@flui-cloud/cli 0.0.1

package/README.md

@@ -0,0 +1,124 @@
+# @flui-cloud/cli
+
+Command-line interface for [Flui](https://flui.cloud) — the open
+platform layer on top of your cloud provider. Create clusters, deploy
+applications from a `flui.yaml` manifest, switch between installations,
+and operate the lifecycle end to end from one binary.
+
+Full reference: **[docs.flui.cloud/cli](https://docs.flui.cloud/cli/)**.
+
+## Install
+
+```bash
+npm install -g @flui-cloud/cli       # or: pnpm add -g, yarn global add
+flui --version
+```
+
+To upgrade later, run `flui update` — it self-replaces the global
+install with the latest published version.
+
+## Quickstart
+
+Flui is a modern, multi-cloud platform layer that turns plain cloud
+servers into a full application platform — you keep ownership of the
+infrastructure, no vendor lock-in. Create your installation in one
+interactive command — it asks for an admin email and a credential for
+one of the supported cloud providers (Hetzner and Scaleway today;
+more providers and bring-your-own-server installs on the roadmap),
+then in a few minutes returns an environment ready to host
+applications: cluster, ingress, TLS, identity, observability,
+dashboard — already wired in.
+
+```bash
+flui env create
+```
+
+The command streams the install logs until the platform is reachable,
+then prints the dashboard, API and OIDC URLs. The full walkthrough
+lives at [Getting started](https://docs.flui.cloud/cli/getting-started/).
+
+## What you can do next
+
+Once the cluster is up, plenty works without any extra integration —
+day-to-day operating the installation, inspecting resources, and
+deploying pre-built apps:
+
+```bash
+flui auth login                              # OIDC against the freshly created installation
+
+flui env status                              # control-cluster health, nodes, capacity
+flui env credentials --test                  # print + probe the dashboard / API / OIDC / Grafana URLs
+
+flui app list                                # all apps on the installation
+flui app status <name>                       # rollout state, replicas, image
+flui app logs <name> --tail 200              # recent logs
+flui app metrics <name>                      # CPU / memory / network
+
+flui deploy                                  # deploy a flui.yaml from the current directory
+```
+
+For source-built apps (`kind: Application`, built from a GitHub repo)
+you also need to install the Flui GitHub App and save a GHCR PAT first
+— see [Integrations](https://docs.flui.cloud/cli/integrations/).
+Pre-built CatalogApps (`kind: CatalogApp`) skip all of that and deploy
+straight from `flui deploy` against any public image registry. The
+manifest reference is on [Deploy](https://docs.flui.cloud/cli/deploy/).
+
+## Topics
+
+Commands are grouped into topics; each verb has its own `--help`.
+
+| Topic | What it does |
+| --- | --- |
+| `env` | Lifecycle of the **control cluster** — create, inspect, scale, destroy. |
+| `cluster` / `node` | Workload-cluster destroy and worker-node add/remove/list. |
+| `app` | Inspect, scale, restart, snapshot, redeploy, and delete applications; read logs, metrics, and crash reports. |
+| `deploy` / `catalog` | Deploy from a `flui.yaml` manifest; validate the manifest offline. |
+| `integration` / `repo` | Connect the Flui GitHub App, save a GHCR PAT, and import repositories — prerequisites for the first source-built deploy. |
+| `template` | Create a new repository from a Flui framework template. |
+| `backup` | Manage backup destinations, policies, jobs, and restores. |
+| `auth` | OIDC login and long-lived M2M API keys. |
+| `context` / `config` | Profiles (isolated installations) and layered configuration. |
+| `server-types` / `ssh` | List provider server sizes; SSH into a node. |
+| `dev` | Helpers for Flui contributors (export secrets, SSH tunnel). |
+| `dns` / `reconcile` / `update` | Maintenance utilities. |
+
+Per-topic reference pages: see [docs.flui.cloud/cli](https://docs.flui.cloud/cli/).
+
+## Common conventions
+
+A handful of flags recur across the CLI:
+
+- `-c, --cluster <name|id>` — target cluster explicitly. Auto-detected
+  when only one is present.
+- `-o, --output <format>` — `json` is always available for scripting;
+  the human format is `text` or `table` depending on the command.
+- `--no-wait` / `--detach` — return as soon as the job is queued.
+- `-f, --force` / `-y, --yes` — skip confirmation on destructive
+  operations.
+- `--dry-run` — print what *would* happen on a subset of mutating
+  commands.
+
+Commands that talk to the API print a short context banner before
+running (active profile + API URL).
+
+## Profiles on disk
+
+The CLI keeps each installation's state under
+`~/.flui/profiles/<name>/`. A profile holds the API token, the
+encrypted credentials needed to talk to the provider, the SSH CA used
+for cluster nodes, and the local inventory the profile knows about.
+The path can be moved with the `FLUI_DIR` environment variable.
+
+Switching between installations: `flui context use <name>`.
+
+## Links
+
+- **Documentation:** [docs.flui.cloud](https://docs.flui.cloud)
+- **Project site:** [flui.cloud](https://flui.cloud)
+- **Source / issues:** [github.com/flui-cloud/core](https://github.com/flui-cloud/core)
+- **Manifest spec:** [`@flui-cloud/spec`](https://www.npmjs.com/package/@flui-cloud/spec) ([repo](https://github.com/flui-cloud/flui-spec))
+
+## License
+
+AGPL-3.0-or-later. See [`LICENSE`](./LICENSE).

