@flui-cloud/cli 0.0.1

package/lib/cli/src/lib/api-client.js

@@ -0,0 +1,162 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiClient = exports.ApiError = void 0;
+const axios_1 = __importDefault(require("axios"));
+const https = __importStar(require("node:https"));
+const common_1 = require("@nestjs/common");
+class ApiError extends Error {
+    constructor(message, statusCode, details) {
+        super(message);
+        this.name = 'ApiError';
+        this.statusCode = statusCode;
+        this.details = details;
+    }
+}
+exports.ApiError = ApiError;
+let ApiClient = class ApiClient {
+    constructor(config) {
+        this.baseUrl = config.baseUrl;
+        this.client = axios_1.default.create({
+            baseURL: config.baseUrl,
+            timeout: config.timeout || 30000,
+            headers: {
+                'Content-Type': 'application/json',
+                ...(config.apiKey ? { Authorization: `Bearer ${config.apiKey}` } : {}),
+            },
+            httpsAgent: new https.Agent({ rejectUnauthorized: false }),
+        });
+        // Add response interceptor for error handling
+        this.client.interceptors.response.use((response) => response, (error) => {
+            return Promise.reject(this.normalizeError(error));
+        });
+    }
+    /**
+     * Normalize Axios errors to ApiError format
+     */
+    normalizeError(error) {
+        if (error.response) {
+            const data = error.response.data;
+            return new ApiError(data?.message || error.message, error.response.status, data);
+        }
+        else if (error.request) {
+            return new ApiError('API server not reachable. Please check the API URL and network connection.', undefined, error.message);
+        }
+        else {
+            return new ApiError(error.message);
+        }
+    }
+    /**
+     * GET request
+     */
+    async get(path) {
+        const response = await this.client.get(path);
+        return response.data;
+    }
+    /**
+     * POST request
+     */
+    async post(path, data) {
+        const response = await this.client.post(path, data);
+        return response.data;
+    }
+    /**
+     * PUT request
+     */
+    async put(path, data) {
+        const response = await this.client.put(path, data);
+        return response.data;
+    }
+    /**
+     * PATCH request
+     */
+    async patch(path, data) {
+        const response = await this.client.patch(path, data);
+        return response.data;
+    }
+    /**
+     * DELETE request
+     */
+    async delete(path, config) {
+        const response = await this.client.delete(path, config);
+        return response.data;
+    }
+    /**
+     * Get base URL
+     */
+    getBaseUrl() {
+        return this.baseUrl;
+    }
+    /**
+     * Get available node sizes/server types for a provider
+     */
+    async getNodeSizes(provider, region, skipCache = false) {
+        const params = new URLSearchParams();
+        if (region) {
+            params.append('region', region);
+        }
+        if (skipCache) {
+            params.append('skipCache', 'true');
+        }
+        const queryString = params.toString();
+        const qs = queryString ? `?${queryString}` : '';
+        const path = `/management/providers/${provider}/node-sizes${qs}`;
+        return this.get(path);
+    }
+    /**
+     * Clear node sizes cache for a provider
+     */
+    async clearNodeSizesCache(provider) {
+        const path = `/management/cache/providers/${provider}/node-sizes`;
+        return this.delete(path);
+    }
+};
+exports.ApiClient = ApiClient;
+exports.ApiClient = ApiClient = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [Object])
+], ApiClient);

