@flui-cloud/cli 0.0.1

package/lib/src/modules/dns/entities/dns-zone.entity.js

@@ -0,0 +1,53 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DnsZoneEntity = void 0;
+const typeorm_1 = require("typeorm");
+const dns_provider_enum_1 = require("../../providers/enums/dns-provider.enum");
+const cluster_dns_zone_entity_1 = require("./cluster-dns-zone.entity");
+let DnsZoneEntity = class DnsZoneEntity {
+};
+exports.DnsZoneEntity = DnsZoneEntity;
+__decorate([
+    (0, typeorm_1.PrimaryGeneratedColumn)('uuid'),
+    __metadata("design:type", String)
+], DnsZoneEntity.prototype, "id", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'varchar' }),
+    __metadata("design:type", String)
+], DnsZoneEntity.prototype, "providerZoneId", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'varchar' }),
+    __metadata("design:type", String)
+], DnsZoneEntity.prototype, "zoneName", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'enum', enum: dns_provider_enum_1.DnsProvider }),
+    __metadata("design:type", String)
+], DnsZoneEntity.prototype, "dnsProvider", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'varchar', nullable: true }),
+    __metadata("design:type", String)
+], DnsZoneEntity.prototype, "description", void 0);
+__decorate([
+    (0, typeorm_1.CreateDateColumn)({ type: 'timestamptz' }),
+    __metadata("design:type", Date)
+], DnsZoneEntity.prototype, "createdAt", void 0);
+__decorate([
+    (0, typeorm_1.UpdateDateColumn)({ type: 'timestamptz' }),
+    __metadata("design:type", Date)
+], DnsZoneEntity.prototype, "updatedAt", void 0);
+__decorate([
+    (0, typeorm_1.OneToMany)(() => cluster_dns_zone_entity_1.ClusterDnsZoneEntity, (assignment) => assignment.dnsZone),
+    __metadata("design:type", Array)
+], DnsZoneEntity.prototype, "clusterAssignments", void 0);
+exports.DnsZoneEntity = DnsZoneEntity = __decorate([
+    (0, typeorm_1.Entity)('dns_zones')
+], DnsZoneEntity);

package/lib/src/modules/dns/entities/san-certificate.entity.d.ts

@@ -0,0 +1,29 @@
+import { ClusterEntity } from '../../infrastructure/clusters/entities/cluster.entity';
+import { ClusterDnsZoneEntity } from './cluster-dns-zone.entity';
+import { CertificateProvider } from '../../providers/enums/certificate-provider.enum';
+import { CertificateStatus } from '../../providers/interfaces/certificate-provider.interface';
+import { ReconciliationStatus } from '../../infrastructure/shared/enums/reconciliation-status.enum';
+import { CertChallenge } from '../enums/cert-challenge.enum';
+export declare class SanCertificateEntity {
+    id: string;
+    clusterId: string;
+    cluster: ClusterEntity;
+    clusterDnsZoneId: string | null;
+    clusterDnsZone: ClusterDnsZoneEntity | null;
+    name: string;
+    dnsNames: string[];
+    certChallenge: CertChallenge;
+    certificateProvider: CertificateProvider;
+    masterNamespace: string;
+    masterCertName: string;
+    masterSecretName: string;
+    issuerName: string;
+    status: CertificateStatus;
+    reconciliationStatus: ReconciliationStatus;
+    notAfter: Date;
+    renewalTime: Date;
+    lastReconciliationAt: Date;
+    errorMessage: string;
+    createdAt: Date;
+    updatedAt: Date;
+}