package/bin/run

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+
+// Load environment variables FIRST, before any modules
+const dotenv = require('dotenv');
+const path = require('path');
+const os = require('os');
+
+// Load .env from CLI data directory and project root
+dotenv.config({ path: path.join(os.homedir(), '.flui', '.env') });
+dotenv.config({ path: path.join(process.cwd(), '.env') });
+
+// Initialize module-alias to resolve 'src/*' paths at runtime.
+// Point it at the CLI package root so `flui` works from any CWD
+// (when invoked via `pnpm link --global`, CWD is wherever the user is).
+require('module-alias')(path.join(__dirname, '..'));
+
+require('@oclif/core').run().then(require('@oclif/core').flush).catch(require('@oclif/core').Errors.handle)

package/lib/cli/src/background/cluster-worker.d.ts

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+/**
+ * Background Worker for Cluster Operations
+ *
+ * This script runs as a detached background process to execute
+ * long-running cluster operations asynchronously.
+ *
+ * Usage:
+ *   node cluster-worker.js create-cluster '{"clusterId":"...","operationId":"..."}'
+ */
+export {};

package/lib/cli/src/background/cluster-worker.js

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * Background Worker for Cluster Operations
+ *
+ * This script runs as a detached background process to execute
+ * long-running cluster operations asynchronously.
+ *
+ * Usage:
+ *   node cluster-worker.js create-cluster '{"clusterId":"...","operationId":"..."}'
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@nestjs/core");
+const common_1 = require("@nestjs/common");
+const cli_module_1 = require("../cli.module");
+const cli_cluster_creator_service_1 = require("../services/cli-cluster-creator.service");
+const cli_cluster_repository_1 = require("../lib/repositories/cli-cluster.repository");
+const cli_operation_repository_1 = require("../lib/repositories/cli-operation.repository");
+const cli_logger_service_1 = require("../services/cli-logger.service");
+const logger = new common_1.Logger('ClusterWorker');
+async function main() {
+    const args = process.argv.slice(2);
+    if (args.length < 2) {
+        console.error('Usage: cluster-worker <jobType> <jobDataJson>');
+        process.exit(1);
+    }
+    const jobType = args[0];
+    const jobDataJson = args[1];
+    logger.log(`Starting background worker: ${jobType}`);
+    // Bootstrap NestJS application context
+    const app = await core_1.NestFactory.createApplicationContext(cli_module_1.CliModule, {
+        logger: ['error', 'warn', 'log'],
+    });
+    try {
+        const jobData = JSON.parse(jobDataJson);
+        if (jobType === 'create-cluster') {
+            await handleCreateCluster(app, jobData);
+        }
+        else if (jobType === 'delete-cluster') {
+            await handleDeleteCluster(app, jobData);
+        }
+        else {
+            throw new Error(`Unknown job type: ${jobType}`);
+        }
+        logger.log(`Background worker completed successfully: ${jobType}`);
+        process.exit(0);
+    }
+    catch (error) {
+        logger.error(`Background worker failed: ${error.message}`, error.stack);
+        process.exit(1);
+    }
+    finally {
+        await app.close();
+    }
+}
+async function handleCreateCluster(app, jobData) {
+    const { clusterId, operationId } = jobData;
+    logger.log(`Creating cluster ${clusterId} (operation ${operationId})`);
+    const clusterRepo = app.get(cli_cluster_repository_1.CliClusterRepository);
+    const operationRepo = app.get(cli_operation_repository_1.CliOperationRepository);
+    const creatorService = app.get(cli_cluster_creator_service_1.CliClusterCreatorService);
+    const loggerService = app.get(cli_logger_service_1.CliLoggerService);
+    // Load cluster and operation from file storage
+    const cluster = await clusterRepo.findOne({ where: { id: clusterId } });
+    const operation = await operationRepo.findOne({ where: { id: operationId } });
+    if (!cluster) {
+        throw new Error(`Cluster ${clusterId} not found`);
+    }
+    if (!operation) {
+        throw new Error(`Operation ${operationId} not found`);
+    }
+    loggerService.writeLog(operationId, `Background worker started for cluster ${cluster.name}`, 'INFO');
+    try {
+        // Execute cluster creation synchronously (within this background process)
+        await creatorService.createClusterSync(cluster, operation);
+        loggerService.writeLog(operationId, `Cluster ${cluster.name} created successfully`, 'INFO');
+    }
+    catch (error) {
+        loggerService.writeLog(operationId, `Cluster creation failed: ${error.message}`, 'ERROR');
+        throw error;
+    }
+}
+async function handleDeleteCluster(app, jobData) {
+    const { clusterId } = jobData;
+    logger.log(`Deleting cluster ${clusterId}`);
+    // TODO: Implement background cluster deletion if needed
+    throw new Error('Background cluster deletion not yet implemented');
+}
+// Run main function
+main();

