@flui-cloud/cli 0.0.1

package/lib/cli/src/commands/dev/creds.js

@@ -0,0 +1,290 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const chalk_1 = __importDefault(require("chalk"));
+const ora_1 = __importDefault(require("ora"));
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const os = __importStar(require("node:os"));
+const nest_app_1 = require("../../lib/nest-app");
+const cli_observability_cluster_service_1 = require("../../services/cli-observability-cluster.service");
+const cli_ssh_service_1 = require("../../services/cli-ssh.service");
+const config_storage_1 = require("../../lib/config-storage");
+const encryption_service_1 = require("../../../../src/modules/shared/encryption/services/encryption.service");
+const cluster_entity_1 = require("../../../../src/modules/infrastructure/clusters/entities/cluster.entity");
+const env_file_1 = require("../../lib/utils/env-file");
+const preferences_resolver_1 = require("../../config/preferences-resolver");
+const prompts_1 = require("../../lib/prompts");
+const preferences_schema_1 = require("../../config/preferences-schema");
+class DevCreds extends core_1.Command {
+    async run() {
+        const { flags } = await this.parse(DevCreds);
+        let spinner = (0, ora_1.default)('Reading cluster configuration...').start();
+        try {
+            const app = await (0, nest_app_1.getNestApp)();
+            const observabilityService = app.get(cli_observability_cluster_service_1.CliObservabilityClusterService);
+            const encryptionService = app.get(encryption_service_1.EncryptionService);
+            const sshService = app.get(cli_ssh_service_1.CliSshService);
+            const cluster = await observabilityService.getObservabilityCluster();
+            if (!cluster) {
+                spinner.fail('No observability cluster found');
+                return;
+            }
+            if (cluster.status !== cluster_entity_1.ClusterStatus.READY) {
+                spinner.fail(`Cluster not ready (status: ${cluster.status})`);
+                return;
+            }
+            const masterIp = cluster.masterIpAddress;
+            if (!masterIp) {
+                spinner.fail('Master IP address not available');
+                return;
+            }
+            spinner.succeed('Cluster ready');
+            // Stack passwords (Postgres, Redis, Grafana) from DB metadata.
+            spinner = (0, ora_1.default)('Resolving stack passwords...').start();
+            const passwords = this.resolveStackPasswords(cluster, encryptionService);
+            if (!passwords) {
+                spinner.fail('Stack passwords not available in cluster metadata');
+                return;
+            }
+            spinner.succeed('Stack passwords resolved');
+            // flui-secrets via SSH + kubectl on the master (avoids needing kube-API
+            // open or a running tunnel). Falls back gracefully if the secret is missing.
+            spinner = (0, ora_1.default)('Reading flui-secrets via SSH...').start();
+            const fluiSecrets = await this.readFluiSecrets(sshService, masterIp);
+            spinner.succeed('flui-secrets read');
+            // OIDC issuer from flui-api-config — used to point local API at the
+            // public Zitadel admin URL instead of the in-cluster service DNS.
+            spinner = (0, ora_1.default)('Reading OIDC issuer from flui-api-config...').start();
+            const oidcIssuer = await this.readOidcIssuer(sshService, masterIp);
+            if (oidcIssuer)
+                spinner.succeed(`OIDC issuer: ${oidcIssuer}`);
+            else
+                spinner.warn('OIDC issuer not found in flui-api-config');
+            // Local encryption key — shared with API via ~/.flui/encryption.key.
+            const encryptionKeyPath = path.join(os.homedir(), '.flui', 'encryption.key');
+            const encryptionKey = fs.existsSync(encryptionKeyPath)
+                ? fs.readFileSync(encryptionKeyPath, 'utf-8').trim()
+                : '';
+            const apiPath = await this.resolveApiPath(flags['api-path'], flags.save);
+            const apiDir = path.isAbsolute(apiPath)
+                ? apiPath
+                : path.resolve(process.cwd(), apiPath);
+            const envLocalPath = path.join(apiDir, '.env.local');
+            const envVars = this.buildEnvVars({
+                passwords,
+                encryptionKey,
+                fluiSecrets,
+                oidcIssuer,
+            });
+            this.printSummary(envLocalPath, envVars);
+            if (fluiSecrets.fluiApiKey) {
+                // Mirror existing export-config behavior: keep ~/.flui/config.json
+                // in sync so that `flui` commands can call the API right away.