package/lib/cli/src/lib/backup-client.d.ts

@@ -0,0 +1,131 @@
+import { ApiClient } from './api-client';
+export interface BackupDestination {
+    id: string;
+    name: string;
+    provider: string;
+    endpoint: string;
+    region: string;
+    bucket: string;
+    pathPrefix?: string;
+    encryptionMode?: string;
+    forcePathStyle?: boolean;
+    useSse?: boolean;
+    usableForEtcdL1?: boolean;
+    costPerGbMonthCents?: number;
+    health?: string;
+    usageBytes?: number;
+    createdAt?: string;
+    updatedAt?: string;
+}
+export interface CreateBackupDestinationInput {
+    name: string;
+    provider: 'hetzner_object_storage' | 'scaleway_object_storage' | 'minio' | 'generic_s3';
+    endpoint: string;
+    region: string;
+    bucket: string;
+    pathPrefix?: string;
+    accessKey: string;
+    secretKey: string;
+    encryptionMode?: 'flui_managed' | 'byo_passphrase' | 'none';
+    encryptionPassphrase?: string;
+    forcePathStyle?: boolean;
+    useSse?: boolean;
+    usableForEtcdL1?: boolean;
+    costPerGbMonthCents?: number;
+}
+export interface BackupPolicy {
+    id: string;
+    name: string;
+    clusterId: string;
+    scope: string;
+    profile: string;
+    enabled?: boolean;
+    schedule?: string;
+    retentionDays?: number;
+    destinations?: Array<{
+        destinationId: string;
+        role: string;
+        priority?: number;
+    }>;
+    createdAt?: string;
+    updatedAt?: string;
+}
+export interface CreatePolicyInput {
+    name: string;
+    clusterId: string;
+    scope: string;
+    profile: string;
+    schedule?: string;
+    retentionDays?: number;
+    retentionMaxCopies?: number;
+    enabled?: boolean;
+    destinations: Array<{
+        destinationId: string;
+        role: 'primary' | 'replica';
+        priority?: number;
+    }>;
+    scopeSelector?: Record<string, any>;
+}
+export interface BackupJob {
+    id: string;
+    policyId: string;
+    status: string;
+    startedAt?: string;
+    completedAt?: string;
+    bytesTransferred?: number;
+    errorMessage?: string;
+}
+export interface RestoreJob {
+    id: string;
+    status: string;
+    artifactId: string;
+    sourceDestinationId: string;
+    targetClusterId: string;
+    targetKind: string;
+    strategy?: string;
+    startedAt?: string;
+    completedAt?: string;
+    errorMessage?: string;
+}
+export declare class BackupClient {
+    private readonly api;
+    constructor(api: ApiClient);
+    static fromConfig(): BackupClient;
+    listDestinations(): Promise<BackupDestination[]>;
+    getDestination(id: string): Promise<BackupDestination>;
+    createDestination(input: CreateBackupDestinationInput): Promise<BackupDestination>;
+    testDestination(id: string): Promise<{
+        healthy: boolean;
+        error?: string;
+    }>;
+    refreshDestinationUsage(id: string): Promise<{
+        ok: boolean;
+    }>;
+    deleteDestination(id: string): Promise<{
+        ok: boolean;
+    }>;
+    listPolicies(): Promise<BackupPolicy[]>;
+    listPoliciesForCluster(clusterId: string): Promise<BackupPolicy[]>;
+    getPolicy(id: string): Promise<BackupPolicy>;
+    createPolicy(input: CreatePolicyInput): Promise<BackupPolicy>;
+    deletePolicy(id: string): Promise<{
+        ok: boolean;
+    }>;
+    runJobForPolicy(policyId: string): Promise<BackupJob>;
+    getJob(id: string): Promise<BackupJob>;
+    listJobsForCluster(clusterId: string): Promise<BackupJob[]>;
+    previewRestore(input: {
+        artifactId: string;
+        sourceDestinationId: string;
+    }): Promise<Record<string, any>>;
+    createRestore(input: {
+        artifactId: string;
+        sourceDestinationId: string;
+        targetClusterId: string;
+        targetKind: string;
+        targetSelector?: Record<string, any>;
+        strategy?: string;
+    }): Promise<RestoreJob>;
+    listRestores(): Promise<RestoreJob[]>;
+    getRestore(id: string): Promise<RestoreJob>;
+}

