@flui-cloud/cli 0.0.1

package/lib/cli/src/lib/template-fetcher.d.ts

@@ -0,0 +1,25 @@
+import { ApiClient } from './api-client';
+export interface TemplateInfo {
+    framework: string;
+    displayName: string;
+    description: string;
+    version: string;
+    repo: string;
+    repoUrl?: string;
+    category: string;
+    language: string;
+    port: number;
+    healthcheckPath: string;
+    buildTool: string;
+    isDefault: boolean;
+    isDeprecated: boolean;
+}
+export declare function listTemplates(api: ApiClient): Promise<TemplateInfo[]>;
+export declare function getTemplate(api: ApiClient, framework: string, version?: string): Promise<TemplateInfo>;
+export declare function listVersionsFor(api: ApiClient, framework: string): Promise<TemplateInfo[]>;
+export declare function pickDefault(entries: TemplateInfo[]): TemplateInfo | undefined;
+export declare function fetchRawFile(repo: string, filename: string, branch?: string): Promise<string>;
+export declare function parseFrameworkArg(input: string): {
+    framework: string;
+    version?: string;
+};

package/lib/cli/src/lib/template-fetcher.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listTemplates = listTemplates;
+exports.getTemplate = getTemplate;
+exports.listVersionsFor = listVersionsFor;
+exports.pickDefault = pickDefault;
+exports.fetchRawFile = fetchRawFile;
+exports.parseFrameworkArg = parseFrameworkArg;
+const TEMPLATE_ORG = 'flui-cloud';
+const DEFAULT_BRANCH = 'main';
+async function listTemplates(api) {
+    return api.get('/templates');
+}
+async function getTemplate(api, framework, version) {
+    const path = version
+        ? `/templates/${framework}?version=${encodeURIComponent(version)}`
+        : `/templates/${framework}`;
+    return api.get(path);
+}
+async function listVersionsFor(api, framework) {
+    const all = await listTemplates(api);
+    return all
+        .filter((t) => t.framework === framework)
+        .sort((a, b) => Number(b.version) - Number(a.version));
+}
+function pickDefault(entries) {
+    return (entries.find((t) => t.isDefault && !t.isDeprecated) ??
+        entries.find((t) => !t.isDeprecated) ??
+        entries[0]);
+}
+async function fetchRawFile(repo, filename, branch = DEFAULT_BRANCH) {
+    const url = `https://raw.githubusercontent.com/${TEMPLATE_ORG}/${repo}/${branch}/${filename}`;
+    const res = await fetch(url);
+    if (!res.ok) {
+        throw new Error(`Failed to fetch ${filename} from ${TEMPLATE_ORG}/${repo}@${branch}: HTTP ${res.status}`);
+    }
+    return await res.text();
+}
+function parseFrameworkArg(input) {
+    const at = input.indexOf('@');
+    if (at === -1) {
+        return { framework: input };
+    }
+    return {
+        framework: input.slice(0, at),
+        version: input.slice(at + 1),
+    };
+}

package/lib/cli/src/lib/templates/firewall-rules.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @deprecated Import from shared template instead:
+ * import { OBSERVABILITY_FIREWALL_RULES, OBSERVABILITY_PORTS } from '../../../../src/modules/infrastructure/firewalls/templates/firewall-rules.template';
+ *
+ * This file is kept for backward compatibility with existing CLI code.
+ * New code should use the shared template.
+ */
+export { OBSERVABILITY_FIREWALL_RULES, OBSERVABILITY_PORTS, WORKLOAD_FIREWALL_RULES, WORKLOAD_PORTS, validateFirewallRules, getFirewallRulesForClusterType, } from '../../../../src/modules/infrastructure/firewalls/templates/firewall-rules.template';

