@flui-cloud/cli 0.0.1

package/lib/cli/src/commands/env/update-firewall.js

@@ -0,0 +1,185 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const chalk_1 = __importDefault(require("chalk"));
+const ora_1 = __importDefault(require("ora"));
+const nest_app_1 = require("../../lib/nest-app");
+const nip_base_domain_util_1 = require("../../lib/nip-base-domain.util");
+const cli_observability_cluster_service_1 = require("../../services/cli-observability-cluster.service");
+const firewall_provider_factory_1 = require("../../../../src/modules/providers/core/factories/firewall-provider.factory");
+const ip_detection_1 = require("../../lib/utils/ip-detection");
+const cli_firewall_repository_1 = require("../../lib/repositories/cli-firewall.repository");
+const firewall_rules_1 = require("../../lib/templates/firewall-rules");
+const context_banner_1 = require("../../lib/context-banner");
+class EnvUpdateFirewall extends core_1.Command {
+    async run() {
+        const { flags } = await this.parse(EnvUpdateFirewall);
+        (0, context_banner_1.printContextBanner)();
+        let spinner = (0, ora_1.default)('Loading cluster information...').start();
+        try {
+            const app = await (0, nest_app_1.getNestApp)();
+            const observabilityService = app.get(cli_observability_cluster_service_1.CliObservabilityClusterService);
+            const ipService = app.get(ip_detection_1.IpDetectionService);
+            const firewallFactory = app.get(firewall_provider_factory_1.FirewallProviderFactory);
+            const firewallRepo = app.get(cli_firewall_repository_1.CliFirewallRepository);
+            const cluster = await observabilityService.getObservabilityCluster();
+            if (!cluster) {
+                spinner.fail('No observability cluster found');
+                console.log(chalk_1.default.yellow('\n⚠️  No observability cluster exists.\n'));
+                console.log(chalk_1.default.dim('Create one with:'));
+                console.log(`   ${chalk_1.default.cyan('flui env create')}\n`);
+                return;
+            }
+            spinner.succeed(`Cluster found (${cluster.provider})`);
+            const providerEnum = (cluster.provider || '').toLowerCase();
+            const firewallService = firewallFactory.getFirewallProviderOrFail(providerEnum);
+            const providerLabel = providerEnum.toUpperCase();
+            let sourceCidrs;
+            if (flags.ip) {
+                sourceCidrs = ipService.parseCidrList(flags.ip);
+                console.log(chalk_1.default.blue(`\nUsing custom IP(s): ${sourceCidrs.join(', ')}`));
+            }
+            else {
+                spinner = (0, ora_1.default)('Detecting public IP...').start();
+                const publicIp = await ipService.getPublicIp();
+                sourceCidrs = [ipService.toCidr(publicIp)];
+                spinner.succeed(`Auto-detected IP: ${sourceCidrs[0]}`);
+            }
+            spinner = (0, ora_1.default)('Finding firewall...').start();
+            let existingFirewall = await firewallRepo.findByClusterId(cluster.id);
+            if (!existingFirewall) {
+                const byProvider = await firewallRepo.findByProvider(providerLabel);
+                if (byProvider.length === 1) {
+                    existingFirewall = byProvider[0];
+                    spinner.text = `Adopting unlinked ${providerLabel} firewall ${existingFirewall.name}`;
+                }
+                else if (byProvider.length > 1) {
+                    const masterIds = (cluster.nodes || [])
+                        .filter((n) => n.nodeType === 'master')
+                        .map((n) => {
+                        const raw = String(n.providerResourceId || '');
+                        const parts = raw.split(':');
+                        return parts.at(-1);
+                    })
+                        .filter(Boolean);
+                    spinner.text = `Disambiguating ${byProvider.length} firewall candidates by master attachment...`;
+                    const matches = [];
+                    for (const fw of byProvider) {
+                        const details = await firewallService
+                            .getFirewall(fw.id)
+                            .catch(() => null);
+                        if (!details)
+                            continue;
+                        const attached = new Set(details.appliedTo.map((a) => a.serverId));
+                        if (masterIds.some((m) => attached.has(m))) {
+                            matches.push(fw);
+                        }
+                    }
+                    if (matches.length === 1) {
+                        existingFirewall = matches[0];
+                        spinner.text = `Found attached firewall ${existingFirewall.name}`;
+                    }
+                    else if (matches.length === 0) {
