@flui-cloud/cli 0.0.1

package/lib/cli/src/lib/services/provider-sync.service.js

@@ -0,0 +1,178 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProviderSyncService = exports.CredentialType = exports.CloudProvider = void 0;
+const api_client_1 = require("../api-client");
+const config_storage_1 = require("../config-storage");
+/**
+ * Provider sync service - Synchronizes CLI provider configuration to API
+ */
+// Enums matching API
+var CloudProvider;
+(function (CloudProvider) {
+    CloudProvider["HETZNER"] = "hetzner";
+    CloudProvider["SCALEWAY"] = "scaleway";
+})(CloudProvider || (exports.CloudProvider = CloudProvider = {}));
+var CredentialType;
+(function (CredentialType) {
+    CredentialType["API_KEY"] = "api_key";
+    CredentialType["ACCESS_KEY_SECRET"] = "access_key_secret";
+    CredentialType["USER_PASSWORD"] = "user_password";
+    CredentialType["BEARER_TOKEN"] = "bearer_token";
+})(CredentialType || (exports.CredentialType = CredentialType = {}));
+// Provider-specific region configurations
+const PROVIDER_REGIONS = {
+    [CloudProvider.HETZNER]: ['nbg1', 'fsn1', 'hel1', 'ash', 'hil'],
+    [CloudProvider.SCALEWAY]: ['fr-par', 'nl-ams', 'pl-waw'],
+};
+class ProviderSyncService {
+    constructor(apiUrl) {
+        this.configStorage = new config_storage_1.ConfigStorage();
+        this.apiClient = new api_client_1.ApiClient({
+            baseUrl: apiUrl,
+            apiKey: this.configStorage.getApiKey(),
+        });
+    }
+    setApiKey(apiKey) {
+        this.apiClient = new api_client_1.ApiClient({
+            baseUrl: this.apiClient.getBaseUrl(),
+            apiKey,
+        });
+    }
+    /**
+     * Check if provider exists in API
+     */
+    async checkProviderExists(provider) {
+        try {
+            await this.apiClient.get(`/management/configurations/${provider}`);
+            return true;
+        }
+        catch (error) {
+            if (error.statusCode === 404) {
+                return false;
+            }
+            throw error;
+        }
+    }
+    /**
+     * Get provider configuration from API
+     */
+    async getProviderConfiguration(provider) {
+        try {
+            const config = await this.apiClient.get(`/management/configurations/${provider}`);
+            return config;
+        }
+        catch (error) {
+            if (error.statusCode === 404) {
+                return null;
+            }
+            throw error;
+        }
+    }
+    /**
+     * Validate provider is supported
+     */
+    validateProvider(provider) {
+        const normalizedProvider = provider.toLowerCase();
+        if (!Object.values(CloudProvider).includes(normalizedProvider)) {
+            throw new Error(`Unsupported provider: ${provider}. Supported providers: ${Object.values(CloudProvider).join(', ')}`);
+        }
+        return normalizedProvider;
+    }
+    /**
+     * Get credential type for provider
+     */
+    getCredentialType(provider) {
+        if (provider === CloudProvider.SCALEWAY) {
+            return CredentialType.ACCESS_KEY_SECRET;
+        }
+        return CredentialType.API_KEY;
+    }
+    /**
+     * Get regions to enable for provider
+     */
+    getRegionsToEnable(provider, specifiedRegions) {
+        if (specifiedRegions && specifiedRegions.length > 0) {
+            return specifiedRegions;
+        }
+        // Return all available regions for provider
+        return PROVIDER_REGIONS[provider] || [];
+    }
+    /**
+     * Build ConfigureProviderDto from CLI config
+     */
+    async buildConfigureDto(provider, regions) {
+        const credentialType = this.getCredentialType(provider);
+        const enabledRegions = this.getRegionsToEnable(provider, regions);
+        const credentials = {
+            provider,
+            type: credentialType,
+        };
+        if (credentialType === CredentialType.ACCESS_KEY_SECRET) {
+            const stored = this.configStorage.getCredentials(provider);
+            if (!stored?.accessKey || !stored?.secretKey) {
+                throw new Error(`No credentials found for ${provider}. Configure them with: flui config set ${provider}`);
+            }
+            credentials.accessKey = stored.accessKey;
+            credentials.secretKey = stored.secretKey;
+        }
+        else {
+            const apiToken = this.configStorage.getToken(provider);
+            if (!apiToken) {
+                throw new Error(`No API token found for ${provider}. Please configure it first using: flui config set ${provider} <token>`);
+            }
+            if (credentialType === CredentialType.API_KEY) {
+                credentials.apiKey = apiToken;
+            }
+            else if (credentialType === CredentialType.BEARER_TOKEN) {
+                credentials.bearerToken = apiToken;
+            }
+        }
+        return {
+            provider,
+            credentials,
+            enabledRegions,
+            additionalConfig: {},
+        };
+    }
+    /**
+     * Sync provider from CLI to API
+     */
+    async syncProvider(providerName, options = {}) {
+        try {
+            // Validate provider
+            const provider = this.validateProvider(providerName);
+            // Check if provider already exists
+            const existingConfig = await this.getProviderConfiguration(provider);
+            if (existingConfig && !options.force) {
+                return {
+                    success: false,
+                    message: `Provider ${provider} is already configured in the API. Use --force to overwrite.`,
+                    providerConfiguration: existingConfig,
+                };
+            }
+            // Build configuration DTO
+            const configDto = await this.buildConfigureDto(provider, options.regions);
+            // Configure provider in API
+            const response = await this.apiClient.post(`/management/providers/${provider}/configure`, configDto);
+            return {
+                success: true,
+                message: `Successfully synced ${provider} provider to API`,
+                providerConfiguration: response,
+            };
+        }
+        catch (error) {
+            return {
+                success: false,
+                message: `Failed to sync provider: ${error.message}`,
+                error: error.details || error.message,
+            };
+        }
+    }
+    /**
+     * Get API client base URL
+     */
+    getApiUrl() {
+        return this.apiClient.getBaseUrl();
+    }
+}
+exports.ProviderSyncService = ProviderSyncService;