package/lib/cli/src/cli-providers.module.d.ts

@@ -0,0 +1,2 @@
+export declare class CliProvidersModule {
+}

package/lib/cli/src/cli-providers.module.js

@@ -0,0 +1,118 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CliProvidersModule = void 0;
+const common_1 = require("@nestjs/common");
+const cli_credential_provider_service_1 = require("./lib/cli-credential-provider.service");
+const ip_detection_1 = require("./lib/utils/ip-detection");
+const cli_firewall_repository_1 = require("./lib/repositories/cli-firewall.repository");
+const cli_vnet_repository_1 = require("./lib/repositories/cli-vnet.repository");
+const vnet_provisioning_service_1 = require("./lib/services/vnet-provisioning.service");
+const api_client_1 = require("./lib/api-client");
+const config_storage_1 = require("./lib/config-storage");
+const provider_core_module_1 = require("../../src/modules/providers/provider-core.module");
+const common_module_1 = require("../../src/modules/common/common.module");
+const hetzner_provider_module_1 = require("../../src/modules/providers/implementations/hetzner/hetzner-provider.module");
+const scaleway_provider_module_1 = require("../../src/modules/providers/implementations/scaleway/scaleway-provider.module");
+const provider_factory_1 = require("../../src/modules/providers/core/factories/provider.factory");
+const firewall_provider_factory_1 = require("../../src/modules/providers/core/factories/firewall-provider.factory");
+const dns_provider_factory_1 = require("../../src/modules/providers/core/factories/dns-provider.factory");
+const cloud_provider_enum_1 = require("../../src/modules/providers/enums/cloud-provider.enum");
+const dns_provider_enum_1 = require("../../src/modules/providers/enums/dns-provider.enum");
+const hetzner_provider_service_1 = require("../../src/modules/providers/services/hetzner-provider.service");
+const hetzner_firewall_service_1 = require("../../src/modules/providers/services/hetzner-firewall.service");
+const hetzner_dns_service_1 = require("../../src/modules/providers/services/hetzner-dns.service");
+const scaleway_provider_service_1 = require("../../src/modules/providers/implementations/scaleway/scaleway-provider.service");
+const scaleway_firewall_service_1 = require("../../src/modules/providers/implementations/scaleway/scaleway-firewall.service");
+const scaleway_dns_service_1 = require("../../src/modules/providers/implementations/scaleway/scaleway-dns.service");
+const hetzner_bootstrap_seeder_service_1 = require("../../src/modules/providers/implementations/hetzner/hetzner-bootstrap-seeder.service");
+const scaleway_bootstrap_seeder_service_1 = require("../../src/modules/providers/implementations/scaleway/scaleway-bootstrap-seeder.service");
+const tokens_1 = require("../../src/modules/providers/core/tokens");
+let CliProvidersModule = class CliProvidersModule {
+};
+exports.CliProvidersModule = CliProvidersModule;
+exports.CliProvidersModule = CliProvidersModule = __decorate([
+    (0, common_1.Global)(),
+    (0, common_1.Module)({
+        imports: [
+            provider_core_module_1.ProviderCoreModule,
+            common_module_1.CommonModule,
+            hetzner_provider_module_1.HetznerProviderModule,
+            scaleway_provider_module_1.ScalewayProviderModule,
+        ],
+        providers: [
+            cli_credential_provider_service_1.CliCredentialProviderService,
+            {
+                provide: 'ICredentialProvider',
+                useExisting: cli_credential_provider_service_1.CliCredentialProviderService,
+            },
+            {
+                provide: provider_factory_1.ProviderFactory,
+                useFactory: (hetzner, scaleway) => new provider_factory_1.ProviderFactory([
+                    { provider: cloud_provider_enum_1.CloudProvider.HETZNER, service: hetzner },
+                    { provider: cloud_provider_enum_1.CloudProvider.SCALEWAY, service: scaleway },
+                ]),
+                inject: [hetzner_provider_service_1.HetznerProviderService, scaleway_provider_service_1.ScalewayProviderService],
+            },
+            {
+                provide: firewall_provider_factory_1.FirewallProviderFactory,
+                useFactory: (hetzner, scaleway) => new firewall_provider_factory_1.FirewallProviderFactory([
+                    { provider: cloud_provider_enum_1.CloudProvider.HETZNER, service: hetzner },
+                    { provider: cloud_provider_enum_1.CloudProvider.SCALEWAY, service: scaleway },
+                ]),
+                inject: [hetzner_firewall_service_1.HetznerFirewallService, scaleway_firewall_service_1.ScalewayFirewallService],
+            },
+            {
+                provide: dns_provider_factory_1.DnsProviderFactory,
+                useFactory: (hetzner, scaleway) => new dns_provider_factory_1.DnsProviderFactory([
+                    { provider: dns_provider_enum_1.DnsProvider.HETZNER, service: hetzner },
+                    { provider: dns_provider_enum_1.DnsProvider.SCALEWAY, service: scaleway },
+                ]),
+                inject: [hetzner_dns_service_1.HetznerDnsService, scaleway_dns_service_1.ScalewayDnsService],
+            },
+            {
+                provide: tokens_1.PROVIDER_BOOTSTRAP_SEEDER_REGISTRY,
+                useFactory: (hetzner, scaleway) => [
+                    { provider: cloud_provider_enum_1.CloudProvider.HETZNER, service: hetzner },
+                    { provider: cloud_provider_enum_1.CloudProvider.SCALEWAY, service: scaleway },
+                ],
+                inject: [hetzner_bootstrap_seeder_service_1.HetznerBootstrapSeeder, scaleway_bootstrap_seeder_service_1.ScalewayBootstrapSeeder],
+            },
+            {
+                provide: api_client_1.ApiClient,
+                useFactory: () => {
+                    const configStorage = new config_storage_1.ConfigStorage();
+                    return new api_client_1.ApiClient({
+                        baseUrl: configStorage.getApiUrl() ?? '',
+                        apiKey: configStorage.getApiKey(),
+                    });
+                },
+            },
+            ip_detection_1.IpDetectionService,
+            cli_firewall_repository_1.CliFirewallRepository,
+            cli_vnet_repository_1.CliVnetRepository,
+            vnet_provisioning_service_1.VnetProvisioningService,
+        ],
+        exports: [
+            provider_core_module_1.ProviderCoreModule,
+            cli_credential_provider_service_1.CliCredentialProviderService,
+            'ICredentialProvider',
+            hetzner_provider_module_1.HetznerProviderModule,
+            scaleway_provider_module_1.ScalewayProviderModule,
+            provider_factory_1.ProviderFactory,
+            firewall_provider_factory_1.FirewallProviderFactory,
+            dns_provider_factory_1.DnsProviderFactory,
+            tokens_1.PROVIDER_BOOTSTRAP_SEEDER_REGISTRY,
+            api_client_1.ApiClient,
+            ip_detection_1.IpDetectionService,
+            cli_firewall_repository_1.CliFirewallRepository,
+            cli_vnet_repository_1.CliVnetRepository,
+            vnet_provisioning_service_1.VnetProvisioningService,
+        ],
+    })
+], CliProvidersModule);