package/lib/cli/src/lib/templates/firewall-rules.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getFirewallRulesForClusterType = exports.validateFirewallRules = exports.WORKLOAD_PORTS = exports.WORKLOAD_FIREWALL_RULES = exports.OBSERVABILITY_PORTS = exports.OBSERVABILITY_FIREWALL_RULES = void 0;
+/**
+ * @deprecated Import from shared template instead:
+ * import { OBSERVABILITY_FIREWALL_RULES, OBSERVABILITY_PORTS } from '../../../../src/modules/infrastructure/firewalls/templates/firewall-rules.template';
+ *
+ * This file is kept for backward compatibility with existing CLI code.
+ * New code should use the shared template.
+ */
+var firewall_rules_template_1 = require("../../../../src/modules/infrastructure/firewalls/templates/firewall-rules.template");
+Object.defineProperty(exports, "OBSERVABILITY_FIREWALL_RULES", { enumerable: true, get: function () { return firewall_rules_template_1.OBSERVABILITY_FIREWALL_RULES; } });
+Object.defineProperty(exports, "OBSERVABILITY_PORTS", { enumerable: true, get: function () { return firewall_rules_template_1.OBSERVABILITY_PORTS; } });
+Object.defineProperty(exports, "WORKLOAD_FIREWALL_RULES", { enumerable: true, get: function () { return firewall_rules_template_1.WORKLOAD_FIREWALL_RULES; } });
+Object.defineProperty(exports, "WORKLOAD_PORTS", { enumerable: true, get: function () { return firewall_rules_template_1.WORKLOAD_PORTS; } });
+Object.defineProperty(exports, "validateFirewallRules", { enumerable: true, get: function () { return firewall_rules_template_1.validateFirewallRules; } });
+Object.defineProperty(exports, "getFirewallRulesForClusterType", { enumerable: true, get: function () { return firewall_rules_template_1.getFirewallRulesForClusterType; } });

package/lib/cli/src/lib/typeorm-shim.d.ts

@@ -0,0 +1,12 @@
+/**
+ * TypeORM Shim for CLI
+ *
+ * Provides getRepositoryToken() function without requiring @nestjs/typeorm dependency.
+ * This allows us to provide repository tokens for dependency injection
+ * without actually loading TypeORM or connecting to a database.
+ */
+/**
+ * Generate TypeORM repository token for an entity
+ * This mimics @nestjs/typeorm's getRepositoryToken() function
+ */
+export declare function getRepositoryToken(entity: Function): string;

package/lib/cli/src/lib/typeorm-shim.js

@@ -0,0 +1,17 @@
+"use strict";
+/**
+ * TypeORM Shim for CLI
+ *
+ * Provides getRepositoryToken() function without requiring @nestjs/typeorm dependency.
+ * This allows us to provide repository tokens for dependency injection
+ * without actually loading TypeORM or connecting to a database.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getRepositoryToken = getRepositoryToken;
+/**
+ * Generate TypeORM repository token for an entity
+ * This mimics @nestjs/typeorm's getRepositoryToken() function
+ */
+function getRepositoryToken(entity) {
+    return `${entity.name}Repository`;
+}

package/lib/cli/src/lib/utils/env-file.d.ts

@@ -0,0 +1,2 @@
+export declare function updateEnvContent(content: string, updates: Record<string, string>): string;
+export declare function formatEnvValue(key: string, value: string): string;

package/lib/cli/src/lib/utils/env-file.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.updateEnvContent = updateEnvContent;
+exports.formatEnvValue = formatEnvValue;
+function updateEnvContent(content, updates) {
+    const lines = content.split('\n');
+    const updatedLines = [];
+    const processedKeys = new Set();
+    for (const line of lines) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#')) {
+            updatedLines.push(line);
+            continue;
+        }
+        const match = /^([^=]+)=(.*)$/.exec(trimmed);
+        if (match) {
+            const key = match[1].trim();
+            if (updates[key] !== undefined) {
+                updatedLines.push(formatEnvValue(key, updates[key]));
+                processedKeys.add(key);
+                continue;
+            }
+        }
+        updatedLines.push(line);
+    }
+    const newKeys = Object.keys(updates).filter((k) => !processedKeys.has(k));
+    if (newKeys.length > 0) {
+        updatedLines.push('', '# Endpoint configuration (auto-synced)');
+        for (const key of newKeys) {
+            updatedLines.push(formatEnvValue(key, updates[key]));
+        }
+    }
+    return updatedLines.join('\n');
+}
+function formatEnvValue(key, value) {
+    if (value.includes('\n')) {
+        return `${key}="${value}"`;
+    }
+    return `${key}=${value}`;
+}