package/lib/cli/src/lib/services/reconciliation.service.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Reconciliation service
+ *
+ * CA, Provider, VNet, Observability, Firewall are now seeded automatically
+ * by BootstrapSeeder (NestJS OnModuleInit) reading from flui-secrets K8s Secret.
+ * No HTTP reconciliation needed for those types.
+ *
+ * Only DNS remains here — it is API-driven (no data from CLI) and optional.
+ */
+export declare enum ReconciliationType {
+    DNS = "dns",
+    ALL = "all"
+}
+export interface ReconciliationResult {
+    type: ReconciliationType;
+    success: boolean;
+    message: string;
+    details?: any;
+    error?: string;
+}
+export interface ReconciliationOptions {
+    types?: ReconciliationType[];
+    dryRun?: boolean;
+    apiUrl?: string;
+}
+export declare class ReconciliationService {
+    private readonly configStorage;
+    private readonly apiClient;
+    private readonly clusterRepository;
+    constructor(apiUrl: string);
+    reconcile(options?: ReconciliationOptions): Promise<{
+        results: ReconciliationResult[];
+        allSuccess: boolean;
+    }>;
+    /**
+     * Trigger DNS reconciliation via API (API-driven, no data from CLI).
+     * Optional — skipped silently if no DNS is configured.
+     */
+    private reconcileDns;
+}