package/lib/src/modules/dns/entities/san-certificate.entity.js

@@ -0,0 +1,132 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SanCertificateEntity = void 0;
+const typeorm_1 = require("typeorm");
+const cluster_entity_1 = require("../../infrastructure/clusters/entities/cluster.entity");
+const cluster_dns_zone_entity_1 = require("./cluster-dns-zone.entity");
+const certificate_provider_enum_1 = require("../../providers/enums/certificate-provider.enum");
+const certificate_provider_interface_1 = require("../../providers/interfaces/certificate-provider.interface");
+const reconciliation_status_enum_1 = require("../../infrastructure/shared/enums/reconciliation-status.enum");
+const cert_challenge_enum_1 = require("../enums/cert-challenge.enum");
+let SanCertificateEntity = class SanCertificateEntity {
+};
+exports.SanCertificateEntity = SanCertificateEntity;
+__decorate([
+    (0, typeorm_1.PrimaryGeneratedColumn)('uuid'),
+    __metadata("design:type", String)
+], SanCertificateEntity.prototype, "id", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'uuid' }),
+    __metadata("design:type", String)
+], SanCertificateEntity.prototype, "clusterId", void 0);
+__decorate([
+    (0, typeorm_1.ManyToOne)(() => cluster_entity_1.ClusterEntity, { onDelete: 'CASCADE' }),
+    (0, typeorm_1.JoinColumn)({ name: 'clusterId' }),
+    __metadata("design:type", cluster_entity_1.ClusterEntity)
+], SanCertificateEntity.prototype, "cluster", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'uuid', nullable: true }),
+    __metadata("design:type", String)
+], SanCertificateEntity.prototype, "clusterDnsZoneId", void 0);
+__decorate([
+    (0, typeorm_1.ManyToOne)(() => cluster_dns_zone_entity_1.ClusterDnsZoneEntity, {
+        nullable: true,
+        eager: true,
+        onDelete: 'SET NULL',
+    }),
+    (0, typeorm_1.JoinColumn)({ name: 'clusterDnsZoneId' }),
+    __metadata("design:type", cluster_dns_zone_entity_1.ClusterDnsZoneEntity)
+], SanCertificateEntity.prototype, "clusterDnsZone", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'varchar' }),
+    __metadata("design:type", String)
+], SanCertificateEntity.prototype, "name", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'simple-array' }),
+    __metadata("design:type", Array)
+], SanCertificateEntity.prototype, "dnsNames", void 0);
+__decorate([
+    (0, typeorm_1.Column)({
+        type: 'enum',
+        enum: cert_challenge_enum_1.CertChallenge,
+        default: cert_challenge_enum_1.CertChallenge.HTTP_01,
+    }),
+    __metadata("design:type", String)
+], SanCertificateEntity.prototype, "certChallenge", void 0);
+__decorate([
+    (0, typeorm_1.Column)({
+        type: 'enum',
+        enum: certificate_provider_enum_1.CertificateProvider,
+        default: certificate_provider_enum_1.CertificateProvider.LETS_ENCRYPT,
+    }),
+    __metadata("design:type", String)
+], SanCertificateEntity.prototype, "certificateProvider", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'varchar', default: 'flui-system' }),
+    __metadata("design:type", String)
+], SanCertificateEntity.prototype, "masterNamespace", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'varchar' }),
+    __metadata("design:type", String)
+], SanCertificateEntity.prototype, "masterCertName", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'varchar' }),
+    __metadata("design:type", String)
+], SanCertificateEntity.prototype, "masterSecretName", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'varchar' }),
+    __metadata("design:type", String)
+], SanCertificateEntity.prototype, "issuerName", void 0);
+__decorate([
+    (0, typeorm_1.Column)({
+        type: 'enum',
+        enum: certificate_provider_interface_1.CertificateStatus,
+        default: certificate_provider_interface_1.CertificateStatus.PENDING,
+    }),
+    __metadata("design:type", String)
+], SanCertificateEntity.prototype, "status", void 0);
+__decorate([
+    (0, typeorm_1.Column)({
+        type: 'enum',
+        enum: reconciliation_status_enum_1.ReconciliationStatus,
+        default: reconciliation_status_enum_1.ReconciliationStatus.PENDING,
+    }),
+    __metadata("design:type", String)
+], SanCertificateEntity.prototype, "reconciliationStatus", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'timestamptz', nullable: true }),
+    __metadata("design:type", Date)
+], SanCertificateEntity.prototype, "notAfter", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'timestamptz', nullable: true }),
+    __metadata("design:type", Date)
+], SanCertificateEntity.prototype, "renewalTime", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'timestamptz', nullable: true }),
+    __metadata("design:type", Date)
+], SanCertificateEntity.prototype, "lastReconciliationAt", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'text', nullable: true }),
+    __metadata("design:type", String)
+], SanCertificateEntity.prototype, "errorMessage", void 0);
+__decorate([
+    (0, typeorm_1.CreateDateColumn)({ type: 'timestamptz' }),
+    __metadata("design:type", Date)
+], SanCertificateEntity.prototype, "createdAt", void 0);
+__decorate([
+    (0, typeorm_1.UpdateDateColumn)({ type: 'timestamptz' }),
+    __metadata("design:type", Date)
+], SanCertificateEntity.prototype, "updatedAt", void 0);
+exports.SanCertificateEntity = SanCertificateEntity = __decorate([
+    (0, typeorm_1.Entity)('san_certificates'),
+    (0, typeorm_1.Index)(['clusterId', 'name'], { unique: true })
+], SanCertificateEntity);