package/lib/cli/src/lib/utils/ip-detection.d.ts

@@ -0,0 +1,27 @@
+export declare class IpDetectionService {
+    private readonly logger;
+    /**
+     * Auto-detect public IP using external services with fallback
+     */
+    getPublicIp(): Promise<string>;
+    /**
+     * Validate IP format (IPv4 or IPv6)
+     */
+    validateIp(ip: string): boolean;
+    /**
+     * Validate CIDR notation
+     */
+    validateCidr(cidr: string): boolean;
+    /**
+     * Convert single IP to CIDR notation
+     */
+    toCidr(ip: string): string;
+    /**
+     * Parse comma-separated list of IPs/CIDRs
+     *
+     * @example
+     * parseCidrList("192.168.1.1,10.0.0.0/24,2001:db8::1/64")
+     * // Returns: ["192.168.1.1/32", "10.0.0.0/24", "2001:db8::1/64"]
+     */
+    parseCidrList(input: string): string[];
+}

package/lib/cli/src/lib/utils/ip-detection.js

@@ -0,0 +1,144 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+var IpDetectionService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IpDetectionService = void 0;
+const common_1 = require("@nestjs/common");
+const axios_1 = __importDefault(require("axios"));
+let IpDetectionService = IpDetectionService_1 = class IpDetectionService {
+    constructor() {
+        this.logger = new common_1.Logger(IpDetectionService_1.name);
+    }
+    /**
+     * Auto-detect public IP using external services with fallback
+     */
+    async getPublicIp() {
+        const services = [
+            { url: 'https://api.ipify.org?format=json', parseJson: true, key: 'ip' },
+            { url: 'https://ifconfig.me/ip', parseJson: false },
+            { url: 'https://icanhazip.com', parseJson: false },
+        ];
+        for (const service of services) {
+            try {
+                const response = await axios_1.default.get(service.url, {
+                    timeout: 5000,
+                    headers: { 'User-Agent': 'Flui-CLI/1.0' },
+                });
+                const ip = service.parseJson
+                    ? response.data[service.key]
+                    : response.data.trim();
+                if (this.validateIp(ip)) {
+                    this.logger.log(`Detected public IP: ${ip} (via ${service.url})`);
+                    return ip;
+                }
+            }
+            catch (error) {
+                this.logger.warn(`Failed to detect IP from ${service.url}: ${error.message}`);
+            }
+        }
+        throw new Error('Unable to detect public IP address from any service');
+    }
+    /**
+     * Validate IP format (IPv4 or IPv6)
+     */
+    validateIp(ip) {
+        // IPv4: 0.0.0.0 to 255.255.255.255
+        const ipv4Regex = /^(\d{1,3}\.){3}\d{1,3}$/;
+        // IPv6: Simplified pattern
+        const ipv6Regex = /^([0-9a-fA-F]{0,4}:){2,7}[0-9a-fA-F]{0,4}$/;
+        if (ipv4Regex.test(ip)) {
+            // Validate octets are 0-255
+            const octets = ip.split('.').map(Number);
+            return octets.every((octet) => octet >= 0 && octet <= 255);
+        }
+        return ipv6Regex.test(ip);
+    }
+    /**
+     * Validate CIDR notation
+     */
+    validateCidr(cidr) {
+        // IPv4 CIDR: 0.0.0.0/0 to 255.255.255.255/32
+        const cidrRegex = /^(\d{1,3}\.){3}\d{1,3}\/(\d{1,2})$/;
+        // IPv6 CIDR: ::/0 to ffff:ffff::/128
+        const cidr6Regex = /^([0-9a-fA-F:]+)\/(\d{1,3})$/;
+        if (cidrRegex.test(cidr)) {
+            const [ip, prefix] = cidr.split('/');
+            const prefixNum = Number.parseInt(prefix);
+            return this.validateIp(ip) && prefixNum >= 0 && prefixNum <= 32;
+        }
+        if (cidr6Regex.test(cidr)) {
+            const [ip, prefix] = cidr.split('/');
+            const prefixNum = Number.parseInt(prefix);
+            return this.validateIp(ip) && prefixNum >= 0 && prefixNum <= 128;
+        }
+        return false;
+    }
+    /**
+     * Convert single IP to CIDR notation
+     */
+    toCidr(ip) {
+        if (this.validateCidr(ip)) {
+            return ip; // Already in CIDR format
+        }
+        if (!this.validateIp(ip)) {
+            throw new Error(`Invalid IP address: ${ip}`);
+        }
+        // Convert to CIDR
+        if (ip.includes(':')) {
+            return `${ip}/128`; // IPv6 single host
+        }
+        else {
+            return `${ip}/32`; // IPv4 single host
+        }
+    }
+    /**
+     * Parse comma-separated list of IPs/CIDRs
+     *
+     * @example
+     * parseCidrList("192.168.1.1,10.0.0.0/24,2001:db8::1/64")
+     * // Returns: ["192.168.1.1/32", "10.0.0.0/24", "2001:db8::1/64"]
+     */
+    parseCidrList(input) {
+        if (!input || input.trim().length === 0) {
+            throw new Error('IP/CIDR list cannot be empty');
+        }
+        const items = input
+            .split(',')
+            .map((s) => s.trim())
+            .filter((s) => s.length > 0);
+        const results = [];
+        const errors = [];
+        for (const item of items) {
+            try {
+                if (this.validateCidr(item)) {
+                    results.push(item);
+                }
+                else if (this.validateIp(item)) {
+                    results.push(this.toCidr(item));
+                }
+                else {
+                    errors.push(`Invalid IP or CIDR: ${item}`);
+                }
+            }
+            catch (error) {
+                errors.push(error.message);
+            }
+        }
+        if (errors.length > 0) {
+            throw new Error(`Invalid IP/CIDR entries:\n  ${errors.join('\n  ')}`);
+        }
+        return results;
+    }
+};
+exports.IpDetectionService = IpDetectionService;
+exports.IpDetectionService = IpDetectionService = IpDetectionService_1 = __decorate([
+    (0, common_1.Injectable)()
+], IpDetectionService);