package/lib/cli/src/lib/services/reconciliation.service.js

@@ -0,0 +1,119 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ReconciliationService = exports.ReconciliationType = void 0;
+const api_client_1 = require("../api-client");
+const config_storage_1 = require("../config-storage");
+const cli_cluster_repository_1 = require("../repositories/cli-cluster.repository");
+/**
+ * Reconciliation service
+ *
+ * CA, Provider, VNet, Observability, Firewall are now seeded automatically
+ * by BootstrapSeeder (NestJS OnModuleInit) reading from flui-secrets K8s Secret.
+ * No HTTP reconciliation needed for those types.
+ *
+ * Only DNS remains here — it is API-driven (no data from CLI) and optional.
+ */
+var ReconciliationType;
+(function (ReconciliationType) {
+    ReconciliationType["DNS"] = "dns";
+    ReconciliationType["ALL"] = "all";
+})(ReconciliationType || (exports.ReconciliationType = ReconciliationType = {}));
+class ReconciliationService {
+    constructor(apiUrl) {
+        this.configStorage = new config_storage_1.ConfigStorage();
+        this.apiClient = new api_client_1.ApiClient({
+            baseUrl: apiUrl,
+            apiKey: this.configStorage.getApiKey(),
+        });
+        this.clusterRepository = new cli_cluster_repository_1.CliClusterRepository();
+    }
+    async reconcile(options = {}) {
+        const types = options.types || [ReconciliationType.ALL];
+        const results = [];
+        const typesToRun = types.includes(ReconciliationType.ALL)
+            ? [ReconciliationType.DNS]
+            : types;
+        for (const type of typesToRun) {
+            try {
+                let result;
+                if (type === ReconciliationType.DNS) {
+                    result = await this.reconcileDns(options);
+                }
+                else {
+                    result = {
+                        type,
+                        success: false,
+                        message: `Unknown reconciliation type: ${type}`,
+                    };
+                }
+                results.push(result);
+            }
+            catch (error) {
+                results.push({
+                    type,
+                    success: false,
+                    message: `Reconciliation failed: ${error.message}`,
+                    error: error.stack || error.message,
+                });
+            }
+        }
+        return { results, allSuccess: results.every((r) => r.success) };
+    }
+    /**
+     * Trigger DNS reconciliation via API (API-driven, no data from CLI).
+     * Optional — skipped silently if no DNS is configured.
+     */
+    async reconcileDns(options) {
+        try {
+            const cluster = await this.clusterRepository.findOne({
+                where: { metadata: { isObservabilityCluster: true } },
+            });
+            if (!cluster) {
+                return {
+                    type: ReconciliationType.DNS,
+                    success: true,
+                    message: 'No observability cluster found, skipping DNS reconciliation',
+                };
+            }
+            try {
+                const dnsConfig = await this.apiClient.get(`/dns/cluster/${cluster.id}`);
+                if (!dnsConfig) {
+                    return {
+                        type: ReconciliationType.DNS,
+                        success: true,
+                        message: 'No DNS configuration found for cluster, skipping',
+                    };
+                }
+                await this.apiClient.post(`/dns/${dnsConfig.id}/reconcile`);
+                return {
+                    type: ReconciliationType.DNS,
+                    success: true,
+                    message: `DNS reconciliation triggered for ${dnsConfig.baseDomain}`,
+                    details: {
+                        baseDomain: dnsConfig.baseDomain,
+                        dnsProvider: dnsConfig.dnsProvider,
+                    },
+                };
+            }
+            catch (apiError) {
+                if (apiError.status === 404 || apiError.statusCode === 404) {
+                    return {
+                        type: ReconciliationType.DNS,
+                        success: true,
+                        message: 'No DNS configuration found for cluster, skipping',
+                    };
+                }
+                throw apiError;
+            }
+        }
+        catch (error) {
+            return {
+                type: ReconciliationType.DNS,
+                success: false,
+                message: `DNS reconciliation failed: ${error.message}`,
+                error: error.stack || error.message,
+            };
+        }
+    }
+}
+exports.ReconciliationService = ReconciliationService;