+                        spinner.fail('No firewall currently attached to the cluster master');
+                        this.exit(1);
+                    }
+                    else {
+                        spinner.fail('Multiple firewalls attached, cannot disambiguate');
+                        for (const f of matches)
+                            this.log(`  - ${f.name} (${f.id})`);
+                        this.exit(1);
+                    }
+                }
+            }
+            if (existingFirewall) {
+                spinner.text = 'Updating firewall rules...';
+                const newRules = (0, firewall_rules_1.OBSERVABILITY_FIREWALL_RULES)(sourceCidrs);
+                await firewallService.updateFirewallRules(existingFirewall.id, newRules);
+                existingFirewall.clusterId = cluster.id;
+                existingFirewall.provider = providerLabel;
+                existingFirewall.sourceCidrs = sourceCidrs;
+                existingFirewall.rules = newRules;
+                await firewallRepo.save(existingFirewall);
+                spinner.succeed('Firewall updated successfully');
+            }
+            else {
+                spinner.text = 'Creating firewall...';
+                const firewallName = `flui-observability-${cluster.id}`;
+                const rules = (0, firewall_rules_1.OBSERVABILITY_FIREWALL_RULES)(sourceCidrs);
+                const result = await firewallService.createFirewall({
+                    name: firewallName,
+                    labels: [
+                        { key: 'managed-by', value: 'flui-cloud' },
+                        { key: 'flui-resource-type', value: 'firewall' },
+                        { key: 'flui-cluster-id', value: cluster.id },
+                        { key: 'flui-cluster-type', value: 'observability' },
+                    ],
+                    rules,
+                    applyToLabelSelector: `flui-cluster-id=${cluster.id}`,
+                });
+                const serverIds = (cluster.nodes || [])
+                    .map((n) => n.providerResourceId)
+                    .filter((x) => typeof x === 'string' && x.length > 0);
+                if (serverIds.length > 0) {
+                    await firewallService.applyToServers(result.firewallId, serverIds);
+                }
+                await firewallRepo.save({
+                    id: result.firewallId,
+                    name: firewallName,
+                    provider: providerLabel,
+                    clusterId: cluster.id,
+                    rules,
+                    appliedToServerIds: serverIds,
+                    sourceCidrs,
+                    labels: [
+                        { key: 'managed-by', value: 'flui-cloud' },
+                        { key: 'flui-cluster-id', value: cluster.id },
+                    ],
+                });
+                spinner.succeed('Firewall created successfully');
+            }
+            console.log(chalk_1.default.cyan('\n📋 Firewall Configuration:\n'));
+            console.log(`   ${chalk_1.default.bold('Provider:')}   ${providerLabel}`);
+            console.log(`   ${chalk_1.default.bold('Cluster:')}    ${cluster.name}`);
+            console.log(`   ${chalk_1.default.bold('Source IP:')}  ${sourceCidrs.join(', ')}`);
+            console.log('');
+            console.log(chalk_1.default.bold('Exposed Services:'));
+            console.log(`   SSH:         ${cluster.masterIpAddress}:22`);
+            const baseDomain = (0, nip_base_domain_util_1.buildNipBaseDomain)(cluster.masterIpAddress, cluster.nipHostnameToken);
+            console.log(`   Flui API:    https://api.${baseDomain}`);
+            console.log(`   Dashboard:   https://app.${baseDomain}`);
+            console.log(`   Grafana/Prometheus/Loki: cluster-internal (kubectl port-forward)`);
+            console.log('');
+        }
+        catch (error) {
+            spinner.fail('Failed to configure firewall');
+            console.log(chalk_1.default.red('\n❌ Error:\n'));
+            if (error instanceof Error) {
+                console.log(`   ${error.message}\n`);
+            }
+            else {
+                console.log(`   ${String(error)}\n`);
+            }
+            this.exit(1);
+        }
+        finally {
+            await (0, nest_app_1.closeNestApp)();
+        }
+    }
+}
+EnvUpdateFirewall.description = 'Create or update firewall IP ranges for observability cluster';
+EnvUpdateFirewall.examples = [
+    '<%= config.bin %> <%= command.id %>',
+    '<%= config.bin %> <%= command.id %> --ip 203.0.113.42',
+    '<%= config.bin %> <%= command.id %> --ip "203.0.113.0/24,198.51.100.5/32"',
+];
+EnvUpdateFirewall.flags = {
+    ip: core_1.Flags.string({
+        description: 'Source IP/CIDR or comma-separated list (default: auto-detect current IP)',
+        required: false,
+    }),
+};
+exports.default = EnvUpdateFirewall;

