@flui-cloud/cli 0.0.1

package/lib/src/modules/access/services/key-storage.service.js

@@ -0,0 +1,133 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var KeyStorageService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeyStorageService = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const fs = __importStar(require("node:fs/promises"));
+const path = __importStar(require("node:path"));
+const crypto = __importStar(require("node:crypto"));
+let KeyStorageService = KeyStorageService_1 = class KeyStorageService {
+    constructor(configService) {
+        this.configService = configService;
+        this.logger = new common_1.Logger(KeyStorageService_1.name);
+        this.keyBasePath = this.configService.get('SSH_KEYS_PATH', '/secure/keys');
+        const secretKey = this.configService.get('SSH_KEY_ENCRYPTION_KEY', 
+        // Default 32-byte hex key if not provided
+        '0000111122223333444455556666777788889999aaaabbbbccccddddeeeeffff');
+        if (!secretKey) {
+            this.logger.warn('No SSH_KEY_ENCRYPTION_KEY provided, using default key');
+        }
+        this.encryptionKey = Buffer.from(secretKey, 'hex');
+    }
+    async storePrivateKey(userId, keyId, privateKey) {
+        const keyPath = this.getKeyPath(userId, keyId);
+        await fs.mkdir(path.dirname(keyPath), { recursive: true });
+        const encryptedKey = this.encryptKey(privateKey);
+        await fs.writeFile(keyPath, encryptedKey);
+        await fs.chmod(keyPath, 0o600);
+        return keyPath;
+    }
+    async retrievePrivateKey(keyPath) {
+        const encryptedKey = await fs.readFile(keyPath);
+        return this.decryptKey(encryptedKey);
+    }
+    async deleteKey(keyPath) {
+        try {
+            await fs.unlink(keyPath);
+            await this.cleanupKeyDirectory(keyPath);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT') {
+                throw error;
+            }
+        }
+    }
+    encryptKeyToString(privateKey) {
+        const encryptedBuffer = this.encryptKey(privateKey);
+        return encryptedBuffer.toString('base64');
+    }
+    encryptKey(privateKey) {
+        const iv = crypto.randomBytes(16);
+        const cipher = crypto.createCipheriv('aes-256-gcm', this.encryptionKey, iv);
+        const encrypted = Buffer.concat([
+            cipher.update(privateKey, 'utf8'),
+            cipher.final(),
+        ]);
+        const authTag = cipher.getAuthTag();
+        return Buffer.concat([iv, authTag, encrypted]);
+    }
+    decryptKey(encryptedData) {
+        const iv = encryptedData.subarray(0, 16);
+        const authTag = encryptedData.subarray(16, 32);
+        const encryptedKey = encryptedData.subarray(32);
+        const decipher = crypto.createDecipheriv('aes-256-gcm', this.encryptionKey, iv);
+        decipher.setAuthTag(authTag);
+        return Buffer.concat([
+            decipher.update(encryptedKey),
+            decipher.final(),
+        ]).toString('utf8');
+    }
+    decryptKeyFromString(encryptedString) {
+        const encryptedBuffer = Buffer.from(encryptedString, 'base64');
+        return this.decryptKey(encryptedBuffer);
+    }
+    getKeyPath(userId, keyId) {
+        return path.join(this.keyBasePath, userId, keyId, 'private.key');
+    }
+    async cleanupKeyDirectory(keyPath) {
+        const directory = path.dirname(keyPath);
+        const files = await fs.readdir(directory);
+        if (files.length === 0) {
+            await fs.rmdir(directory);
+            await this.cleanupKeyDirectory(directory);
+        }
+    }
+};
+exports.KeyStorageService = KeyStorageService;
+exports.KeyStorageService = KeyStorageService = KeyStorageService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [config_1.ConfigService])
+], KeyStorageService);

package/lib/src/modules/access/services/ssh-key-generator.service.d.ts

@@ -0,0 +1,6 @@
+import { SSHKeyPair } from '../interfaces/ssh-key.interface';
+export declare class SSHKeyGeneratorService {
+    private readonly logger;
+    generateKeyPair(type?: 'ed25519' | 'rsa'): Promise<SSHKeyPair>;
+    private generateFingerprint;
+}