package/lib/cli/src/modules/cli-infrastructure.module.d.ts

@@ -0,0 +1,14 @@
+/**
+ * CLI Infrastructure Module
+ *
+ * Provides infrastructure services for CLI commands without requiring database or Redis.
+ * Uses file-based repositories that persist data to ~/.flui/*.json files.
+ *
+ * Key differences from InfrastructureModule:
+ * - NO TypeORM database connection required
+ * - NO Bull/Redis queue required
+ * - File-based persistence in ~/.flui/
+ * - Synchronous cluster operations (no background jobs)
+ */
+export declare class CliInfrastructureModule {
+}

package/lib/cli/src/modules/cli-infrastructure.module.js

@@ -0,0 +1,249 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CliInfrastructureModule = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const typeorm_shim_1 = require("../lib/typeorm-shim");
+const node_child_process_1 = require("node:child_process");
+const path = __importStar(require("node:path"));
+// CLI repositories
+const repositories_1 = require("../lib/repositories");
+// Entities
+const cluster_entity_1 = require("../../../src/modules/infrastructure/clusters/entities/cluster.entity");
+const cluster_node_entity_1 = require("../../../src/modules/infrastructure/clusters/entities/cluster-node.entity");
+const infrastructure_operations_entity_1 = require("../../../src/modules/infrastructure/servers/entities/infrastructure-operations.entity");
+// Services
+const encryption_module_1 = require("../../../src/modules/shared/encryption/encryption.module");
+const kubernetes_service_1 = require("../../../src/modules/infrastructure/shared/services/kubernetes.service");
+const label_service_1 = require("../../../src/modules/infrastructure/shared/services/label.service");
+const cli_k3s_script_service_1 = require("../services/cli-k3s-script.service");
+const cli_cluster_creator_service_1 = require("../services/cli-cluster-creator.service");
+const cli_clusters_service_1 = require("../services/cli-clusters.service");
+const cli_observability_cluster_service_1 = require("../services/cli-observability-cluster.service");
+const cli_ssh_service_1 = require("../services/cli-ssh.service");
+const cli_ca_service_1 = require("../services/cli-ca.service");
+const cli_logger_service_1 = require("../services/cli-logger.service");
+const cli_endpoint_resolver_service_1 = require("../services/cli-endpoint-resolver.service");
+const cluster_storage_service_1 = require("../../../src/modules/infrastructure/clusters/services/cluster-storage.service");
+const cluster_capacity_service_1 = require("../../../src/modules/infrastructure/clusters/services/cluster-capacity.service");
+const cluster_node_scaling_service_1 = require("../../../src/modules/infrastructure/clusters/services/cluster-node-scaling.service");
+const billing_intervals_service_1 = require("../../../src/modules/infrastructure/clusters/services/billing-intervals.service");
+const node_billable_interval_entity_1 = require("../../../src/modules/infrastructure/clusters/entities/node-billable-interval.entity");
+const volume_billable_interval_entity_1 = require("../../../src/modules/infrastructure/clusters/entities/volume-billable-interval.entity");
+const application_entity_1 = require("../../../src/modules/applications/entities/application.entity");
+const native_ssh_connection_service_1 = require("../../../src/modules/terminal/services/native-ssh-connection.service");
+const access_service_1 = require("../../../src/modules/access/services/access.service");
+// Modules
+const cli_providers_module_1 = require("../cli-providers.module");
+const common_module_1 = require("../../../src/modules/common/common.module");
+/**
+ * CLI Infrastructure Module
+ *
+ * Provides infrastructure services for CLI commands without requiring database or Redis.
+ * Uses file-based repositories that persist data to ~/.flui/*.json files.
+ *
+ * Key differences from InfrastructureModule:
+ * - NO TypeORM database connection required
+ * - NO Bull/Redis queue required
+ * - File-based persistence in ~/.flui/
+ * - Synchronous cluster operations (no background jobs)
+ */
+let CliInfrastructureModule = class CliInfrastructureModule {
+};
+exports.CliInfrastructureModule = CliInfrastructureModule;
+exports.CliInfrastructureModule = CliInfrastructureModule = __decorate([
+    (0, common_1.Module)({