package/lib/cli/src/commands/integration/connect.d.ts

@@ -0,0 +1,13 @@
+import { Command } from '@oclif/core';
+export default class IntegrationConnect extends Command {
+    static readonly description = "Connect a third-party integration to your Flui account. Currently supports GitHub: opens a browser to install the Flui GitHub App, then waits for the local callback to confirm the connection.";
+    static readonly examples: string[];
+    static readonly args: {
+        provider: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static readonly flags: {
+        headless: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+    private waitForCallback;
+}

package/lib/cli/src/commands/integration/connect.js

@@ -0,0 +1,161 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const chalk_1 = __importDefault(require("chalk"));
+const ora_1 = __importDefault(require("ora"));
+const http = __importStar(require("node:http"));
+const api_client_1 = require("../../lib/api-client");
+const config_storage_1 = require("../../lib/config-storage");
+const browser_callback_1 = require("../../lib/browser-callback");
+const CONNECT_TIMEOUT_MS = 5 * 60 * 1000;
+class IntegrationConnect extends core_1.Command {
+    async run() {
+        const { args, flags } = await this.parse(IntegrationConnect);
+        const configStorage = new config_storage_1.ConfigStorage();
+        const apiUrl = configStorage.getApiUrlOrThrow();
+        const apiKey = configStorage.getApiKey();
+        if (!apiKey) {
+            this.error('Not logged in. Run `flui auth login` first.', { exit: 1 });
+        }
+        const api = new api_client_1.ApiClient({ baseUrl: apiUrl, apiKey });
+        if (args.provider !== 'github') {
+            this.error(`Unknown provider "${args.provider}"`, { exit: 1 });
+        }
+        const port = await (0, browser_callback_1.findFreeCallbackPort)();
+        const cliCallbackUrl = `http://127.0.0.1:${port}/callback`;
+        const spinner = (0, ora_1.default)('Requesting GitHub App install URL…').start();
+        let install;
+        try {
+            install = await api.get(`/repositories/github-app/install-url?cliCallback=${encodeURIComponent(cliCallbackUrl)}`);
+            spinner.stop();
+        }
+        catch (error) {
+            spinner.fail('Failed to get install URL');
+            console.log(chalk_1.default.red(`  ${error.message}`));
+            this.exit(1);
+        }
+        if (install.alreadyConnected) {
+            console.log(chalk_1.default.green(`\n  ✔ GitHub is already connected as ${chalk_1.default.bold(install.login ?? '?')}.\n`));
+            return;
+        }
+        if (!install.installUrl) {
+            console.log(chalk_1.default.red('\n  API did not return an install URL. Please retry or contact support.\n'));
+            this.exit(1);
+        }
+        if (flags.headless) {
+            console.log('');
+            console.log(chalk_1.default.dim('  Open this URL in a browser to install the GitHub App:'));
+            console.log(`  ${chalk_1.default.cyan(install.installUrl)}`);
+            console.log('');
+            console.log(chalk_1.default.dim(`  Waiting for the post-install callback on ${cliCallbackUrl}…`));
+        }
+        else {
+            const opened = (0, browser_callback_1.openInBrowser)(install.installUrl);
+            if (opened) {
+                console.log(chalk_1.default.dim(`\n  Opened browser to install the Flui GitHub App.`));
+            }
+            else {
+                console.log(chalk_1.default.yellow(`\n  Could not open browser. Open this URL manually:\n  ${install.installUrl}\n`));
+            }
+            console.log(chalk_1.default.dim(`  Waiting for the post-install callback on ${cliCallbackUrl}…`));
+        }
+        const result = await this.waitForCallback(port);
+        if (result.status === 'connected') {
+            console.log(chalk_1.default.green(`\n  ✔ GitHub connected as ${chalk_1.default.bold(result.login ?? '?')}.\n`));
+            console.log(chalk_1.default.dim(`  Next: \`flui repo connect <owner/repo>\` to make a repository deployable.\n`));
+            return;
+        }
+        console.log(chalk_1.default.red(`\n  ✖ Connection failed: ${result.error}\n`));
+        this.exit(1);
+    }
+    waitForCallback(port) {
+        return new Promise((resolve) => {
+            const timer = setTimeout(() => {
+                server.close();
+                resolve({
+                    status: 'error',
+                    error: `timed out after ${CONNECT_TIMEOUT_MS / 1000}s`,
+                });
+            }, CONNECT_TIMEOUT_MS);
+            const server = http.createServer((req, res) => {
+                const url = new URL(req.url ?? '/', `http://127.0.0.1:${port}`);
+                if (url.pathname !== '/callback') {
+                    res.writeHead(404);
+                    res.end();
+                    return;
+                }
+                const status = url.searchParams.get('status');
+                const login = url.searchParams.get('login');
+                const error = url.searchParams.get('error');
+                if (status === 'connected' && login) {
+                    res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+                    res.end((0, browser_callback_1.renderPage)('GitHub connected', `<h2>GitHub connected</h2><p>Connected as <code>${login}</code>. You can close this tab and return to the terminal.</p>`));
+                    clearTimeout(timer);
+                    server.close(() => resolve({ status: 'connected', login }));
+                    return;
+                }
+                const errMsg = error ?? 'unknown callback shape';
+                res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
+                res.end((0, browser_callback_1.renderPage)('GitHub connection failed', `<h2>Connection failed</h2><p>${errMsg}</p>`));
+                clearTimeout(timer);
+                server.close(() => resolve({ status: 'error', error: errMsg }));
+            });
+            server.listen(port, '127.0.0.1');
+        });
+    }
+}
+IntegrationConnect.description = 'Connect a third-party integration to your Flui account. Currently supports GitHub: opens a browser to install the Flui GitHub App, then waits for the local callback to confirm the connection.';
+IntegrationConnect.examples = [
+    '<%= config.bin %> <%= command.id %> github',
+    '<%= config.bin %> <%= command.id %> github --headless',
+];
+IntegrationConnect.args = {
+    provider: core_1.Args.string({
+        description: 'Integration provider (currently only `github`)',
+        required: true,
+        options: ['github'],
+    }),
+};
+IntegrationConnect.flags = {
+    headless: core_1.Flags.boolean({
+        description: 'Print the install URL instead of opening a browser (useful over SSH)',
+        default: false,
+    }),
+};
+exports.default = IntegrationConnect;