+                new config_storage_1.ConfigStorage().setApiKey(fluiSecrets.fluiApiKey);
+            }
+            if (flags['dry-run']) {
+                console.log(chalk_1.default.yellow('🔍 Dry run — .env.local not modified\n'));
+                return;
+            }
+            this.writeEnvFile(envLocalPath, apiDir, envVars, !!flags.backup);
+            console.log(chalk_1.default.green(`\n✅ Wrote secrets to ${envLocalPath}\n`));
+            console.log(chalk_1.default.dim('Next steps:'));
+            console.log(`   1. ${chalk_1.default.cyan('flui dev tunnel')}  (in another terminal)`);
+            console.log(`   2. ${chalk_1.default.cyan('pnpm start:dev')}\n`);
+        }
+        catch (error) {
+            spinner.fail('Error writing dev credentials');
+            console.error(chalk_1.default.red(`\n❌ ${error.message}\n`));
+            this.exit(1);
+        }
+        finally {
+            await (0, nest_app_1.closeNestApp)();
+        }
+    }
+    resolveStackPasswords(cluster, encryptionService) {
+        const metadata = (cluster.metadata ?? {});
+        const stack = metadata.observabilityStack?.passwords;
+        if (stack)
+            return stack;
+        if (metadata.postgresPasswordEncrypted &&
+            metadata.redisPasswordEncrypted &&
+            metadata.grafanaPasswordEncrypted) {
+            try {
+                return {
+                    postgres: encryptionService.decrypt(metadata.postgresPasswordEncrypted),
+                    redis: encryptionService.decrypt(metadata.redisPasswordEncrypted),
+                    grafana: encryptionService.decrypt(metadata.grafanaPasswordEncrypted),
+                };
+            }
+            catch {
+                return null;
+            }
+        }
+        return null;
+    }
+    buildEnvVars(opts) {
+        const { passwords, encryptionKey, fluiSecrets, oidcIssuer } = opts;
+        const envVars = {
+            DB_PASSWORD: passwords.postgres,
+            REDIS_PASSWORD: passwords.redis,
+            GRAFANA_ADMIN_PASSWORD: passwords.grafana,
+        };
+        if (encryptionKey)
+            envVars.ENCRYPTION_KEY = encryptionKey;
+        if (fluiSecrets.adminEmail)
+            envVars.ADMIN_EMAIL = fluiSecrets.adminEmail;
+        if (fluiSecrets.jwtSecret)
+            envVars.JWT_SECRET = fluiSecrets.jwtSecret;
+        if (fluiSecrets.fluiApiKey)
+            envVars.FLUI_API_KEY = fluiSecrets.fluiApiKey;
+        if (fluiSecrets.sshCaPrivateKey)
+            envVars.SSH_CA_PRIVATE_KEY = fluiSecrets.sshCaPrivateKey;
+        if (fluiSecrets.sshCaPublicKey)
+            envVars.SSH_CA_PUBLIC_KEY = fluiSecrets.sshCaPublicKey;
+        if (fluiSecrets.zitadelPat)
+            envVars.ZITADEL_SERVICE_ACCOUNT_PAT = fluiSecrets.zitadelPat;
+        if (oidcIssuer)
+            envVars.OIDC_PROVIDER_ADMIN_URL = oidcIssuer;
+        return envVars;
+    }
+    writeEnvFile(envLocalPath, apiDir, envVars, backup) {
+        let existing = '';
+        if (fs.existsSync(envLocalPath)) {
+            existing = fs.readFileSync(envLocalPath, 'utf-8');
+            if (backup) {
+                const stamp = new Date()
+                    .toISOString()
+                    .replaceAll(':', '-')
+                    .replace(/\..+/, '');
+                fs.copyFileSync(envLocalPath, `${envLocalPath}.backup.${stamp}`);
+            }
+        }
+        else {
+            existing =
+                '# Local-only secrets written by `flui dev creds`. Do NOT commit.\n';
+        }
+        const updated = (0, env_file_1.updateEnvContent)(existing, envVars);
+        fs.mkdirSync(apiDir, { recursive: true });
+        fs.writeFileSync(envLocalPath, updated, { mode: 0o600 });
+        try {
+            fs.chmodSync(envLocalPath, 0o600);
+        }
+        catch {
+            /* best-effort */
+        }
+    }
+    async readFluiSecrets(sshService, masterIp) {
+        try {
+            const raw = await sshService.sshExec(masterIp, "kubectl -n flui-system get secret flui-secrets -o jsonpath='{.data}'");