package/lib/cli/src/cli.module.d.ts

@@ -0,0 +1,13 @@
+/**
+ * CLI Module - Standalone Infrastructure Management
+ *
+ * This module provides CLI commands without requiring external services:
+ * - NO PostgreSQL database required
+ * - NO Redis queue required
+ * - File-based persistence in ~/.flui/
+ * - Uses CliInfrastructureModule for cluster management
+ * - config:* commands use file-based storage in ~/.flui/config.json
+ * - env:* commands use file-based cluster/operation tracking
+ */
+export declare class CliModule {
+}

package/lib/cli/src/cli.module.js

@@ -0,0 +1,80 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CliModule = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const cli_providers_module_1 = require("./cli-providers.module");
+const common_module_1 = require("../../src/modules/common/common.module");
+const cli_infrastructure_module_1 = require("./modules/cli-infrastructure.module");
+const path = __importStar(require("node:path"));
+const os = __importStar(require("node:os"));
+const CLI_DATA_DIR = path.join(os.homedir(), '.flui');
+/**
+ * CLI Module - Standalone Infrastructure Management
+ *
+ * This module provides CLI commands without requiring external services:
+ * - NO PostgreSQL database required
+ * - NO Redis queue required
+ * - File-based persistence in ~/.flui/
+ * - Uses CliInfrastructureModule for cluster management
+ * - config:* commands use file-based storage in ~/.flui/config.json
+ * - env:* commands use file-based cluster/operation tracking
+ */
+let CliModule = class CliModule {
+};
+exports.CliModule = CliModule;
+exports.CliModule = CliModule = __decorate([
+    (0, common_1.Module)({
+        imports: [
+            config_1.ConfigModule.forRoot({
+                isGlobal: true,
+                envFilePath: [
+                    path.join(CLI_DATA_DIR, '.env'),
+                    path.join(process.cwd(), '.env'),
+                ],
+            }),
+            cli_providers_module_1.CliProvidersModule,
+            common_module_1.CommonModule,
+            cli_infrastructure_module_1.CliInfrastructureModule,
+        ],
+    })
+], CliModule);

package/lib/cli/src/commands/_diag-oidc.d.ts

@@ -0,0 +1,6 @@
+import { Command } from '@oclif/core';
+export default class DiagOidc extends Command {
+    static description: string;
+    static hidden: boolean;
+    run(): Promise<void>;
+}

