                    return;
+                case 'system':
+                    if (!args.value) {
+                        console.log(chalk_1.default.red(`\nMissing value for '${args.key}'\n`));
+                        this.exit(1);
+                    }
+                    this.setSystem(storage, args.key.toLowerCase(), args.value);
+                    return;
+                case 'unknown':
+                    this.failUnknown(args.key);
+                    return;
+            }
+        }
+        catch (error) {
+            console.log(chalk_1.default.red('\nFailed to save configuration'));
+            console.log(chalk_1.default.gray(`Error: ${error instanceof Error ? error.message : String(error)}\n`));
+            this.exit(1);
+        }
+    }
+    setPreference(storage, key, value) {
+        const validationError = preferences_resolver_1.PreferencesResolver.validate(key, value);
+        if (validationError) {
+            console.log(chalk_1.default.red(`\nInvalid value for '${key}': ${validationError}\n`));
+            this.exit(1);
+        }
+        storage.setPreference(key, value);
+        console.log(chalk_1.default.green(`\nPreference saved: ${key} = ${value}`));
+        console.log(chalk_1.default.gray(`Location: ${storage.getConfigPath()}`));
+        console.log(chalk_1.default.gray(`Description: ${preferences_schema_1.PREFERENCES[key].description}\n`));
+    }
+    async setProvider(storage, provider, value) {
+        const schema = (0, provider_credential_schemas_1.getCredentialSchema)(provider);
+        if ((0, provider_credential_schemas_1.isCompoundProvider)(provider)) {
+            if (value) {
+                console.log(chalk_1.default.red(`\n'${provider}' requires an Access Key + Secret Key pair — pass no value and enter them interactively.\n`));
+                this.exit(1);
+            }
+            await this.setCompoundProvider(storage, provider, schema);
+            return;
+        }
+        if (!value) {
+            console.log(chalk_1.default.red(`\nMissing token for provider '${provider}'\n`));
+            this.exit(1);
+        }
+        storage.saveToken(provider, value);
+        console.log(chalk_1.default.green(`\nProvider configured: ${provider}`));
+        console.log(chalk_1.default.gray(`Location: ${storage.getConfigPath()}`));
+        console.log(chalk_1.default.gray('Encryption: AES-256-GCM\n'));
+        console.log(chalk_1.default.gray(`Next: flui env create\n`));
+    }
+    async setCompoundProvider(storage, provider, schema) {
+        console.log(chalk_1.default.dim(`\nEnter ${provider} credentials. Values are stored AES-256-GCM encrypted.\n`));
+        const collected = {};
+        for (const field of schema.fields) {
+            const hintLabel = field.hint ? chalk_1.default.dim(` (${field.hint})`) : '';
+            const value = field.secret
+                ? await (0, prompts_1.promptMaskedInput)(`  ${field.label}`)
+                : (await (0, prompts_1.promptInput)({
+                    message: `  ${field.label}${hintLabel}`,
+                })).trim();
+            if (!value.trim()) {
+                console.log(chalk_1.default.red(`\n${field.label} is required.\n`));
+                this.exit(1);
+            }
+            collected[field.key] = value.trim();
+        }
+        if (provider === 'scaleway') {
+            process.stdout.write(chalk_1.default.dim('\nValidating credentials...'));
+            const result = await (0, scaleway_validator_1.validateScalewayCredentials)(collected.accessKey, collected.secretKey);
+            process.stdout.write('\r\u001B[2K');
+            if (!result.success) {
+                console.log(chalk_1.default.red(`✖ ${result.message}\n`));
+                this.exit(1);
+            }
+            console.log(chalk_1.default.green(`✔ ${result.message}`));
+        }
+        storage.saveCredentials(provider, collected);
+        console.log(chalk_1.default.green(`\nProvider configured: ${provider}`));
+        console.log(chalk_1.default.gray(`Location: ${storage.getConfigPath()}`));
+        console.log(chalk_1.default.gray('Encryption: AES-256-GCM\n'));
+        console.log(chalk_1.default.gray(`Next: flui env create\n`));
+    }
+    setSystem(storage, key, value) {
+        if (key === 'api-url') {
+            try {
+                new URL(value);
+            }
+            catch {
+                console.log(chalk_1.default.red(`\nInvalid URL: ${value}\n`));
+                this.exit(1);
+            }
+            storage.saveApiUrl(value);
+            console.log(chalk_1.default.green(`\nAPI URL saved: ${value}`));
+            console.log(chalk_1.default.gray(`Location: ${storage.getConfigPath()}\n`));
+            return;
+        }
+        this.failUnknown(key);
+    }
+    failUnknown(key) {
+        console.log(chalk_1.default.red(`\nUnknown configuration key: '${key}'\n`));
+        console.log((0, key_router_1.formatKnownKeys)());
+        console.log();
+        this.exit(1);
+    }
+}
+ConfigSet.description = 'Set a configuration value. The key determines whether it is stored as a non-secret preference (e.g. email, certificateMode) or as an encrypted provider token (e.g. hetzner).';
+ConfigSet.examples = [
+    '<%= config.bin %> <%= command.id %> hetzner YOUR_API_TOKEN',
+    '<%= config.bin %> <%= command.id %> email you@example.com',
+    '<%= config.bin %> <%= command.id %> certificateMode preflight',
+];
+ConfigSet.args = {
+    key: core_1.Args.string({
+        required: true,
+        description: 'Configuration key (preference name or provider name)',
+    }),
+    value: core_1.Args.string({
+        required: false,
+        description: 'Value to store. Omit for compound providers (e.g. scaleway) to enter values interactively.',
+    }),
+};
+exports.default = ConfigSet;

package/lib/cli/src/commands/config/show.d.ts

@@ -0,0 +1,6 @@
+import { Command } from '@oclif/core';
+export default class ConfigShow extends Command {
+    static readonly description = "Show every preference resolved through the layered config (flag > env > project > user > default). Useful for debugging where a value is coming from.";
+    static readonly examples: string[];
+    run(): Promise<void>;
+}

package/lib/cli/src/commands/config/show.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const config_storage_1 = require("../../lib/config-storage");
+const preferences_resolver_1 = require("../../config/preferences-resolver");
+const preferences_echo_1 = require("../../config/preferences-echo");
+class ConfigShow extends core_1.Command {
+    async run() {
+        const resolver = new preferences_resolver_1.PreferencesResolver(new config_storage_1.ConfigStorage());
+        (0, preferences_echo_1.echoPreferences)(resolver.resolveAll(), resolver);
+    }
+}
+ConfigShow.description = 'Show every preference resolved through the layered config (flag > env > project > user > default). Useful for debugging where a value is coming from.';
+ConfigShow.examples = ['<%= config.bin %> <%= command.id %>'];
+exports.default = ConfigShow;

package/lib/cli/src/commands/context/create.d.ts

@@ -0,0 +1,12 @@
+import { Command } from '@oclif/core';
+export default class ContextCreate extends Command {
+    static readonly description = "Create a new profile";
+    static readonly examples: string[];
+    static readonly args: {
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static readonly flags: {
+        switch: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}