+            const data = JSON.parse(raw);
+            const decode = (v) => v ? Buffer.from(v, 'base64').toString('utf-8') : undefined;
+            return {
+                jwtSecret: decode(data.JWT_SECRET),
+                adminEmail: decode(data.ADMIN_EMAIL),
+                fluiApiKey: decode(data.FLUI_API_KEY),
+                sshCaPrivateKey: decode(data.SSH_CA_PRIVATE_KEY),
+                sshCaPublicKey: decode(data.SSH_CA_PUBLIC_KEY),
+                zitadelPat: decode(data.ZITADEL_SERVICE_ACCOUNT_PAT),
+            };
+        }
+        catch {
+            return {};
+        }
+    }
+    async readOidcIssuer(sshService, masterIp) {
+        try {
+            const raw = await sshService.sshExec(masterIp, "kubectl -n flui-system get configmap flui-api-config -o jsonpath='{.data.OIDC_ISSUER}'");
+            const trimmed = raw.trim();
+            return trimmed || undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    async resolveApiPath(explicit, save) {
+        const storage = new config_storage_1.ConfigStorage();
+        const resolver = new preferences_resolver_1.PreferencesResolver(storage);
+        const initial = resolver.resolve('apiPath', explicit);
+        if (initial.value !== null)
+            return initial.value;
+        const def = preferences_schema_1.PREFERENCES.apiPath;
+        const value = await (0, prompts_1.promptInput)({
+            message: def.description,
+            default: def.defaultValue,
+            validate: (v) => preferences_resolver_1.PreferencesResolver.validate('apiPath', v),
+        });
+        if (save)
+            storage.setPreference('apiPath', value);
+        return value;
+    }
+    printSummary(envLocalPath, envVars) {
+        console.log(chalk_1.default.cyan(`\n📋 Writing to ${envLocalPath}:\n`));
+        for (const k of Object.keys(envVars)) {
+            console.log(`   ${k}=${chalk_1.default.yellow('******')} ${chalk_1.default.dim('(hidden)')}`);
+        }
+        console.log();
+    }
+}
+DevCreds.description = 'Developer-only: write cluster secrets (DB/Redis passwords, JWT, encryption key, SSH CA) to <apiPath>/.env.local for local development.\n' +
+    '.env.local is gitignored. Run `flui dev tunnel` to expose the matching services on localhost.';
+DevCreds.examples = [
+    '<%= config.bin %> <%= command.id %>',
+    '<%= config.bin %> <%= command.id %> --dry-run',
+    '<%= config.bin %> <%= command.id %> --api-path ../flui.api',
+];
+DevCreds.flags = {
+    'dry-run': core_1.Flags.boolean({
+        description: 'Print which keys would be written without touching the file',
+        default: false,
+    }),
+    backup: core_1.Flags.boolean({
+        description: 'Create a backup of an existing .env.local before overwriting keys',
+        default: true,
+        allowNo: true,
+    }),
+    'api-path': core_1.Flags.string({
+        description: `Override resolved value for the "apiPath" preference (${preferences_schema_1.PREFERENCES.apiPath.description})`,
+    }),
+    save: core_1.Flags.boolean({
+        description: 'Persist any prompted preference value to the active profile (~/.flui/profiles/<active>/config.json).',
+        default: false,
+    }),
+};
+exports.default = DevCreds;

package/lib/cli/src/commands/dev/tunnel.d.ts

@@ -0,0 +1,15 @@
+import { Command } from '@oclif/core';
+export default class DevTunnel extends Command {
+    static readonly description: string;
+    static readonly examples: string[];
+    static readonly flags: {
+        ports: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        retry: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'kill-local': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+    private freeLocalPorts;
+    private findListeningPids;
+    private printForwardTable;
+    private buildRemoteCommand;
+}

package/lib/cli/src/commands/dev/tunnel.js

@@ -0,0 +1,268 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const chalk_1 = __importDefault(require("chalk"));
+const ora_1 = __importDefault(require("ora"));
+const node_child_process_1 = require("node:child_process");