package/lib/cli/src/commands/integration/ghcr-pat/revoke.d.ts

@@ -0,0 +1,9 @@
+import { Command } from '@oclif/core';
+export default class IntegrationGhcrPatRevoke extends Command {
+    static readonly description = "Revoke the GHCR PAT stored in Flui. Does NOT revoke the token on GitHub \u2014 do that separately at https://github.com/settings/tokens. After revoking, `flui deploy` will fail until a new PAT is set.";
+    static readonly examples: string[];
+    static readonly flags: {
+        yes: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/lib/cli/src/commands/integration/ghcr-pat/revoke.js

@@ -0,0 +1,61 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const chalk_1 = __importDefault(require("chalk"));
+const ora_1 = __importDefault(require("ora"));
+const api_client_1 = require("../../../lib/api-client");
+const config_storage_1 = require("../../../lib/config-storage");
+const prompts_1 = require("../../../lib/prompts");
+class IntegrationGhcrPatRevoke extends core_1.Command {
+    async run() {
+        const { flags } = await this.parse(IntegrationGhcrPatRevoke);
+        const configStorage = new config_storage_1.ConfigStorage();
+        const apiUrl = configStorage.getApiUrlOrThrow();
+        const apiKey = configStorage.getApiKey();
+        if (!apiKey) {
+            this.error('Not logged in. Run `flui auth login` first.', { exit: 1 });
+        }
+        const api = new api_client_1.ApiClient({ baseUrl: apiUrl, apiKey });
+        if (!flags.yes) {
+            const ok = await (0, prompts_1.confirmPrompt)('Revoke the stored GHCR PAT? Future `flui deploy` will fail until a new one is set.', false);
+            if (!ok) {
+                console.log(chalk_1.default.dim('\n  Cancelled.\n'));
+                return;
+            }
+        }
+        const spinner = (0, ora_1.default)('Revoking GHCR PAT…').start();
+        try {
+            await api.delete('/repositories/github-app/packages-pat');
+            spinner.succeed('GHCR PAT revoked');
+            console.log('');
+            console.log(chalk_1.default.yellow('  Remember to also delete it on GitHub at https://github.com/settings/tokens'));
+            console.log('');
+        }
+        catch (error) {
+            spinner.fail('Failed to revoke GHCR PAT');
+            if (error instanceof api_client_1.ApiError && error.statusCode === 404) {
+                console.log(chalk_1.default.dim('  No PAT was configured.'));
+            }
+            else {
+                console.log(chalk_1.default.red(`  ${error.message}`));
+            }
+            this.exit(1);
+        }
+    }
+}
+IntegrationGhcrPatRevoke.description = 'Revoke the GHCR PAT stored in Flui. Does NOT revoke the token on GitHub — do that separately at https://github.com/settings/tokens. After revoking, `flui deploy` will fail until a new PAT is set.';
+IntegrationGhcrPatRevoke.examples = [
+    '<%= config.bin %> <%= command.id %>',
+    '<%= config.bin %> <%= command.id %> --yes',
+];
+IntegrationGhcrPatRevoke.flags = {
+    yes: core_1.Flags.boolean({
+        char: 'y',
+        description: 'Skip the confirmation prompt',
+        default: false,
+    }),
+};
+exports.default = IntegrationGhcrPatRevoke;

package/lib/cli/src/commands/integration/ghcr-pat/set.d.ts

@@ -0,0 +1,12 @@
+import { Command } from '@oclif/core';
+export default class IntegrationGhcrPatSet extends Command {
+    static readonly description = "Save (or replace) the GitHub classic PAT used by Flui to pull container images from GHCR. Required for `flui deploy` to work \u2014 GitHub App and OAuth tokens cannot read container packages (see https://github.com/orgs/community/discussions/34084).";
+    static readonly examples: string[];
+    static readonly flags: {
+        headless: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+    private printResult;
+    private printSaveError;
+    private printInstructions;
+}