+        imports: [config_1.ConfigModule, cli_providers_module_1.CliProvidersModule, common_module_1.CommonModule, encryption_module_1.EncryptionModule],
+        providers: [
+            // File-based repositories
+            repositories_1.CliClusterRepository,
+            repositories_1.CliNodeRepository,
+            repositories_1.CliOperationRepository,
+            repositories_1.CliFirewallRepository,
+            // Provide CLI repositories as TypeORM repository tokens
+            // This allows ClustersService to inject them without knowing they're file-based
+            {
+                provide: (0, typeorm_shim_1.getRepositoryToken)(cluster_entity_1.ClusterEntity),
+                useExisting: repositories_1.CliClusterRepository,
+            },
+            {
+                provide: (0, typeorm_shim_1.getRepositoryToken)(cluster_node_entity_1.ClusterNodeEntity),
+                useExisting: repositories_1.CliNodeRepository,
+            },
+            {
+                provide: (0, typeorm_shim_1.getRepositoryToken)(infrastructure_operations_entity_1.InfrastructureOperationEntity),
+                useExisting: repositories_1.CliOperationRepository,
+            },
+            // CLI mode: BillingIntervalsService is unused at runtime (CLI doesn't track
+            // node intervals — that's done by the in-cluster API at the master). Stub
+            // the two interval repos so the service can be constructed and methods are
+            // safe no-ops if accidentally called.
+            {
+                provide: (0, typeorm_shim_1.getRepositoryToken)(node_billable_interval_entity_1.NodeBillableIntervalEntity),
+                useValue: {
+                    find: async () => [],
+                    findOne: async () => null,
+                    save: async (e) => e,
+                    update: async () => undefined,
+                    create: (data) => data,
+                },
+            },
+            {
+                provide: (0, typeorm_shim_1.getRepositoryToken)(volume_billable_interval_entity_1.VolumeBillableIntervalEntity),
+                useValue: {
+                    find: async () => [],
+                    findOne: async () => null,
+                    save: async (e) => e,
+                    update: async () => undefined,
+                    create: (data) => data,
+                },
+            },
+            billing_intervals_service_1.BillingIntervalsService,
+            // CLI-specific services
+            cli_k3s_script_service_1.CliK3sScriptService,
+            cli_cluster_creator_service_1.CliClusterCreatorService,
+            // Provide a Bull Queue that executes operations asynchronously via background worker
+            // Instead of queuing to Bull/Redis, we spawn a detached background process
+            {
+                provide: 'BullQueue_infrastructure',
+                useFactory: () => ({
+                    add: async (jobName, jobData) => {
+                        console.log(`[CLI Mode] Spawning background job: ${jobName}`);
+                        // Determine the path to the compiled worker script
+                        // In development: cli/lib/cli/src/background/cluster-worker.js
+                        // The worker will be compiled by TypeScript to the lib directory
+                        const workerScript = path.join(__dirname, '../background/cluster-worker.js');
+                        // Spawn background worker as detached process
+                        const child = (0, node_child_process_1.spawn)(process.execPath, // Use same Node.js executable
+                        [workerScript, jobName, JSON.stringify(jobData)], {
+                            detached: true, // Run independently of parent
+                            cwd: process.cwd(), // Use current working directory
+                            windowsHide: true, // Prevent console window flash on Windows
+                            stdio: 'ignore', // Fully detach stdio to prevent Windows console popup
+                        });
+                        // Detach from parent so CLI can exit immediately
+                        child.unref();
+                        console.log(`[CLI Mode] Background job spawned (PID: ${child.pid})`);