+const node_util_1 = require("node:util");
+const execFileAsync = (0, node_util_1.promisify)(node_child_process_1.execFile);
+const nest_app_1 = require("../../lib/nest-app");
+const cli_observability_cluster_service_1 = require("../../services/cli-observability-cluster.service");
+const cli_ssh_service_1 = require("../../services/cli-ssh.service");
+const cluster_entity_1 = require("../../../../src/modules/infrastructure/clusters/entities/cluster.entity");
+const FORWARDS = {
+    postgres: {
+        name: 'postgres',
+        localPort: 5432,
+        remotePort: 5432,
+        service: 'svc/postgres',
+        namespace: 'flui-system',
+        needsKubectl: true,
+    },
+    redis: {
+        name: 'redis',
+        localPort: 6379,
+        remotePort: 6379,
+        service: 'svc/redis',
+        namespace: 'flui-system',
+        needsKubectl: true,
+    },
+    'kube-api': {
+        name: 'kube-api',
+        localPort: 6443,
+        remotePort: 6443,
+        needsKubectl: false,
+    },
+    grafana: {
+        name: 'grafana',
+        localPort: 3001,
+        remotePort: 3000,
+        service: 'svc/grafana',
+        namespace: 'flui-observability',
+        needsKubectl: true,
+    },
+    vmsingle: {
+        name: 'vmsingle',
+        localPort: 9090,
+        remotePort: 8428,
+        service: 'svc/vmsingle',
+        namespace: 'flui-observability',
+        needsKubectl: true,
+    },
+    loki: {
+        name: 'loki',
+        localPort: 3100,
+        remotePort: 3100,
+        service: 'svc/loki',
+        namespace: 'flui-observability',
+        needsKubectl: true,
+    },
+};
+class DevTunnel extends core_1.Command {
+    async run() {
+        const { flags } = await this.parse(DevTunnel);
+        const spinner = (0, ora_1.default)('Resolving cluster...').start();
+        let masterIp;
+        try {
+            const app = await (0, nest_app_1.getNestApp)();
+            const observabilityService = app.get(cli_observability_cluster_service_1.CliObservabilityClusterService);
+            const cluster = await observabilityService.getObservabilityCluster();
+            if (!cluster) {
+                spinner.fail('No observability cluster found');
+                console.log(chalk_1.default.yellow('\n⚠️  Run `flui env create` first.\n'));
+                return;
+            }
+            if (cluster.status !== cluster_entity_1.ClusterStatus.READY) {
+                spinner.fail(`Cluster not ready (status: ${cluster.status})`);
+                return;
+            }
+            masterIp = cluster.masterIpAddress ?? undefined;
+            if (!masterIp) {
+                spinner.fail('Master IP address not available');
+                return;
+            }
+            spinner.succeed(`Cluster ${cluster.name} → master ${masterIp}`);
+        }
+        catch (error) {
+            spinner.fail('Error resolving cluster');
+            console.error(chalk_1.default.red(`\n❌ ${error.message}\n`));
+            this.exit(1);
+            return;
+        }
+        const requested = flags.ports
+            .split(',')
+            .map((s) => s.trim())
+            .filter(Boolean);
+        const unknown = requested.filter((p) => !FORWARDS[p]);
+        if (unknown.length > 0) {
+            console.error(chalk_1.default.red(`\n❌ Unknown port(s): ${unknown.join(', ')}\n`));
+            console.error(chalk_1.default.dim(`Available: ${Object.keys(FORWARDS).join(', ')}\n`));
+            this.exit(1);
+            return;
+        }
+        const specs = requested.map((p) => FORWARDS[p]);
+        this.printForwardTable(specs);
+        if (flags['kill-local']) {
+            await this.freeLocalPorts(specs.map((s) => s.localPort));
+        }
+        const remoteCommand = this.buildRemoteCommand(specs);
+        const sshForwards = specs.map((s) => ({
+            localPort: s.localPort,
+            remotePort: s.localPort, // remote side listens on same port via kubectl/loopback
+        }));
+        const app = await (0, nest_app_1.getNestApp)();
+        const sshService = app.get(cli_ssh_service_1.CliSshService);