package/lib/cli/src/commands/_diag-oidc.js

@@ -0,0 +1,132 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const nest_app_1 = require("../lib/nest-app");
+const cli_ssh_service_1 = require("../services/cli-ssh.service");
+const cli_observability_cluster_service_1 = require("../services/cli-observability-cluster.service");
+class DiagOidc extends core_1.Command {
+    async run() {
+        const app = await (0, nest_app_1.getNestApp)();
+        try {
+            const ssh = app.get(cli_ssh_service_1.CliSshService);
+            const obs = app.get(cli_observability_cluster_service_1.CliObservabilityClusterService);
+            const cluster = await obs.getObservabilityCluster();
+            if (!cluster?.masterIpAddress) {
+                this.error('No cluster / master IP');
+            }
+            const ip = cluster.masterIpAddress;
+            this.log('# Master IP: ' + ip);
+            this.log('# nipHostnameToken: ' + JSON.stringify(cluster.nipHostnameToken));
+            const opRepo = app.get((await Promise.resolve().then(() => __importStar(require('../lib/repositories/cli-operation.repository')))).CliOperationRepository);
+            const ops = await opRepo.find({ where: { resourceId: cluster.id } });
+            this.log('# Operations on cluster:');
+            for (const op of ops) {
+                this.log(`  ${op.id} type=${op.operationType} status=${op.status} step=${op.currentStepIndex}/${op.totalSteps} createdAt=${op.createdAt}`);
+                if (op.status === 'FAILED' || op.status === 'IN_PROGRESS' || op.status === 'PENDING') {
+                    this.log('    metadata=' + JSON.stringify(op.metadata).slice(0, 600));
+                }
+            }
+            this.log('# Local cluster status: ' + cluster.status);
+            const cmds = [
+                ['ACME solver ingresses (k8s Ingress)', "kubectl -n flui-system get ingress 2>&1; echo ---; kubectl -n flui-system get ingress -o yaml 2>&1 | grep -E 'host:|path:|name:|number:|className' | head -40"],
+                ['Traefik routers on :web', "TPOD=$(kubectl -n kube-system get pod -l app.kubernetes.io/name=traefik -o jsonpath='{.items[0].metadata.name}'); kubectl -n kube-system exec $TPOD -- wget -qO- http://localhost:9000/api/http/routers 2>/dev/null | head -c 4000; echo"],
+                ['Traefik routers via host curl', "TIP=$(kubectl -n kube-system get pod -l app.kubernetes.io/name=traefik -o jsonpath='{.items[0].status.podIP}'); echo TIP=$TIP; curl -s --connect-timeout 5 http://$TIP:9000/api/http/routers > /tmp/routers.json 2>&1; head -c 200 /tmp/routers.json; echo; echo ---PARSE---; python3 -c 'import json; rs=json.load(open(\"/tmp/routers.json\")); [print(r.get(\"name\",\"?\"),\"|rule=\",r.get(\"rule\",\"\")[:80],\"|eps=\",r.get(\"entryPoints\",[]),\"|stat=\",r.get(\"status\",\"\"),\"|tls=\",bool(r.get(\"tls\")),\"|err=\",str(r.get(\"error\",\"\"))[:120]) for r in rs]' 2>&1 | head -40"],
+                ['IngressClass + Traefik k8s ingress provider', "kubectl get ingressclass -o wide 2>&1; echo ---traefik-args; kubectl -n kube-system get pod -l app.kubernetes.io/name=traefik -o jsonpath='{.items[0].spec.containers[0].args}' 2>&1 | tr ',' '\\n' | grep -iE 'kubernetesingress|kubernetescrd|providers' | head -20"],
+                ['Sleep 8 then retest :80 (Traefik reload)', "sleep 8; for h in app api auth; do echo --- $h; curl -sk --connect-timeout 5 -o /dev/null -w 'HTTP %{http_code}\\n' --resolve $h.royal-gecko-72.162.55.56.10.nip.io:80:162.55.56.10 http://$h.royal-gecko-72.162.55.56.10.nip.io/ ; done"],
+                ['PATCH: drop tls + add web entrypoint to zitadel', "for ir in flui-api flui-web zitadel; do kubectl -n flui-system patch ingressroute $ir --type=json -p '[{\"op\":\"remove\",\"path\":\"/spec/tls\"}]' 2>&1 | head -1; done; kubectl -n flui-system patch ingressroute zitadel --type=json -p '[{\"op\":\"replace\",\"path\":\"/spec/entryPoints\",\"value\":[\"web\",\"websecure\"]}]'; sleep 5; echo ---test---; for h in app api auth; do curl -sk --connect-timeout 5 -o /dev/null -w \"$h=HTTP %{http_code}\\n\" --resolve $h.royal-gecko-72.162.55.56.10.nip.io:80:162.55.56.10 http://$h.royal-gecko-72.162.55.56.10.nip.io/; done"],