package/lib/cli/src/commands/integration/ghcr-pat/set.js

@@ -0,0 +1,141 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const chalk_1 = __importDefault(require("chalk"));
+const ora_1 = __importDefault(require("ora"));
+const api_client_1 = require("../../../lib/api-client");
+const config_storage_1 = require("../../../lib/config-storage");
+const browser_callback_1 = require("../../../lib/browser-callback");
+const prompts_1 = require("../../../lib/prompts");
+const PAT_PATTERN = /^(ghp_|github_pat_)/;
+const DEFAULT_EXPIRY_DAYS = 90;
+class IntegrationGhcrPatSet extends core_1.Command {
+    async run() {
+        const { flags } = await this.parse(IntegrationGhcrPatSet);
+        const configStorage = new config_storage_1.ConfigStorage();
+        const apiUrl = configStorage.getApiUrlOrThrow();
+        const apiKey = configStorage.getApiKey();
+        if (!apiKey) {
+            this.error('Not logged in. Run `flui auth login` first.', { exit: 1 });
+        }
+        const api = new api_client_1.ApiClient({ baseUrl: apiUrl, apiKey });
+        let existing = null;
+        try {
+            existing = await api.get('/repositories/github-app/packages-pat/status');
+        }
+        catch {
+            /* empty */
+        }
+        this.printInstructions(existing?.configured ?? false, flags.headless);
+        const token = await (0, prompts_1.promptMaskedInput)('Token');
+        if (!token) {
+            this.error('Token cannot be empty', { exit: 1 });
+        }
+        if (!PAT_PATTERN.test(token)) {
+            this.error('Token must start with `ghp_` (classic PAT) or `github_pat_` (fine-grained PAT).', { exit: 1 });
+        }
+        const defaultExpiry = new Date(Date.now() + DEFAULT_EXPIRY_DAYS * 24 * 60 * 60 * 1000)
+            .toISOString()
+            .slice(0, 10);
+        const expiry = await (0, prompts_1.promptInput)({
+            message: 'Expiry date (YYYY-MM-DD, must match the one set on GitHub)',
+            default: defaultExpiry,
+            validate: (v) => {
+                if (!/^\d{4}-\d{2}-\d{2}$/.test(v))
+                    return 'Expected format YYYY-MM-DD';
+                const d = new Date(v);
+                if (Number.isNaN(d.getTime()))
+                    return 'Not a valid date';
+                if (d.getTime() < Date.now())
+                    return 'Expiry must be in the future';
+                return null;
+            },
+        });
+        const expiresAt = new Date(`${expiry}T00:00:00.000Z`).toISOString();
+        const action = existing?.configured ? 'Rotating' : 'Saving';
+        const endpoint = existing?.configured
+            ? '/repositories/github-app/packages-pat/rotate'
+            : '/repositories/github-app/packages-pat';
+        const method = existing?.configured ? 'put' : 'post';
+        const spinner = (0, ora_1.default)(`${action} GHCR PAT…`).start();
+        try {
+            const result = await api[method](endpoint, {
+                token,
+                expiresAt,
+            });
+            spinner.succeed(`${action.replace(/ing$/, 'ed')} GHCR PAT`);
+            this.printResult(result);
+        }
+        catch (error) {
+            spinner.fail(`Failed to ${action.toLowerCase()} GHCR PAT`);
+            this.printSaveError(error);
+            this.exit(1);
+        }
+    }
+    printResult(result) {
+        console.log('');
+        if (result.githubLogin) {