package/lib/src/modules/access/services/ssh-key-generator.service.js

@@ -0,0 +1,51 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var SSHKeyGeneratorService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SSHKeyGeneratorService = void 0;
+const common_1 = require("@nestjs/common");
+const ssh2_1 = require("ssh2");
+const node_crypto_1 = require("node:crypto");
+let SSHKeyGeneratorService = SSHKeyGeneratorService_1 = class SSHKeyGeneratorService {
+    constructor() {
+        this.logger = new common_1.Logger(SSHKeyGeneratorService_1.name);
+    }
+    async generateKeyPair(type = 'ed25519') {
+        return new Promise((resolve, reject) => {
+            const options = type === 'rsa' ? { bits: 4096 } : undefined;
+            ssh2_1.utils.generateKeyPair(type, options, (err, keys) => {
+                if (err) {
+                    reject(new Error(`Failed to generate SSH key pair: ${err.message}`));
+                    return;
+                }
+                const fingerprint = this.generateFingerprint(keys.public);
+                this.logger.debug(`Generated SSH key | fingerprint: ${fingerprint}`);
+                resolve({
+                    publicKey: keys.public,
+                    privateKey: keys.private,
+                    fingerprint: fingerprint,
+                });
+            });
+        });
+    }
+    generateFingerprint(publicKey) {
+        const parts = publicKey.split(' ');
+        if (parts.length < 2) {
+            throw new Error('Invalid public key format');
+        }
+        const keyData = parts[1];
+        const hash = (0, node_crypto_1.createHash)('sha256')
+            .update(Buffer.from(keyData, 'base64'))
+            .digest('base64');
+        return `SHA256:${hash}`;
+    }
+};
+exports.SSHKeyGeneratorService = SSHKeyGeneratorService;
+exports.SSHKeyGeneratorService = SSHKeyGeneratorService = SSHKeyGeneratorService_1 = __decorate([
+    (0, common_1.Injectable)()
+], SSHKeyGeneratorService);

package/lib/src/modules/app-builds/entities/app-build.entity.d.ts

@@ -0,0 +1,38 @@
+import { AppBuildStatus } from '../enums/app-build-status.enum';
+import { BuildProvider } from '../enums/build-provider.enum';
+export declare class AppBuildEntity {
+    id: string;
+    applicationId: string | null;
+    provider: BuildProvider;
+    targetClusterId: string | null;
+    gitUrl: string | null;
+    suggestedName: string | null;
+    buildClusterId: string | null;
+    branch: string;
+    commitSha?: string;
+    imageRef?: string;
+    k8sJobName: string | null;
+    k8sPodName?: string;
+    externalRunId?: string;
+    externalUrl?: string;
+    logsUrl?: string;
+    status: AppBuildStatus;
+    railpackPlan?: Record<string, any>;
+    detectedPort?: number;
+    detectedFramework?: string;
+    detectedFrontendFramework?: string;
+    detectedStartCommand?: string;
+    deployStrategy?: string | null;
+    deployabilityScore?: number | null;
+    deployabilityFactors?: Record<string, unknown> | null;
+    suggestedBuildCommand?: string | null;
+    suggestedStartCommand?: string | null;
+    recommendedStructure?: string[] | null;
+    logs?: string[];
+    errorMessage?: string;
+    operationId?: string;
+    startedAt?: Date;
+    completedAt?: Date;
+    createdAt: Date;
+    updatedAt: Date;
+}