+                ['Test ACME path before retry', "TOKEN=$(kubectl -n flui-system get challenge -o jsonpath='{.items[0].spec.token}'); HOST=$(kubectl -n flui-system get challenge -o jsonpath='{.items[0].spec.dnsName}'); echo TOKEN=${TOKEN:0:20}... HOST=$HOST; curl -sk --connect-timeout 5 -o /tmp/c -w 'HTTP %{http_code}\\n' --resolve $HOST:80:162.55.56.10 http://$HOST/.well-known/acme-challenge/$TOKEN; echo body_first50=$(head -c 50 /tmp/c)"],
+                ['Force cert-manager retry (delete Order)', "kubectl -n flui-system delete order --all 2>&1; kubectl -n flui-system delete certificaterequest --all 2>&1; sleep 6; kubectl -n flui-system get challenge,order,certificaterequest 2>&1 | head"],
+                ['PATCH: cert-manager hostAliases -> Traefik ClusterIP', "TIP=$(kubectl -n kube-system get svc traefik -o jsonpath='{.spec.clusterIP}'); echo TIP=$TIP; kubectl -n cert-manager patch deploy cert-manager --type=json -p '[{\"op\":\"add\",\"path\":\"/spec/template/spec/hostAliases\",\"value\":[{\"ip\":\"'$TIP'\",\"hostnames\":[\"app.royal-gecko-72.162.55.56.10.nip.io\",\"api.royal-gecko-72.162.55.56.10.nip.io\",\"auth.royal-gecko-72.162.55.56.10.nip.io\"]}]}]' 2>&1; kubectl -n cert-manager rollout status deploy/cert-manager --timeout=60s 2>&1 | tail -3"],
+                ['Order invalid reason + restart cycle', "kubectl -n flui-system get order -o yaml 2>&1 | grep -A2 -E 'state:|reason:|message:' | head -40; echo ---deleting all + restart cert-manager---; kubectl -n flui-system delete order,certificaterequest,challenge --all 2>&1; kubectl -n flui-system delete certificate flui-system-tls 2>&1"],
+                ['Recreate Certificate', "cat <<'YAML' | kubectl apply -f -\napiVersion: cert-manager.io/v1\nkind: Certificate\nmetadata:\n  name: flui-system-tls\n  namespace: flui-system\n  labels:\n    app.kubernetes.io/managed-by: flui-cloud\nspec:\n  secretName: flui-system-tls\n  issuerRef:\n    name: letsencrypt-production\n    kind: ClusterIssuer\n  dnsNames:\n    - auth.royal-gecko-72.162.55.56.10.nip.io\n    - api.royal-gecko-72.162.55.56.10.nip.io\n    - app.royal-gecko-72.162.55.56.10.nip.io\nYAML\nsleep 10; kubectl -n flui-system get challenge,order 2>&1 | head"],
+                ['Wait 25s then check', "sleep 25; kubectl -n flui-system get certificate,secret/flui-system-tls,challenge 2>&1"],
+                ['Cert challenges + Certificate after fix', "kubectl -n flui-system get certificate flui-system-tls -o jsonpath='{.status.conditions[*].message}' 2>&1; echo; kubectl -n flui-system get challenge -o wide 2>&1 | head"],
+                ['external curl :80 to ACME path', "for h in app api auth; do echo --- $h; curl -sk --connect-timeout 6 -o /dev/null -w 'HTTP %{http_code} loc=%{redirect_url}\\n' --resolve $h.royal-gecko-72.162.55.56.10.nip.io:80:162.55.56.10 http://$h.royal-gecko-72.162.55.56.10.nip.io/.well-known/acme-challenge/test 2>&1; done"],
+                ['external curl :80 root', "for h in app api auth; do echo --- $h; curl -sk --connect-timeout 6 -o /dev/null -w 'HTTP %{http_code} loc=%{redirect_url}\\n' --resolve $h.royal-gecko-72.162.55.56.10.nip.io:80:162.55.56.10 http://$h.royal-gecko-72.162.55.56.10.nip.io/ 2>&1; done"],
+                ['ACME solver ingresses', "kubectl -n flui-system get ingress 2>&1; echo ---; kubectl -n flui-system get ingress -o yaml 2>&1 | grep -E 'host:|path:|backend:|service:|name:|number:|class:' | head -50"],
+                ['HTTP-01 self-check from cm pod', "CMP=$(kubectl -n cert-manager get pod -l app=cert-manager -o jsonpath='{.items[0].metadata.name}'); echo CMP=$CMP; for h in app api auth; do echo --- $h; kubectl -n cert-manager exec $CMP -- wget --spider --timeout=8 -S http://${h}.royal-gecko-72.162.55.56.10.nip.io/ 2>&1 | tail -10; done"],
+                ['HTTP-01 self-check via local nginx-style', "CHALLENGE=$(kubectl -n flui-system get challenge -o jsonpath='{.items[0].spec.token}'); echo TOKEN=$CHALLENGE; CMP=$(kubectl -n cert-manager get pod -l app=cert-manager -o jsonpath='{.items[0].metadata.name}'); kubectl -n cert-manager exec $CMP -- wget -qO- --timeout=8 http://app.royal-gecko-72.162.55.56.10.nip.io/.well-known/acme-challenge/$CHALLENGE 2>&1 | head -5; echo ---; kubectl -n cert-manager exec $CMP -- wget -S --timeout=8 -O /dev/null http://162.55.56.10/.well-known/acme-challenge/$CHALLENGE 2>&1 | tail -8"],
+                ['cert-manager Certificate', "kubectl -n flui-system get certificate -o wide 2>&1; echo ---; kubectl -n flui-system describe certificate 2>&1 | tail -50"],