package/lib/cli/src/lib/services/vnet-provisioning.service.d.ts

@@ -0,0 +1,37 @@
+import { CloudProvider } from '../../../../src/modules/providers/enums/cloud-provider.enum';
+import { ProviderFactory } from '../../../../src/modules/providers/core/factories/provider.factory';
+import { SubnetType } from '../../../../src/modules/infrastructure/vnets/entities/vnet-subnet.entity';
+import { CliVnetRepository } from '../repositories/cli-vnet.repository';
+export interface EnvVnetSpec {
+    provider: CloudProvider;
+    name: string;
+    ipRange?: string;
+    subnetIpRange?: string;
+    /** Hetzner: networkZone (eu-central). Scaleway: regional, ignored. */
+    networkZone?: string;
+    /** Scaleway: region (fr-par, nl-ams, pl-waw). Hetzner: ignored. */
+    region?: string;
+}
+export interface EnvVnetInfo {
+    vnetId: string;
+    vnetProviderResourceId: string;
+    vnetName: string;
+    vnetIpRange: string;
+    subnetId: string;
+    subnetProviderResourceId: string;
+    subnetIpRange: string;
+    subnetType: SubnetType;
+    networkZone: string;
+}
+export declare class VnetProvisioningService {
+    private readonly providerFactory;
+    private readonly vnetRepo;
+    private readonly logger;
+    constructor(providerFactory: ProviderFactory, vnetRepo: CliVnetRepository);
+    ensureEnvVnet(spec: EnvVnetSpec): Promise<EnvVnetInfo>;
+    private createHetznerVnet;
+    private createScalewayVnet;
+    destroyEnvVnet(): Promise<void>;
+    hetznerNetworkZoneFor(region: string): string;
+    private toInfo;
+}