+        let attempt = 0;
+        let userExit = false;
+        const onSigint = () => {
+            userExit = true;
+        };
+        process.on('SIGINT', onSigint);
+        try {
+            while (!userExit) {
+                attempt += 1;
+                if (attempt > 1) {
+                    console.log(chalk_1.default.yellow(`\n↻ Reconnecting (attempt ${attempt})...\n`));
+                }
+                else {
+                    console.log(chalk_1.default.cyan(`\n🔌 Opening SSH tunnel to ${masterIp}. Press CTRL-C to close.\n`));
+                }
+                const result = await sshService.sshForward({
+                    host: masterIp,
+                    forwards: sshForwards,
+                    remoteCommand,
+                    expectedForwardLines: specs.filter((s) => s.needsKubectl).length,
+                    onReady: () => {
+                        console.log(chalk_1.default.green('\n✅ Tunnel up. Localhost endpoints:\n'));
+                        for (const s of specs) {
+                            console.log(`   ${s.name.padEnd(11)} → 127.0.0.1:${s.localPort}`);
+                        }
+                        console.log();
+                    },
+                });
+                if (userExit || !flags.retry)
+                    break;
+                console.log(chalk_1.default.yellow(`SSH session ended (status=${result.status}, signal=${result.signal}).`));
+                // small backoff
+                await new Promise((r) => setTimeout(r, 2000));
+            }
+        }
+        finally {
+            process.off('SIGINT', onSigint);
+            await (0, nest_app_1.closeNestApp)();
+        }
+    }
+    async freeLocalPorts(ports) {
+        for (const port of ports) {
+            const pids = await this.findListeningPids(port);
+            if (pids.length === 0)
+                continue;
+            const ownPid = process.pid;
+            const targets = pids.filter((p) => p !== ownPid);
+            if (targets.length === 0)
+                continue;
+            console.log(chalk_1.default.yellow(`⚠️  Port ${port} in use by pid(s) ${targets.join(', ')} — killing...`));
+            for (const pid of targets) {
+                try {
+                    process.kill(pid, 'SIGTERM');
+                }
+                catch {
+                    /* already gone */
+                }
+            }
+            await new Promise((r) => setTimeout(r, 400));
+            const stillThere = (await this.findListeningPids(port)).filter((p) => p !== ownPid);
+            for (const pid of stillThere) {
+                try {
+                    process.kill(pid, 'SIGKILL');
+                }
+                catch {
+                    /* already gone */
+                }
+            }
+        }
+    }
+    async findListeningPids(port) {
+        try {
+            const { stdout } = await execFileAsync('lsof', [
+                '-ti',
+                `tcp:${port}`,
+                '-sTCP:LISTEN',
+            ]);
+            return stdout
+                .split('\n')
+                .map((s) => s.trim())
+                .filter(Boolean)
+                .map((s) => Number.parseInt(s, 10))
+                .filter((n) => Number.isFinite(n));
+        }
+        catch {
+            return [];
+        }
+    }
+    printForwardTable(specs) {
+        console.log(chalk_1.default.cyan('\n📡 Forwards to open:\n'));
+        for (const s of specs) {
+            const target = s.service
+                ? `${s.namespace}/${s.service}:${s.remotePort}`
+                : `master:127.0.0.1:${s.remotePort}`;
+            console.log(`   ${s.name.padEnd(11)} 127.0.0.1:${s.localPort}  →  ${target}`);
+        }
+    }
+    buildRemoteCommand(specs) {
+        const kubectlSpecs = specs.filter((s) => s.needsKubectl);
+        if (kubectlSpecs.length === 0) {
+            // Nothing to run remotely; SSH -N is enough. The kube-API is reached via
+            // the local-forward to 127.0.0.1:6443 on the master (kube-API binds there).