+                ['cert-manager Order/Challenge', "kubectl -n flui-system get order,challenge -o wide 2>&1; echo ---; kubectl -n flui-system describe challenge 2>&1 | tail -50"],
+                ['cert-manager logs', "kubectl -n cert-manager logs -l app=cert-manager --tail=80 2>&1 | grep -iE 'error|fail|warn|royal-gecko' | tail -30"],
+                ['ClusterIssuer', "kubectl get clusterissuer 2>&1"],
+                ['placeholder',
+                    'noop'],
+                ['Traefik pod / svc', "kubectl -n kube-system get pods -l app.kubernetes.io/name=traefik -o wide 2>&1; echo; kubectl -n kube-system get svc traefik 2>&1"],
+                ['Traefik logs (last 80, errors)', "kubectl -n kube-system logs -l app.kubernetes.io/name=traefik --tail=200 2>&1 | grep -iE 'error|fail|warn' | tail -40"],
+                ['IngressRoutes flui-system', "kubectl -n flui-system get ingressroute -o wide 2>&1"],
+                ['flui-system pods', "kubectl -n flui-system get pods 2>&1"],
+                ['flui-system services', "kubectl -n flui-system get svc 2>&1"],
+                ['flui-system-tls secret', "kubectl -n flui-system get secret flui-system-tls -o yaml 2>&1 | grep -E 'tls.crt|tls.key|name:' | head -10; echo ---; kubectl -n flui-system get secret flui-system-tls -o jsonpath='{.data.tls\\.crt}' 2>/dev/null | base64 -d | openssl x509 -noout -subject -issuer -dates 2>&1 | head"],
+                ['IngressRoute for app/api/auth detail', "for n in 09-flui-api 10-flui-web 11-zitadel; do echo '=== '$n; kubectl -n flui-system get ingressroute -o yaml | grep -E 'host\\(|Host\\(|tls:|secretName' | head -20; done; kubectl -n flui-system get ingressroute -o yaml | grep -E 'match:|host:' | head -30"],
+                ['curl from inside cluster (Traefik svc IP)', "TIP=$(kubectl -n kube-system get svc traefik -o jsonpath='{.spec.clusterIP}'); echo TIP=$TIP; for h in app.royal-gecko-72.162.55.56.10.nip.io api.royal-gecko-72.162.55.56.10.nip.io auth.royal-gecko-72.162.55.56.10.nip.io; do echo --- $h ---; curl -sk --connect-timeout 5 -o /dev/null -w 'HTTP %{http_code}\\n' -H \"Host: $h\" https://$TIP/; done"],
+            ];
+            const _allCmds = [
+                ['OIDC_AUDIENCE in flui-secrets', "kubectl -n flui-system get secret flui-secrets -o jsonpath='{.data.OIDC_AUDIENCE}' | base64 -d; echo"],
+                ['OIDC_ISSUER in flui-api-config', "kubectl -n flui-system get cm flui-api-config -o jsonpath='{.data.OIDC_ISSUER}'; echo"],
+                ['OIDC_CLI_CLIENT_ID in flui-api-config', "kubectl -n flui-system get cm flui-api-config -o jsonpath='{.data.OIDC_CLI_CLIENT_ID}'; echo"],
+                ['oidcClientId in flui-web-config', "kubectl -n flui-system get cm flui-web-config -o jsonpath='{.data.config\\.json}'; echo"],
+                ['flui-api OIDC log lines', "kubectl -n flui-system logs deploy/flui-api --tail=400 2>/dev/null | grep -iE 'oidc|bootstrap|zitadel' | tail -40 || echo '(no matches)'"],
+                ['/var/log/flui-oidc-bootstrap.log tail', "test -f /var/log/flui-oidc-bootstrap.log && tail -80 /var/log/flui-oidc-bootstrap.log || echo '(file missing)'"],
+                ['Zitadel pod status', "kubectl -n flui-system get pods 2>&1 | grep -i zitadel"],
+                ['Zitadel ExternalDomain', "for cm in $(kubectl -n flui-system get cm -o name | grep -i zitadel); do echo --- $cm ---; kubectl -n flui-system get $cm -o yaml | grep -iE 'external|domain' | head -10; done"],
+                ['flui-api pod -> Zitadel via tokenized Host', "POD=$(kubectl -n flui-system get pod -l app=flui-api -o jsonpath='{.items[0].metadata.name}'); ZDOM=$(kubectl -n flui-system get cm flui-api-config -o jsonpath='{.data.OIDC_ISSUER}' | sed 's|https://||'); PAT=$(kubectl -n flui-system get secret flui-secrets -o jsonpath='{.data.ZITADEL_SERVICE_ACCOUNT_PAT}' | base64 -d); echo POD=$POD; echo ZDOM_used=$ZDOM; kubectl -n flui-system exec $POD -c flui-api -- sh -c \"curl -s -o /tmp/o -w 'HTTP %{http_code}\\n' -H 'Host: $ZDOM' -H 'Authorization: Bearer $PAT' http://zitadel.flui-system.svc.cluster.local:8080/auth/v1/users/me; head -c 200 /tmp/o; echo; echo --no-host--; curl -s -o /tmp/o -w 'HTTP %{http_code}\\n' -H 'Authorization: Bearer $PAT' http://zitadel.flui-system.svc.cluster.local:8080/auth/v1/users/me; head -c 250 /tmp/o; echo\" 2>&1"],