package/lib/src/modules/app-builds/entities/app-build.entity.js

@@ -0,0 +1,168 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppBuildEntity = void 0;
+const typeorm_1 = require("typeorm");
+const app_build_status_enum_1 = require("../enums/app-build-status.enum");
+const build_provider_enum_1 = require("../enums/build-provider.enum");
+let AppBuildEntity = class AppBuildEntity {
+};
+exports.AppBuildEntity = AppBuildEntity;
+__decorate([
+    (0, typeorm_1.PrimaryGeneratedColumn)('uuid'),
+    __metadata("design:type", String)
+], AppBuildEntity.prototype, "id", void 0);
+__decorate([
+    (0, typeorm_1.Index)(),
+    (0, typeorm_1.Column)({ type: 'uuid', nullable: true }),
+    __metadata("design:type", String)
+], AppBuildEntity.prototype, "applicationId", void 0);
+__decorate([
+    (0, typeorm_1.Column)({
+        type: 'enum',
+        enum: build_provider_enum_1.BuildProvider,
+        default: build_provider_enum_1.BuildProvider.IN_CLUSTER_AGENT,
+    }),
+    __metadata("design:type", String)
+], AppBuildEntity.prototype, "provider", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'uuid', nullable: true }),
+    __metadata("design:type", String)
+], AppBuildEntity.prototype, "targetClusterId", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ length: 500, nullable: true }),
+    __metadata("design:type", String)
+], AppBuildEntity.prototype, "gitUrl", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ length: 255, nullable: true }),
+    __metadata("design:type", String)
+], AppBuildEntity.prototype, "suggestedName", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'uuid', nullable: true }),
+    __metadata("design:type", String)
+], AppBuildEntity.prototype, "buildClusterId", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ length: 255 }),
+    __metadata("design:type", String)
+], AppBuildEntity.prototype, "branch", void 0);
+__decorate([
+    (0, typeorm_1.Index)(),
+    (0, typeorm_1.Column)({ length: 255, nullable: true }),
+    __metadata("design:type", String)
+], AppBuildEntity.prototype, "commitSha", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ length: 500, nullable: true }),
+    __metadata("design:type", String)
+], AppBuildEntity.prototype, "imageRef", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ length: 255, nullable: true }),
+    __metadata("design:type", String)
+], AppBuildEntity.prototype, "k8sJobName", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ length: 255, nullable: true }),
+    __metadata("design:type", String)
+], AppBuildEntity.prototype, "k8sPodName", void 0);
+__decorate([
+    (0, typeorm_1.Index)(),
+    (0, typeorm_1.Column)({ length: 255, nullable: true }),
+    __metadata("design:type", String)
+], AppBuildEntity.prototype, "externalRunId", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ length: 1000, nullable: true }),
+    __metadata("design:type", String)
+], AppBuildEntity.prototype, "externalUrl", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ length: 1000, nullable: true }),
+    __metadata("design:type", String)
+], AppBuildEntity.prototype, "logsUrl", void 0);
+__decorate([
+    (0, typeorm_1.Column)({
+        type: 'enum',
+        enum: app_build_status_enum_1.AppBuildStatus,
+        default: app_build_status_enum_1.AppBuildStatus.PENDING,
+    }),
+    __metadata("design:type", String)
+], AppBuildEntity.prototype, "status", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'json', nullable: true }),
+    __metadata("design:type", Object)
+], AppBuildEntity.prototype, "railpackPlan", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'int', nullable: true }),
+    __metadata("design:type", Number)
+], AppBuildEntity.prototype, "detectedPort", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ length: 64, nullable: true }),
+    __metadata("design:type", String)
+], AppBuildEntity.prototype, "detectedFramework", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ length: 64, nullable: true }),
+    __metadata("design:type", String)
+], AppBuildEntity.prototype, "detectedFrontendFramework", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'text', nullable: true }),
+    __metadata("design:type", String)
+], AppBuildEntity.prototype, "detectedStartCommand", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ length: 64, nullable: true }),
+    __metadata("design:type", String)
+], AppBuildEntity.prototype, "deployStrategy", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'decimal', precision: 4, scale: 3, nullable: true }),
+    __metadata("design:type", Number)
+], AppBuildEntity.prototype, "deployabilityScore", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'json', nullable: true }),
+    __metadata("design:type", Object)
+], AppBuildEntity.prototype, "deployabilityFactors", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'text', nullable: true }),
+    __metadata("design:type", String)
+], AppBuildEntity.prototype, "suggestedBuildCommand", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'text', nullable: true }),
+    __metadata("design:type", String)
+], AppBuildEntity.prototype, "suggestedStartCommand", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'simple-array', nullable: true }),
+    __metadata("design:type", Array)
+], AppBuildEntity.prototype, "recommendedStructure", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'simple-array', nullable: true }),
+    __metadata("design:type", Array)
+], AppBuildEntity.prototype, "logs", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'text', nullable: true }),
+    __metadata("design:type", String)
+], AppBuildEntity.prototype, "errorMessage", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ nullable: true }),
+    __metadata("design:type", String)
+], AppBuildEntity.prototype, "operationId", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'timestamptz', nullable: true }),
+    __metadata("design:type", Date)
+], AppBuildEntity.prototype, "startedAt", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'timestamptz', nullable: true }),
+    __metadata("design:type", Date)
+], AppBuildEntity.prototype, "completedAt", void 0);
+__decorate([
+    (0, typeorm_1.CreateDateColumn)({ type: 'timestamptz' }),
+    __metadata("design:type", Date)
+], AppBuildEntity.prototype, "createdAt", void 0);
+__decorate([
+    (0, typeorm_1.UpdateDateColumn)({ type: 'timestamptz' }),
+    __metadata("design:type", Date)
+], AppBuildEntity.prototype, "updatedAt", void 0);
+exports.AppBuildEntity = AppBuildEntity = __decorate([
+    (0, typeorm_1.Entity)('app_builds')
+], AppBuildEntity);