package/lib/cli/src/lib/services/vnet-provisioning.service.js

@@ -0,0 +1,164 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var VnetProvisioningService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VnetProvisioningService = void 0;
+const common_1 = require("@nestjs/common");
+const cloud_provider_enum_1 = require("../../../../src/modules/providers/enums/cloud-provider.enum");
+const provider_factory_1 = require("../../../../src/modules/providers/core/factories/provider.factory");
+const vnet_subnet_entity_1 = require("../../../../src/modules/infrastructure/vnets/entities/vnet-subnet.entity");
+const vnet_entity_1 = require("../../../../src/modules/infrastructure/vnets/entities/vnet.entity");
+const cli_vnet_repository_1 = require("../repositories/cli-vnet.repository");
+const HETZNER_DEFAULT_NETWORK_ZONE_BY_REGION = {
+    nbg1: 'eu-central',
+    fsn1: 'eu-central',
+    hel1: 'eu-central',
+    ash: 'us-east',
+    hil: 'us-west',
+};
+let VnetProvisioningService = VnetProvisioningService_1 = class VnetProvisioningService {
+    constructor(providerFactory, vnetRepo) {
+        this.providerFactory = providerFactory;
+        this.vnetRepo = vnetRepo;
+        this.logger = new common_1.Logger(VnetProvisioningService_1.name);
+    }
+    async ensureEnvVnet(spec) {
+        const existing = await this.vnetRepo.findActive();
+        if (existing?.provider === spec.provider) {
+            const subnet = existing.subnets?.[0];
+            if (!subnet) {
+                throw new Error(`VNet ${existing.providerResourceId} has no subnet — recreate the environment`);
+            }
+            this.logger.log(`Reusing existing VNet ${existing.providerResourceId} (subnet ${subnet.providerSubnetId})`);
+            return this.toInfo(existing, subnet);
+        }
+        const ipRange = spec.ipRange || '10.10.0.0/16';
+        const subnetIpRange = spec.subnetIpRange || '10.10.1.0/24';
+        if (spec.provider === cloud_provider_enum_1.CloudProvider.HETZNER) {
+            return this.createHetznerVnet(spec, ipRange, subnetIpRange);
+        }
+        if (spec.provider === cloud_provider_enum_1.CloudProvider.SCALEWAY) {
+            return this.createScalewayVnet(spec, ipRange, subnetIpRange);
+        }
+        throw new Error(`VNet provisioning not yet implemented for provider ${spec.provider}`);
+    }
+    async createHetznerVnet(spec, ipRange, subnetIpRange) {
+        const networkZone = spec.networkZone || 'eu-central';
+        this.logger.log(`Creating Hetzner VNet ${spec.name} (${ipRange})`);
+        const provider = this.providerFactory.getProvider(cloud_provider_enum_1.CloudProvider.HETZNER);
+        if (!provider.createVNet) {
+            throw new Error('Hetzner provider does not implement createVNet');
+        }
+        const created = await provider.createVNet({
+            name: spec.name,
+            ipRange,
+            labels: [
+                { key: 'managed-by', value: 'flui-cloud' },
+                { key: 'flui-resource-type', value: 'vnet' },
+            ],
+            subnets: [{ ipRange: subnetIpRange, networkZone }],
+        });
+        const vnetRecord = await this.vnetRepo.save({
+            providerResourceId: created.vnetId,
+            name: spec.name,
+            provider: spec.provider,
+            ipRange: created.ipRange,
+            labels: [
+                { key: 'managed-by', value: 'flui-cloud' },
+                { key: 'flui-resource-type', value: 'vnet' },
+            ],
+            status: vnet_entity_1.VNetStatus.ACTIVE,
+            subnets: [],
+        });
+        const subnetRecord = await this.vnetRepo.addSubnet(vnetRecord.id, {
+            providerSubnetId: subnetIpRange,
+            ipRange: subnetIpRange,
+            type: vnet_subnet_entity_1.SubnetType.CLOUD,
+            networkZone,
+        });
+        return this.toInfo({ ...vnetRecord, subnets: [subnetRecord] }, subnetRecord);
+    }
+    async createScalewayVnet(spec, ipRange, subnetIpRange) {
+        const region = spec.region || 'fr-par';
+        this.logger.log(`Creating Scaleway Private Network ${spec.name} in ${region} (${ipRange})`);
+        const provider = this.providerFactory.getProvider(cloud_provider_enum_1.CloudProvider.SCALEWAY);
+        if (!provider.createVNet) {
+            throw new Error('Scaleway provider does not implement createVNet');
+        }
+        const created = await provider.createVNet({
+            name: spec.name,
+            ipRange,
+            labels: [
+                { key: 'managed-by', value: 'flui-cloud' },
+                { key: 'flui-resource-type', value: 'vnet' },
+                { key: 'region', value: region },
+            ],
+            subnets: [{ ipRange: subnetIpRange, networkZone: region }],
+        });
+        const vnetRecord = await this.vnetRepo.save({
+            providerResourceId: created.vnetId,
+            name: spec.name,
+            provider: spec.provider,
+            ipRange: created.ipRange,
+            labels: [
+                { key: 'managed-by', value: 'flui-cloud' },
+                { key: 'flui-resource-type', value: 'vnet' },
+                { key: 'region', value: region },
+            ],
+            status: vnet_entity_1.VNetStatus.ACTIVE,
+            subnets: [],
+        });
+        const subnetRecord = await this.vnetRepo.addSubnet(vnetRecord.id, {
+            providerSubnetId: subnetIpRange,
+            ipRange: subnetIpRange,
+            type: vnet_subnet_entity_1.SubnetType.CLOUD,
+            networkZone: region,
+        });
+        return this.toInfo({ ...vnetRecord, subnets: [subnetRecord] }, subnetRecord);
+    }
+    async destroyEnvVnet() {
+        const existing = await this.vnetRepo.findActive();
+        if (!existing)
+            return;
+        try {
+            const provider = this.providerFactory.getProvider(existing.provider);
+            if (provider.deleteVNet) {
+                await provider.deleteVNet(existing.providerResourceId);
+            }
+        }
+        catch (error) {
+            this.logger.warn(`Failed to delete VNet ${existing.providerResourceId} on ${existing.provider}: ${error.message}`);
+        }
+        await this.vnetRepo.remove(existing.id);
+    }
+    hetznerNetworkZoneFor(region) {
+        return HETZNER_DEFAULT_NETWORK_ZONE_BY_REGION[region] || 'eu-central';
+    }
+    toInfo(vnet, subnet) {
+        return {
+            vnetId: vnet.id,
+            vnetProviderResourceId: vnet.providerResourceId,
+            vnetName: vnet.name,
+            vnetIpRange: vnet.ipRange,
+            subnetId: subnet.id,
+            subnetProviderResourceId: subnet.providerSubnetId || subnet.ipRange,
+            subnetIpRange: subnet.ipRange,
+            subnetType: subnet.type,
+            networkZone: subnet.networkZone,
+        };
+    }
+};
+exports.VnetProvisioningService = VnetProvisioningService;
+exports.VnetProvisioningService = VnetProvisioningService = VnetProvisioningService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [provider_factory_1.ProviderFactory,
+        cli_vnet_repository_1.CliVnetRepository])
+], VnetProvisioningService);