+                ['axios from flui-api pod: capital Host vs lowercase host', "POD=$(kubectl -n flui-system get pod -l app=flui-api -o jsonpath='{.items[0].metadata.name}'); ZDOM=$(kubectl -n flui-system get cm flui-api-config -o jsonpath='{.data.OIDC_ISSUER}' | sed 's|https://||'); PAT=$(kubectl -n flui-system get secret flui-secrets -o jsonpath='{.data.ZITADEL_SERVICE_ACCOUNT_PAT}' | base64 -d); kubectl -n flui-system exec $POD -c flui-api -- node -e \"const a=require('axios');(async()=>{for (const k of ['Host','host']){try{const r=await a.get('http://zitadel.flui-system.svc.cluster.local:8080/auth/v1/users/me',{headers:{[k]:'$ZDOM',Authorization:'Bearer $PAT'},validateStatus:()=>true});console.log(k+'=>HTTP '+r.status+' '+JSON.stringify(r.data).slice(0,100));}catch(e){console.log(k+'=>ERR '+e.message)}}})();\" 2>&1"],
+                ['find postgres pod', "kubectl -n flui-system get pods -o wide | grep -iE 'postgres|sql' | head"],
+                ['flui-api DB env', "POD=$(kubectl -n flui-system get pod -l app=flui-api -o jsonpath='{.items[0].metadata.name}'); kubectl -n flui-system exec $POD -c flui-api -- sh -c 'echo DB_USERNAME=$DB_USERNAME; echo DB_NAME=$DB_NAME; echo DB_HOST=$DB_HOST'"],
+                ['cluster row (in-cluster DB)', "kubectl -n flui-system exec postgres-0 -- psql -U fluicloud -d fluicloud -tAc 'SELECT id, name, \"masterIpAddress\", \"nipHostnameToken\", \"clusterType\" FROM infrastructure_clusters;' 2>&1 | head"],
+                ['flui-api PAT in env vs in PVC', "POD=$(kubectl -n flui-system get pod -l app=flui-api -o jsonpath='{.items[0].metadata.name}'); kubectl -n flui-system exec $POD -c flui-api -- sh -c 'echo ENV_PAT_LEN=${#ZITADEL_SERVICE_ACCOUNT_PAT}; echo ENV_PAT_HEAD=${ZITADEL_SERVICE_ACCOUNT_PAT:0:8}'; SECRET_PAT=$(kubectl -n flui-system get secret flui-secrets -o jsonpath='{.data.ZITADEL_SERVICE_ACCOUNT_PAT}' | base64 -d); echo SECRET_PAT_LEN=${#SECRET_PAT}; echo SECRET_PAT_HEAD=${SECRET_PAT:0:8}; PVC_PAT=$(kubectl -n flui-system exec deploy/zitadel -- cat /pvc/flui-api-system.pat 2>/dev/null || echo none); echo PVC_PAT_LEN=${#PVC_PAT}; echo PVC_PAT_HEAD=${PVC_PAT:0:8}"],
+                ['Zitadel /auth/v1/users/me (what verifyPat hits)', "PAT=$(kubectl -n flui-system get secret flui-secrets -o jsonpath='{.data.ZITADEL_SERVICE_ACCOUNT_PAT}' | base64 -d); ZDOM=$(kubectl -n flui-system get cm flui-api-config -o jsonpath='{.data.OIDC_ISSUER}' | sed 's|https://||'); echo via_internal_dns:; curl -s -o /tmp/out -w 'HTTP %{http_code}\\n' -H \"Host: $ZDOM\" -H \"Authorization: Bearer $PAT\" http://zitadel.flui-system.svc.cluster.local:8080/auth/v1/users/me; head -c 300 /tmp/out; echo; echo via_clusterip:; ZSVC=$(kubectl -n flui-system get svc zitadel -o jsonpath='{.spec.clusterIP}'):8080; curl -s -o /tmp/out -w 'HTTP %{http_code}\\n' -H \"Host: $ZDOM\" -H \"Authorization: Bearer $PAT\" http://$ZSVC/auth/v1/users/me; head -c 300 /tmp/out; echo"],
+            ];
+            for (const [label, cmd] of cmds) {
+                this.log('\n=== ' + label + ' ===');
+                try {
+                    const out = await ssh.sshExec(ip, cmd);
+                    this.log(out.trim());
+                }
+                catch (e) {
+                    this.log('ERR: ' + (e?.message ?? String(e)));
+                }
+            }
+        }
+        finally {
+            await (0, nest_app_1.closeNestApp)();
+        }
+    }
+}
+DiagOidc.description = 'Internal diag: OIDC bootstrap state';
+DiagOidc.hidden = true;
+exports.default = DiagOidc;

package/lib/cli/src/commands/app/backup/create.d.ts

@@ -0,0 +1,20 @@
+import { Command } from '@oclif/core';
+export default class AppBackupCreate extends Command {
+    static readonly description: string;
+    static readonly examples: string[];
+    static readonly args: {
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static readonly flags: {
+        cluster: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        volume: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        description: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        bucket: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        endpoint: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        region: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'access-key': import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'secret-key': import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'key-prefix': import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}