+            return undefined;
+        }
+        // Use newlines as separators: `&` terminates a command on its own, so
+        // joining with `; ` would emit invalid `&;` sequences. Trap HUP too so
+        // we clean up child kubectl processes when SSH disconnects.
+        const portsToFree = kubectlSpecs.map((s) => s.localPort).join(' ');
+        const lines = [
+            // Pre-cleanup: free the loopback ports we want to bind. fuser -k is
+            // port-targeted (won't match our own sh wrapper by accident); pkill
+            // is a fallback if fuser is not installed.
+            `for p in ${portsToFree}; do fuser -k -n tcp $p 2>/dev/null || true; done`,
+            'pkill -f "^kubectl .*port-forward" 2>/dev/null || true',
+            'sleep 1',
+            'trap "kill 0" INT TERM EXIT HUP',
+        ];
+        for (const s of kubectlSpecs) {
+            lines.push(`kubectl -n ${s.namespace} port-forward --address 127.0.0.1 ${s.service} ${s.localPort}:${s.remotePort} &`);
+        }
+        lines.push('wait');
+        return `sh -c '${lines.join('\n')}'`;
+    }
+}
+DevTunnel.description = 'Open SSH tunnels from localhost to the observability cluster services.\n' +
+    'On the remote side runs kubectl port-forward against the in-cluster Services,\n' +
+    'so no NodePort or kube-API exposure is required. Stay in foreground; CTRL-C to close.';
+DevTunnel.examples = [
+    '<%= config.bin %> <%= command.id %>',
+    '<%= config.bin %> <%= command.id %> --ports postgres,redis',
+    '<%= config.bin %> <%= command.id %> --ports postgres,redis,kube-api,grafana',
+    '<%= config.bin %> <%= command.id %> --no-retry',
+];
+DevTunnel.flags = {
+    ports: core_1.Flags.string({
+        description: 'Comma-separated list of forwards to open. ' +
+            `Available: ${Object.keys(FORWARDS).join(', ')}`,
+        default: 'postgres,redis,kube-api,vmsingle,loki',
+    }),
+    retry: core_1.Flags.boolean({
+        description: 'Reconnect automatically if the SSH session drops. Disable with --no-retry.',
+        default: true,
+        allowNo: true,
+    }),
+    'kill-local': core_1.Flags.boolean({
+        description: 'Kill any local process bound to the requested ports before opening the tunnel. Disable with --no-kill-local.',
+        default: true,
+        allowNo: true,
+    }),
+};
+exports.default = DevTunnel;

package/lib/cli/src/commands/dns/cleanup.d.ts

@@ -0,0 +1,11 @@
+import { Command } from '@oclif/core';
+export default class DnsCleanup extends Command {
+    static readonly description = "Delete all A records from a Hetzner DNS zone";
+    static readonly examples: string[];
+    static readonly flags: {
+        domain: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        force: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'dry-run': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/lib/cli/src/commands/dns/cleanup.js

@@ -0,0 +1,93 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const chalk_1 = __importDefault(require("chalk"));
+const ora_1 = __importDefault(require("ora"));
+const nest_app_1 = require("../../lib/nest-app");
+const prompts_1 = require("../../lib/prompts");
+const hetzner_dns_service_1 = require("../../../../src/modules/providers/services/hetzner-dns.service");
+const dns_provider_interface_1 = require("../../../../src/modules/providers/interfaces/dns-provider.interface");
+class DnsCleanup extends core_1.Command {
+    async run() {
+        const { flags } = await this.parse(DnsCleanup);
+        let spinner = (0, ora_1.default)('Looking up zone...').start();
+        try {