package/lib/cli/src/lib/backup-client.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BackupClient = void 0;
+const api_client_1 = require("./api-client");
+const config_storage_1 = require("./config-storage");
+class BackupClient {
+    constructor(api) {
+        this.api = api;
+    }
+    static fromConfig() {
+        const cfg = new config_storage_1.ConfigStorage();
+        const apiUrl = cfg.getApiUrlOrThrow();
+        const apiKey = cfg.getApiKey();
+        if (!apiKey) {
+            throw new Error('Not logged in. Run `flui auth login` first or check API key.');
+        }
+        return new BackupClient(new api_client_1.ApiClient({ baseUrl: apiUrl, apiKey }));
+    }
+    // ─── Destinations ────────────────────────────────────────────────────────
+    async listDestinations() {
+        return this.api.get('/backup-destinations');
+    }
+    async getDestination(id) {
+        return this.api.get(`/backup-destinations/${id}`);
+    }
+    async createDestination(input) {
+        return this.api.post('/backup-destinations', input);
+    }
+    async testDestination(id) {
+        return this.api.post(`/backup-destinations/${id}/test`);
+    }
+    async refreshDestinationUsage(id) {
+        return this.api.post(`/backup-destinations/${id}/refresh-usage`);
+    }
+    async deleteDestination(id) {
+        return this.api.delete(`/backup-destinations/${id}`);
+    }
+    // ─── Policies ────────────────────────────────────────────────────────────
+    async listPolicies() {
+        return this.api.get('/backup-policies');
+    }
+    async listPoliciesForCluster(clusterId) {
+        return this.api.get(`/backup-policies/cluster/${clusterId}`);
+    }
+    async getPolicy(id) {
+        return this.api.get(`/backup-policies/${id}`);
+    }
+    async createPolicy(input) {
+        return this.api.post('/backup-policies', input);
+    }
+    async deletePolicy(id) {
+        return this.api.delete(`/backup-policies/${id}`);
+    }
+    // ─── Jobs ────────────────────────────────────────────────────────────────
+    async runJobForPolicy(policyId) {
+        return this.api.post('/backup-jobs', { policyId });
+    }
+    async getJob(id) {
+        return this.api.get(`/backup-jobs/${id}`);
+    }
+    async listJobsForCluster(clusterId) {
+        return this.api.get(`/backup-jobs/cluster/${clusterId}`);
+    }
+    // ─── Restore ─────────────────────────────────────────────────────────────
+    async previewRestore(input) {
+        return this.api.post('/restore-jobs/preview', input);
+    }
+    async createRestore(input) {
+        return this.api.post('/restore-jobs', input);
+    }
+    async listRestores() {
+        return this.api.get('/restore-jobs');
+    }
+    async getRestore(id) {
+        return this.api.get(`/restore-jobs/${id}`);
+    }
+}
+exports.BackupClient = BackupClient;

package/lib/cli/src/lib/browser-callback.d.ts

@@ -0,0 +1,3 @@
+export declare function findFreeCallbackPort(): Promise<number>;
+export declare function openInBrowser(url: string): boolean;
+export declare function renderPage(title: string, body: string): string;

package/lib/cli/src/lib/browser-callback.js

@@ -0,0 +1,83 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findFreeCallbackPort = findFreeCallbackPort;
+exports.openInBrowser = openInBrowser;
+exports.renderPage = renderPage;
+const http = __importStar(require("node:http"));
+const node_child_process_1 = require("node:child_process");
+const CALLBACK_PORTS = [8899, 8900, 8901, 8902, 8910];
+function tryListen(port) {
+    return new Promise((resolve) => {
+        const server = http.createServer();
+        server.once('error', () => resolve(false));
+        server.listen(port, '127.0.0.1', () => {
+            server.close(() => resolve(true));
+        });
+    });
+}
+async function findFreeCallbackPort() {
+    for (const port of CALLBACK_PORTS) {
+        if (await tryListen(port))
+            return port;
+    }
+    throw new Error(`No free local callback port available in [${CALLBACK_PORTS.join(', ')}]`);
+}
+function openInBrowser(url) {
+    let cmd;
+    let args;
+    if (process.platform === 'darwin') {
+        cmd = 'open';
+        args = [url];
+    }
+    else if (process.platform === 'win32') {
+        cmd = 'cmd';
+        args = ['/c', 'start', '', url];
+    }
+    else {
+        cmd = 'xdg-open';
+        args = [url];
+    }
+    try {
+        (0, node_child_process_1.execFile)(cmd, args, () => undefined);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function renderPage(title, body) {
+    return `<!DOCTYPE html><html><head><meta charset="utf-8"><title>${title}</title><style>body{font-family:sans-serif;max-width:480px;margin:80px auto;text-align:center}</style></head><body>${body}</body></html>`;
+}