package/lib/src/modules/app-builds/enums/app-build-status.enum.d.ts

@@ -0,0 +1,10 @@
+export declare enum AppBuildStatus {
+    PENDING = "PENDING",
+    CLONING = "CLONING",
+    ANALYZING = "ANALYZING",
+    BUILDING = "BUILDING",
+    PUSHING = "PUSHING",
+    COMPLETED = "COMPLETED",
+    FAILED = "FAILED",
+    CANCELLED = "CANCELLED"
+}

package/lib/src/modules/app-builds/enums/app-build-status.enum.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppBuildStatus = void 0;
+var AppBuildStatus;
+(function (AppBuildStatus) {
+    AppBuildStatus["PENDING"] = "PENDING";
+    AppBuildStatus["CLONING"] = "CLONING";
+    AppBuildStatus["ANALYZING"] = "ANALYZING";
+    AppBuildStatus["BUILDING"] = "BUILDING";
+    AppBuildStatus["PUSHING"] = "PUSHING";
+    AppBuildStatus["COMPLETED"] = "COMPLETED";
+    AppBuildStatus["FAILED"] = "FAILED";
+    AppBuildStatus["CANCELLED"] = "CANCELLED";
+})(AppBuildStatus || (exports.AppBuildStatus = AppBuildStatus = {}));

package/lib/src/modules/app-builds/enums/build-provider.enum.d.ts

@@ -0,0 +1,6 @@
+export declare enum BuildProvider {
+    IN_CLUSTER_AGENT = "IN_CLUSTER_AGENT",
+    GITHUB_ACTIONS = "GITHUB_ACTIONS",
+    RAILPACK = "RAILPACK",
+    DOCKERFILE = "DOCKERFILE"
+}

package/lib/src/modules/app-builds/enums/build-provider.enum.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BuildProvider = void 0;
+var BuildProvider;
+(function (BuildProvider) {
+    BuildProvider["IN_CLUSTER_AGENT"] = "IN_CLUSTER_AGENT";
+    BuildProvider["GITHUB_ACTIONS"] = "GITHUB_ACTIONS";
+    BuildProvider["RAILPACK"] = "RAILPACK";
+    BuildProvider["DOCKERFILE"] = "DOCKERFILE";
+})(BuildProvider || (exports.BuildProvider = BuildProvider = {}));