package/lib/cli/src/lib/ssh-key.d.ts

@@ -0,0 +1,23 @@
+export interface SSHKeyPair {
+    publicKey: string;
+    privateKeyPath: string;
+    fingerprint?: string;
+}
+/**
+ * Get or generate SSH key pair for Flui CLI
+ * @returns SSH key pair with public key content and private key path
+ */
+export declare function getOrCreateSSHKey(): SSHKeyPair;
+/**
+ * Get SSH key information without generating
+ * @returns Key info or null if doesn't exist
+ */
+export declare function getSSHKeyInfo(): {
+    exists: boolean;
+    path: string;
+    publicKey?: string;
+};
+/**
+ * Delete SSH key pair
+ */
+export declare function deleteSSHKey(): void;

package/lib/cli/src/lib/ssh-key.js

@@ -0,0 +1,126 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getOrCreateSSHKey = getOrCreateSSHKey;
+exports.getSSHKeyInfo = getSSHKeyInfo;
+exports.deleteSSHKey = deleteSSHKey;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const os = __importStar(require("node:os"));
+const node_child_process_1 = require("node:child_process");
+const SSH_DIR = path.join(os.homedir(), '.ssh');
+const FLUI_KEY_NAME = 'flui_shared_dev';
+const FLUI_KEY_PATH = path.join(SSH_DIR, FLUI_KEY_NAME);
+/**
+ * Ensure .ssh directory exists with correct permissions
+ */
+function ensureSSHDir() {
+    if (!fs.existsSync(SSH_DIR)) {
+        fs.mkdirSync(SSH_DIR, { mode: 0o700, recursive: true });
+    }
+}
+/**
+ * Get or generate SSH key pair for Flui CLI
+ * @returns SSH key pair with public key content and private key path
+ */
+function getOrCreateSSHKey() {
+    ensureSSHDir();
+    const privateKeyPath = FLUI_KEY_PATH;
+    const publicKeyPath = `${FLUI_KEY_PATH}.pub`;
+    // Check if key already exists
+    if (fs.existsSync(publicKeyPath) && fs.existsSync(privateKeyPath)) {
+        const publicKey = fs.readFileSync(publicKeyPath, 'utf-8').trim();
+        return {
+            publicKey,
+            privateKeyPath,
+        };
+    }
+    // Generate new SSH key (ed25519 for security and performance)
+    try {
+        (0, node_child_process_1.execFileSync)('ssh-keygen', [
+            '-t',
+            'ed25519',
+            '-C',
+            'flui-cli@shared-dev',
+            '-f',
+            privateKeyPath,
+            '-N',
+            '',
+        ], { stdio: 'pipe' });
+        // Set correct permissions
+        fs.chmodSync(privateKeyPath, 0o600);
+        fs.chmodSync(publicKeyPath, 0o644);
+        const publicKey = fs.readFileSync(publicKeyPath, 'utf-8').trim();
+        return {
+            publicKey,
+            privateKeyPath,
+        };
+    }
+    catch (error) {
+        throw new Error(`Failed to generate SSH key: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+/**
+ * Get SSH key information without generating
+ * @returns Key info or null if doesn't exist
+ */
+function getSSHKeyInfo() {
+    const publicKeyPath = `${FLUI_KEY_PATH}.pub`;
+    if (fs.existsSync(publicKeyPath)) {
+        const publicKey = fs.readFileSync(publicKeyPath, 'utf-8').trim();
+        return {
+            exists: true,
+            path: FLUI_KEY_PATH,
+            publicKey,
+        };
+    }
+    return {
+        exists: false,
+        path: FLUI_KEY_PATH,
+    };
+}
+/**
+ * Delete SSH key pair
+ */
+function deleteSSHKey() {
+    const privateKeyPath = FLUI_KEY_PATH;
+    const publicKeyPath = `${FLUI_KEY_PATH}.pub`;
+    if (fs.existsSync(privateKeyPath)) {
+        fs.unlinkSync(privateKeyPath);
+    }
+    if (fs.existsSync(publicKeyPath)) {
+        fs.unlinkSync(publicKeyPath);
+    }
+}