package/lib/cli/src/lib/byos-precheck.d.ts

@@ -0,0 +1,29 @@
+export type Compatibility = 'supported' | 'best-effort' | 'unsupported';
+export interface SshTarget {
+    host: string;
+    user: string;
+    privateKeyPath: string;
+}
+export interface SystemReport {
+    os: {
+        distro: string;
+        version: string;
+        prettyName: string;
+    };
+    kernel: string;
+    arch: string;
+    cpu: number;
+    memoryMb: number;
+    diskGb: number;
+    hasSystemd: boolean;
+    hasCurl: boolean;
+    hasJq: boolean;
+    portsFree: {
+        port: number;
+        free: boolean;
+    }[];
+    compatibility: Compatibility;
+    warnings: string[];
+    blockers: string[];
+}
+export declare function runPrecheck(target: SshTarget): Promise<SystemReport>;

package/lib/cli/src/lib/byos-precheck.js

@@ -0,0 +1,162 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runPrecheck = runPrecheck;
+const child_process_1 = require("child_process");
+const SUPPORTED = [
+    // Ubuntu 24.04 LTS (Noble) is the primary tested target.
+    { distro: 'ubuntu', minVersion: 24.04 },
+    { distro: 'debian', minVersion: 12 },
+];
+const BEST_EFFORT = [
+    { distro: 'ubuntu', minVersion: 22.04 },
+    { distro: 'ubuntu', minVersion: 20.04 },
+    { distro: 'debian', minVersion: 11 },
+    { distro: 'rocky', minVersion: 9 },
+    { distro: 'almalinux', minVersion: 9 },
+    { distro: 'rhel', minVersion: 9 },
+    { distro: 'fedora', minVersion: 40 },
+    { distro: 'opensuse-leap', minVersion: 15.5 },
+];
+const UNSUPPORTED = ['alpine']; // k3s on Alpine needs extra cgroup setup, fragile
+const SUPPORTED_ARCH = ['x86_64', 'amd64', 'aarch64', 'arm64'];
+const REQUIRED_PORTS = [6443, 80, 443];
+/**
+ * Run a one-shot SSH command on the target and capture stdout. Throws on
+ * non-zero exit (the caller decides whether to surface the failure as a
+ * blocker or just an unknown).
+ */
+function ssh(target, command) {
+    const result = (0, child_process_1.spawnSync)('ssh', [
+        '-i', target.privateKeyPath,
+        '-o', 'StrictHostKeyChecking=accept-new',
+        '-o', 'ConnectTimeout=10',
+        '-o', 'BatchMode=yes',
+        `${target.user}@${target.host}`,
+        command,
+    ], { encoding: 'utf-8' });
+    if (result.status !== 0) {
+        throw new Error(`ssh ${target.user}@${target.host} '${command}' failed (exit ${result.status}): ${result.stderr.trim()}`);
+    }
+    return result.stdout.trim();
+}
+function safe(target, command) {
+    try {
+        return ssh(target, command);
+    }
+    catch {
+        return '';
+    }
+}
+function classify(distro, version) {
+    const versionNum = parseFloat(version);
+    if (UNSUPPORTED.includes(distro)) {
+        return {
+            compatibility: 'unsupported',
+            reason: `${distro} ${version} is not supported (k3s requires extra setup)`,
+        };
+    }
+    for (const s of SUPPORTED) {
+        if (s.distro === distro && versionNum >= s.minVersion) {
+            return { compatibility: 'supported' };
+        }
+    }
+    for (const b of BEST_EFFORT) {
+        if (b.distro === distro && (b.minVersion === undefined || versionNum >= b.minVersion)) {
+            return {
+                compatibility: 'best-effort',
+                reason: `${distro} ${version} is not in the tested matrix; install will proceed but may need manual fixes`,
+            };
+        }
+    }
+    return {
+        compatibility: 'unsupported',
+        reason: `${distro} ${version} is unknown to Flui; for a smooth install use Ubuntu 22.04+ or Debian 12+`,
+    };
+}
+async function runPrecheck(target) {
+    // 1. Verify SSH first — reachable + we can run a command.
+    ssh(target, 'echo flui-precheck-ok');
+    // 2. /etc/os-release