+            console.log(`  GitHub user: ${chalk_1.default.bold(result.githubLogin)}`);
+        }
+        if (result.scopes && result.scopes.length > 0) {
+            console.log(`  Scopes:      ${result.scopes.join(', ')}`);
+        }
+        if (result.expiresAt) {
+            console.log(`  Expires:     ${new Date(result.expiresAt).toISOString().slice(0, 10)}`);
+        }
+        console.log('');
+        console.log(chalk_1.default.dim('  You can now `flui deploy`. Set a calendar reminder to rotate before expiry.'));
+        console.log('');
+    }
+    printSaveError(error) {
+        if (error instanceof api_client_1.ApiError && error.statusCode === 400) {
+            console.log(chalk_1.default.red(`  ${error.message}`));
+            console.log(chalk_1.default.yellow('  GitHub rejected the token. Check it has read:packages scope and is not expired.'));
+            return;
+        }
+        console.log(chalk_1.default.red(`  ${error.message}`));
+    }
+    printInstructions(alreadyConfigured, headless) {
+        const prefilledUrl = 'https://github.com/settings/tokens/new?scopes=read:packages,delete:packages&description=Flui+GHCR+pull';
+        console.log('');
+        if (alreadyConfigured) {
+            console.log(chalk_1.default.yellow('  A GHCR PAT is already configured. This will replace it.'));
+            console.log('');
+        }
+        console.log(`  ${chalk_1.default.bold('Generate a GitHub Personal Access Token (classic)')}`);
+        console.log('');
+        const opened = !headless && (0, browser_callback_1.openInBrowser)(prefilledUrl);
+        if (opened) {
+            console.log(chalk_1.default.dim('  Opened browser at the token-creation page.'));
+            console.log(chalk_1.default.dim('  If it did not open, use this URL:'));
+            console.log(`  ${chalk_1.default.cyan(prefilledUrl)}`);
+        }
+        else {
+            console.log(`  Pre-filled link (scopes already set):`);
+            console.log(`  ${chalk_1.default.cyan(prefilledUrl)}`);
+        }
+        console.log('');
+        console.log(`  Required scopes: ${chalk_1.default.bold('read:packages')} ${chalk_1.default.dim('(or write:packages)')}`);
+        console.log(`  Recommended:     ${chalk_1.default.bold('delete:packages')} ${chalk_1.default.dim('(lets Flui clean up old images)')}`);
+        console.log(`  Expiry:          ${chalk_1.default.dim('pick a date (90 days is a sensible default)')}`);
+        console.log('');
+        console.log(chalk_1.default.dim('  Fine-grained PATs (github_pat_…) are also accepted as long as'));
+        console.log(chalk_1.default.dim('  they grant Packages: read on the relevant org/account.'));
+        console.log('');
+    }
+}
+IntegrationGhcrPatSet.description = 'Save (or replace) the GitHub classic PAT used by Flui to pull container images from GHCR. Required for `flui deploy` to work — GitHub App and OAuth tokens cannot read container packages (see https://github.com/orgs/community/discussions/34084).';
+IntegrationGhcrPatSet.examples = [
+    '<%= config.bin %> <%= command.id %>',
+    '<%= config.bin %> <%= command.id %> --headless',
+];
+IntegrationGhcrPatSet.flags = {
+    headless: core_1.Flags.boolean({
+        description: 'Print the GitHub token-creation URL instead of opening a browser (useful over SSH)',
+        default: false,
+    }),
+};
+exports.default = IntegrationGhcrPatSet;