package/lib/src/modules/app-builds/services/build-job.service.d.ts

@@ -0,0 +1,178 @@
+import { ConfigService } from '@nestjs/config';
+import { KubernetesService } from '../../infrastructure/shared/services/kubernetes.service';
+import { AppBuildEntity } from '../entities/app-build.entity';
+import { ApplicationEntity } from '../../applications/entities/application.entity';
+export declare const BUILD_NAMESPACE = "flui-build";
+export declare const BUILD_RUNNER_IMAGE = "ghcr.io/dawit-io/flui-build-runner:railpack-0.22.2";
+export declare const BUILD_CACHE_PVC_NAME = "flui-buildkit-cache";
+interface BuildJobInfo {
+    name: string;
+    status: 'Running' | 'Pending' | 'Succeeded' | 'Failed' | 'Unknown';
+    ageSecs: number;
+    buildId: string | null;
+    appSlug: string | null;
+    purpose: string | null;
+    cpuRequestMillicores: number;
+    memoryRequestMiB: number;
+}
+interface BuildPodInfo {
+    name: string;
+    phase: string;
+    ageSecs: number;
+    buildId: string | null;
+    appSlug: string | null;
+    containers: Array<{
+        name: string;
+        ready: boolean;
+        state: string;
+    }>;
+}
+/** Total CPU request (millicores) for a single build Job (git-clone + railpack + buildkitd) */
+export declare const BUILD_JOB_CPU_REQUEST = 800;
+/** Total memory request (Mi) for a single build Job */
+export declare const BUILD_JOB_MEMORY_REQUEST = 896;
+export interface BuildJobConfig {
+    build: AppBuildEntity;
+    app: ApplicationEntity;
+    repoOwner: string;
+    repoName: string;
+    githubToken: string;
+    imageRef: string;
+    noCache?: boolean;
+    cloneUrl?: string;
+    deployStrategy?: string;
+    suggestedBuildCommand?: string;
+    suggestedStartCommand?: string;
+    dockerfileContent?: string;
+}
+export declare class BuildJobService {
+    private readonly kubernetesService;
+    private readonly configService;
+    private readonly logger;
+    constructor(kubernetesService: KubernetesService, configService: ConfigService);
+    /**
+     * Ensure the flui-build namespace exists with the correct PSA labels.
+     * Uses server-side apply so labels are always patched even if namespace already exists.
+     */
+    ensureBuildNamespace(kubeconfig: string): Promise<void>;
+    /**
+     * Create or update the ghcr-push-secret in the flui-build namespace.
+     * Contains:
+     *   - dockerconfig: Docker config.json for ghcr.io authentication
+     *   - github_token: plaintext token for git clone via HTTPS
+     */
+    ensureGhcrSecret(kubeconfig: string, githubUsername: string, githubToken: string): Promise<void>;
+    /**
+     * Ensure the flui-buildkit-cache PVC exists in the flui-build namespace.
+     * Mounts at /var/lib/buildkit in the buildkitd container to persist BuildKit's
+     * content-addressable store across Jobs. This covers all package manager caches
+     * (pnpm, NuGet, Maven, Gradle, pip, etc.) via railpack's RUN --mount=type=cache directives.
+     */
+    ensureBuildCachePvc(kubeconfig: string): Promise<void>;
+    /**
+     * Delete the flui-buildkit-cache PVC. Used by cache-clear operations.
+     * Deletion is permanent — the underlying volume data is wiped.
+     */
+    deleteBuildCachePvc(kubeconfig: string): Promise<void>;
+    /**
+     * Return metadata about the flui-buildkit-cache PVC from the Kubernetes API.
+     * Returns null if the PVC does not exist.
+     */
+    getBuildCachePvcInfo(kubeconfig: string): Promise<{
+        exists: boolean;
+        phase: string | null;
+        capacity: string | null;
+        storageClass: string | null;
+        createdAt: Date | null;
+    }>;
+    /**
+     * Build the image reference for the build.
+     * Format: ghcr.io/{githubUsername}/{appName}:{branch}-{shortSha}
+     * appName is derived from appSlug stripping any trailing branch/random suffix
+     * so the ghcr.io package name stays stable across branches and rebuilds.
+     */