+            const app = await (0, nest_app_1.getNestApp)();
+            const hetznerDns = app.get(hetzner_dns_service_1.HetznerDnsService);
+            const zone = await hetznerDns.getZoneByName(flags.domain);
+            if (!zone) {
+                spinner.fail(`Zone not found: ${flags.domain}`);
+                this.exit(1);
+            }
+            spinner.succeed(`Zone found: ${zone.zoneId}`);
+            spinner = (0, ora_1.default)('Fetching A records...').start();
+            const records = await hetznerDns.listRecords(zone.zoneId);
+            const aRecords = records.filter((r) => r.type === dns_provider_interface_1.DnsRecordType.A);
+            const rrsetNames = [...new Set(aRecords.map((r) => r.name))];
+            spinner.succeed(`Found ${aRecords.length} A value(s) across ${rrsetNames.length} RRSet(s)`);
+            console.log(chalk_1.default.yellow(`\n  Zone:           ${flags.domain}`));
+            console.log(chalk_1.default.yellow(`  A RRSets:       ${rrsetNames.length}`));
+            console.log(chalk_1.default.yellow(`  Total A values: ${aRecords.length}\n`));
+            for (const name of rrsetNames) {
+                const values = aRecords
+                    .filter((r) => r.name === name)
+                    .map((r) => r.value);
+                console.log(`  ${chalk_1.default.bold(name)} → ${values.join(', ')}`);
+            }
+            if (flags['dry-run']) {
+                console.log(chalk_1.default.green('\n  Dry run complete. No records deleted.\n'));
+                return;
+            }
+            if (rrsetNames.length === 0) {
+                console.log(chalk_1.default.green('\n  No A records found. Nothing to do.\n'));
+                return;
+            }
+            if (!flags.force) {
+                console.log('');
+                console.log(chalk_1.default.yellow(`  Type 'yes' to delete all ${rrsetNames.length} A RRSet(s) from ${flags.domain}:`));
+                const confirmed = await (0, prompts_1.confirmByTypingPrompt)(chalk_1.default.yellow('Confirm'), 'yes');
+                if (!confirmed) {
+                    console.log(chalk_1.default.green('\n  Deletion cancelled.\n'));
+                    return;
+                }
+            }
+            spinner = (0, ora_1.default)('Deleting A records...').start();
+            const deleted = await hetznerDns.purgeARecords(zone.zoneId);
+            spinner.succeed(`Deleted ${deleted} A RRSet(s)`);
+            console.log(chalk_1.default.green(`\n  Cleaned up ${deleted} A RRSet(s) from ${flags.domain}\n`));
+        }
+        catch (error) {
+            spinner.fail('DNS cleanup failed');
+            console.log(chalk_1.default.red(`\n  ${error instanceof Error ? error.message : String(error)}\n`));
+            this.exit(1);
+        }
+        finally {
+            await (0, nest_app_1.closeNestApp)();
+        }
+    }
+}
+DnsCleanup.description = 'Delete all A records from a Hetzner DNS zone';
+DnsCleanup.examples = [
+    '<%= config.bin %> <%= command.id %> --domain example.com',
+    '<%= config.bin %> <%= command.id %> --domain example.com --dry-run',
+    '<%= config.bin %> <%= command.id %> --domain example.com --force',
+];
+DnsCleanup.flags = {
+    domain: core_1.Flags.string({
+        required: true,
+        description: 'Hetzner DNS zone domain name',
+    }),
+    force: core_1.Flags.boolean({
+        char: 'f',
+        description: 'Skip confirmation prompt',
+        default: false,
+    }),
+    'dry-run': core_1.Flags.boolean({
+        description: 'Preview without deleting',
+        default: false,
+    }),
+};
+exports.default = DnsCleanup;