package/lib/cli/src/commands/integration/ghcr-pat/status.d.ts

@@ -0,0 +1,6 @@
+import { Command } from '@oclif/core';
+export default class IntegrationGhcrPatStatus extends Command {
+    static readonly description = "Show the current state of the GHCR PAT used by Flui to pull container images from GHCR.";
+    static readonly examples: string[];
+    run(): Promise<void>;
+}

package/lib/cli/src/commands/integration/ghcr-pat/status.js

@@ -0,0 +1,69 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const chalk_1 = __importDefault(require("chalk"));
+const api_client_1 = require("../../../lib/api-client");
+const config_storage_1 = require("../../../lib/config-storage");
+class IntegrationGhcrPatStatus extends core_1.Command {
+    async run() {
+        const configStorage = new config_storage_1.ConfigStorage();
+        const apiUrl = configStorage.getApiUrlOrThrow();
+        const apiKey = configStorage.getApiKey();
+        if (!apiKey) {
+            this.error('Not logged in. Run `flui auth login` first.', { exit: 1 });
+        }
+        const api = new api_client_1.ApiClient({ baseUrl: apiUrl, apiKey });
+        let status;
+        try {
+            status = await api.get('/repositories/github-app/packages-pat/status');
+        }
+        catch (error) {
+            this.error(`Failed to fetch GHCR PAT status: ${error.message}`, { exit: 1 });
+        }
+        console.log('');
+        if (!status.configured) {
+            console.log(`  ${chalk_1.default.bold('Status:')} ${chalk_1.default.yellow('not configured')}`);
+            console.log('');
+            console.log(chalk_1.default.dim(`  Run \`${chalk_1.default.cyan('flui integration ghcr-pat set')}\` to add one.`));
+            console.log('');
+            return;
+        }
+        const statusColor = status.status === 'VALID'
+            ? chalk_1.default.green
+            : status.status === 'EXPIRING_SOON'
+                ? chalk_1.default.yellow
+                : chalk_1.default.red;
+        console.log(`  ${chalk_1.default.bold('Status:')}    ${statusColor(status.status ?? 'unknown')}`);
+        if (status.githubLogin) {
+            console.log(`  GitHub user: ${chalk_1.default.bold(status.githubLogin)}`);
+        }
+        if (status.scopes && status.scopes.length > 0) {
+            console.log(`  Scopes:      ${status.scopes.join(', ')}`);
+        }
+        if (status.expiresAt) {
+            const date = new Date(status.expiresAt).toISOString().slice(0, 10);
+            const days = status.daysUntilExpiry;
+            const suffix = days != null
+                ? days < 0
+                    ? chalk_1.default.red(` (expired ${-days}d ago)`)
+                    : days <= 14
+                        ? chalk_1.default.yellow(` (${days}d left)`)
+                        : chalk_1.default.dim(` (${days}d left)`)
+                : '';
+            console.log(`  Expires:     ${date}${suffix}`);
+        }
+        if (status.lastRotatedAt) {
+            console.log(`  Rotated:     ${new Date(status.lastRotatedAt).toISOString().slice(0, 10)}`);
+        }
+        if (status.lastVerifiedAt) {
+            console.log(`  Verified:    ${new Date(status.lastVerifiedAt).toISOString().slice(0, 10)}`);
+        }
+        console.log('');
+    }
+}
+IntegrationGhcrPatStatus.description = 'Show the current state of the GHCR PAT used by Flui to pull container images from GHCR.';
+IntegrationGhcrPatStatus.examples = ['<%= config.bin %> <%= command.id %>'];
+exports.default = IntegrationGhcrPatStatus;