+    buildImageRef(githubUsername: string, appSlug: string, commitSha?: string, branch?: string, suffix?: string): string;
+    /**
+     * Generate a DNS-safe K8s Job name from the app slug and commit SHA.
+     * Ensures max 63 chars (K8s name limit).
+     */
+    buildJobName(appSlug: string, commitSha?: string, suffix?: string): string;
+    /**
+     * Apply the K3s build Job manifest to the cluster.
+     * Returns the job name applied.
+     */
+    createBuildJob(kubeconfig: string, config: BuildJobConfig): Promise<string>;
+    /**
+     * Ensure the build runner image exists in ghcr.io.
+     * If missing, bootstrap it by running a K8s Job that builds and pushes the image
+     * using the same BuildKit infrastructure used for app builds.
+     */
+    ensureBuildRunnerImage(kubeconfig: string, githubUsername: string, githubToken: string): Promise<void>;
+    /**
+     * Check if the build runner image exists in the ghcr.io registry.
+     * Uses the Docker Distribution API v2 with the user's GitHub token.
+     */
+    private checkBuildRunnerExists;
+    /**
+     * Build and push the build runner image by running a one-off K8s Job.
+     * The Job writes the Dockerfile from an embedded template, then uses
+     * BuildKit (already available in the cluster) to build and push it.
+     */
+    private bootstrapBuildRunnerImage;
+    private httpsGetJson;
+    private httpsHeadStatus;
+    /**
+     * Delete a K3s Job and its pods (best-effort cleanup on failure).
+     */
+    deleteJob(kubeconfig: string, jobName: string, buildId?: string): Promise<void>;
+    /**
+     * Poll until the build Job pod transitions to Running.
+     * Streams K8s Events for the pod to onStatusLine so the frontend receives
+     * live feedback (image pulls, container creation, etc.) during Pending.
+     * Returns the pod name once running.
+     */
+    waitForPodRunning(kubeconfig: string, buildId: string, timeoutMs?: number, onStatusLine?: (line: string) => void): Promise<string>;
+    /**
+     * Poll the Job status until it succeeds or fails.
+     * Returns true on success, throws on failure.
+     */
+    waitForJobCompletion(kubeconfig: string, jobName: string, timeoutMs?: number): Promise<void>;
+    /**
+     * List all Jobs and Pods in the flui-build namespace with status, age, and labels.
+     *
+     * Tolerates a missing namespace (returns empty lists) so that callers can
+     * safely query diagnostic endpoints on clusters where the in-cluster build
+     * agent has never run — e.g. when the master switch is disabled.
+     */
+    getNamespaceResources(kubeconfig: string): Promise<{
+        jobs: BuildJobInfo[];
+        pods: BuildPodInfo[];
+    }>;
+    /**
+     * Returns true if the error came from the Kubernetes API indicating that
+     * the target namespace (or a resource within it) does not exist.
+     * Handles both the new `@kubernetes/client-node` v1 error shape
+     * (`ApiException` with `.code`) and the legacy `.response.statusCode` shape.
+     */
+    private isNamespaceNotFoundError;
+    /**
+     * Delete stale Jobs and orphaned Pods from the flui-build namespace.
+     * Stale = build is in a terminal DB state, or the resource is in a K8s terminal state.
+     * @param activeBuilds Set of build IDs that are currently in-progress (should NOT be deleted).
+     * @param olderThanMinutes If > 0, skip resources younger than this threshold.
+     * @param dryRun If true, return what would be deleted without making changes.
+     */
+    cleanupStaleResources(kubeconfig: string, activeBuilds: Set<string>, olderThanMinutes: number, dryRun: boolean): Promise<{
+        deletedJobs: string[];
+        deletedPods: string[];
+    }>;
+    private isJobStale;
+    private isPodStale;
+    private deriveJobStatus;
+    private deriveContainerState;
+    private ageSeconds;
+    private parseCpuMillicores;
+    private parseMemoryMiB;
+    private sleep;
+}
+export {};