+    const osReleaseRaw = safe(target, 'cat /etc/os-release || true');
+    const osVars = parseEnvBlock(osReleaseRaw);
+    const distro = (osVars.ID || '').toLowerCase();
+    const version = osVars.VERSION_ID || '';
+    const prettyName = osVars.PRETTY_NAME || `${distro} ${version}`;
+    // 3. Kernel + arch + capacity
+    const kernel = safe(target, 'uname -r');
+    const arch = safe(target, 'uname -m');
+    const cpu = parseInt(safe(target, 'nproc') || '0', 10);
+    const memoryKb = parseInt(safe(target, "awk '/MemTotal/ {print $2}' /proc/meminfo") || '0', 10);
+    const memoryMb = Math.floor(memoryKb / 1024);
+    const diskKb = parseInt(safe(target, "df -k --output=size / | tail -1 | tr -d ' '") || '0', 10);
+    const diskGb = Math.floor(diskKb / 1024 / 1024);
+    // 4. systemd present (k3s uses it)
+    const hasSystemd = safe(target, 'command -v systemctl >/dev/null && echo yes || echo no') === 'yes';
+    const hasCurl = safe(target, 'command -v curl >/dev/null && echo yes || echo no') === 'yes';
+    const hasJq = safe(target, 'command -v jq >/dev/null && echo yes || echo no') === 'yes';
+    // 5. Required ports free.
+    const portsFree = REQUIRED_PORTS.map((port) => {
+        const inUse = safe(target, `(ss -lnt 2>/dev/null || netstat -lnt 2>/dev/null) | awk '{print $4}' | grep -E '[:.]${port}$' | head -1`);
+        return { port, free: inUse === '' };
+    });
+    // 6. Classify.
+    const warnings = [];
+    const blockers = [];
+    const { compatibility, reason } = classify(distro, version);
+    if (reason) {
+        if (compatibility === 'unsupported')
+            blockers.push(reason);
+        else
+            warnings.push(reason);
+    }
+    if (!SUPPORTED_ARCH.includes(arch)) {
+        blockers.push(`unsupported architecture: ${arch} (need x86_64 or arm64)`);
+    }
+    if (!hasSystemd) {
+        blockers.push('systemd not found — k3s installer requires systemd');
+    }
+    if (!hasCurl) {
+        blockers.push('curl not found — install with `apt install curl` or equivalent');
+    }
+    if (!hasJq) {
+        warnings.push('jq not found — non-fatal but recommended for the install logs');
+    }
+    if (cpu < 2)
+        warnings.push(`only ${cpu} CPU detected — Flui needs ≥ 2`);
+    if (memoryMb < 4096)
+        warnings.push(`only ${memoryMb} MB RAM detected — Flui needs ≥ 4 GB`);
+    if (diskGb < 30)
+        warnings.push(`only ${diskGb} GB free disk on / — Flui needs ≥ 30 GB`);
+    for (const p of portsFree) {
+        if (!p.free)
+            blockers.push(`port ${p.port} is already in use`);
+    }
+    return {
+        os: { distro, version, prettyName },
+        kernel,
+        arch,
+        cpu,
+        memoryMb,
+        diskGb,
+        hasSystemd,
+        hasCurl,
+        hasJq,
+        portsFree,
+        compatibility: blockers.length > 0 ? 'unsupported' : compatibility,
+        warnings,
+        blockers,
+    };
+}
+function parseEnvBlock(s) {
+    const out = {};
+    for (const line of s.split('\n')) {
+        const m = /^([A-Z_]+)=(.*)$/.exec(line.trim());
+        if (!m)
+            continue;
+        let value = m[2];
+        if (value.startsWith('"') && value.endsWith('"'))
+            value = value.slice(1, -1);
+        out[m[1]] = value;
+    }
+    return out;
+}

package/lib/cli/src/lib/ca-utils.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Get CA public key for SSH certificate authentication
+ * @returns CA public key content or null if not found
+ */
+export declare function getCAPublicKey(): string | null;
+/**
+ * Check if CA certificate system is configured
+ */
+export declare function isCAConfigured(): boolean;
+/**
+ * Get CA configuration path for debugging
+ */
+export declare function getCAPath(): string;