+                        console.log(`[CLI Mode] Job will continue running in background`);
+                        // Return immediately with a job ID
+                        return { id: `cli-bg-${Date.now()}-${child.pid}` };
+                    },
+                }),
+                inject: [],
+            },
+            // Infrastructure services
+            label_service_1.LabelService,
+            kubernetes_service_1.KubernetesService,
+            cli_clusters_service_1.CliClustersService,
+            cli_observability_cluster_service_1.CliObservabilityClusterService,
+            cli_ssh_service_1.CliSshService,
+            cli_ca_service_1.CliCaService,
+            cli_logger_service_1.CliLoggerService,
+            cli_endpoint_resolver_service_1.CliEndpointResolverService,
+            cluster_storage_service_1.ClusterStorageService,
+            cluster_capacity_service_1.ClusterCapacityService,
+            // Stubs for CLI mode (no apps DB, no SSH-cert key registry).
+            // ClusterNodeScalingService.scaleNode does not touch ApplicationEntity/SSH at all,
+            // so these stubs only matter for expandSharedVolume which is not validatable in CLI mode.
+            {
+                provide: (0, typeorm_shim_1.getRepositoryToken)(application_entity_1.ApplicationEntity),
+                useValue: (() => {
+                    const emptyQueryBuilder = {
+                        where: () => emptyQueryBuilder,
+                        andWhere: () => emptyQueryBuilder,
+                        getMany: async () => [],
+                    };
+                    return {
+                        find: async () => [],
+                        findOne: async () => null,
+                        createQueryBuilder: () => emptyQueryBuilder,
+                    };
+                })(),
+            },
+            native_ssh_connection_service_1.NativeSSHConnectionService,
+            {
+                // CLI-mode AccessService stub: pulls the bootstrap private key from
+                // ~/.flui/bootstrap-keys/<keyId> (where the CLI stored it at cluster
+                // creation time). Avoids depending on the full AccessService which
+                // expects a DB-backed key registry.
+                provide: access_service_1.AccessService,
+                useFactory: () => {
+                    const fs = require('node:fs/promises');
+                    const path = require('node:path');
+                    const os = require('node:os');
+                    return {
+                        getPrivateKey: async (_user, keyId) => {
+                            const candidates = [
+                                path.join(os.homedir(), '.flui', 'bootstrap-keys', keyId),
+                                path.join(os.homedir(), '.flui', 'bootstrap-keys', `${keyId}.pem`),
+                                path.join(os.homedir(), '.flui', 'bootstrap-keys', `${keyId}.key`),
+                            ];
+                            for (const p of candidates) {
+                                try {
+                                    return await fs.readFile(p, 'utf8');
+                                }
+                                catch {
+                                    /* try next */
+                                }
+                            }
+                            throw new Error(`Bootstrap key ${keyId} not found under ~/.flui/bootstrap-keys/`);
+                        },
+                    };
+                },
+            },
+            cluster_node_scaling_service_1.ClusterNodeScalingService,
+        ],
+        exports: [
+            cli_observability_cluster_service_1.CliObservabilityClusterService,
+            cli_clusters_service_1.CliClustersService,
+            kubernetes_service_1.KubernetesService,
+            label_service_1.LabelService,
+            cli_ssh_service_1.CliSshService,
+            cli_ca_service_1.CliCaService,
+            cli_logger_service_1.CliLoggerService,
+            cli_endpoint_resolver_service_1.CliEndpointResolverService,
+            cluster_storage_service_1.ClusterStorageService,
+            cluster_capacity_service_1.ClusterCapacityService,
+            cluster_node_scaling_service_1.ClusterNodeScalingService,
+        ],
+    })
+], CliInfrastructureModule);