package/lib/src/modules/dns/entities/wildcard-certificate.entity.d.ts

@@ -0,0 +1,26 @@
+import { ClusterEntity } from '../../infrastructure/clusters/entities/cluster.entity';
+import { DnsZoneEntity } from './dns-zone.entity';
+import { CertificateProvider } from '../../providers/enums/certificate-provider.enum';
+import { CertificateStatus } from '../../providers/interfaces/certificate-provider.interface';
+import { ReconciliationStatus } from '../../infrastructure/shared/enums/reconciliation-status.enum';
+export declare class WildcardCertificateEntity {
+    id: string;
+    clusterId: string;
+    cluster: ClusterEntity;
+    dnsZoneId: string;
+    dnsZone: DnsZoneEntity;
+    scope: string;
+    masterNamespace: string;
+    masterSecretName: string;
+    masterCertName: string;
+    issuerName: string;
+    certificateProvider: CertificateProvider;
+    status: CertificateStatus;
+    reconciliationStatus: ReconciliationStatus;
+    notAfter: Date;
+    renewalTime: Date;
+    lastReconciliationAt: Date;
+    errorMessage: string;
+    createdAt: Date;
+    updatedAt: Date;
+}

package/lib/src/modules/dns/entities/wildcard-certificate.entity.js

@@ -0,0 +1,111 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WildcardCertificateEntity = void 0;
+const typeorm_1 = require("typeorm");
+const cluster_entity_1 = require("../../infrastructure/clusters/entities/cluster.entity");
+const dns_zone_entity_1 = require("./dns-zone.entity");
+const certificate_provider_enum_1 = require("../../providers/enums/certificate-provider.enum");
+const certificate_provider_interface_1 = require("../../providers/interfaces/certificate-provider.interface");
+const reconciliation_status_enum_1 = require("../../infrastructure/shared/enums/reconciliation-status.enum");
+let WildcardCertificateEntity = class WildcardCertificateEntity {
+};
+exports.WildcardCertificateEntity = WildcardCertificateEntity;
+__decorate([
+    (0, typeorm_1.PrimaryGeneratedColumn)('uuid'),
+    __metadata("design:type", String)
+], WildcardCertificateEntity.prototype, "id", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'uuid' }),
+    __metadata("design:type", String)
+], WildcardCertificateEntity.prototype, "clusterId", void 0);
+__decorate([
+    (0, typeorm_1.ManyToOne)(() => cluster_entity_1.ClusterEntity, { onDelete: 'CASCADE' }),
+    (0, typeorm_1.JoinColumn)({ name: 'clusterId' }),
+    __metadata("design:type", cluster_entity_1.ClusterEntity)
+], WildcardCertificateEntity.prototype, "cluster", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'uuid' }),
+    __metadata("design:type", String)
+], WildcardCertificateEntity.prototype, "dnsZoneId", void 0);
+__decorate([
+    (0, typeorm_1.ManyToOne)(() => dns_zone_entity_1.DnsZoneEntity, { eager: true }),
+    (0, typeorm_1.JoinColumn)({ name: 'dnsZoneId' }),
+    __metadata("design:type", dns_zone_entity_1.DnsZoneEntity)
+], WildcardCertificateEntity.prototype, "dnsZone", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'varchar' }),
+    __metadata("design:type", String)
+], WildcardCertificateEntity.prototype, "scope", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'varchar' }),
+    __metadata("design:type", String)
+], WildcardCertificateEntity.prototype, "masterNamespace", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'varchar' }),
+    __metadata("design:type", String)
+], WildcardCertificateEntity.prototype, "masterSecretName", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'varchar' }),
+    __metadata("design:type", String)
+], WildcardCertificateEntity.prototype, "masterCertName", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'varchar' }),
+    __metadata("design:type", String)
+], WildcardCertificateEntity.prototype, "issuerName", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'enum', enum: certificate_provider_enum_1.CertificateProvider }),
+    __metadata("design:type", String)
+], WildcardCertificateEntity.prototype, "certificateProvider", void 0);
+__decorate([
+    (0, typeorm_1.Column)({
+        type: 'enum',
+        enum: certificate_provider_interface_1.CertificateStatus,
+        default: certificate_provider_interface_1.CertificateStatus.PENDING,
+    }),
+    __metadata("design:type", String)
+], WildcardCertificateEntity.prototype, "status", void 0);
+__decorate([
+    (0, typeorm_1.Column)({
+        type: 'enum',
+        enum: reconciliation_status_enum_1.ReconciliationStatus,
+        default: reconciliation_status_enum_1.ReconciliationStatus.PENDING,
+    }),
+    __metadata("design:type", String)
+], WildcardCertificateEntity.prototype, "reconciliationStatus", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'timestamptz', nullable: true }),
+    __metadata("design:type", Date)
+], WildcardCertificateEntity.prototype, "notAfter", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'timestamptz', nullable: true }),
+    __metadata("design:type", Date)
+], WildcardCertificateEntity.prototype, "renewalTime", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'timestamptz', nullable: true }),
+    __metadata("design:type", Date)
+], WildcardCertificateEntity.prototype, "lastReconciliationAt", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'text', nullable: true }),
+    __metadata("design:type", String)
+], WildcardCertificateEntity.prototype, "errorMessage", void 0);
+__decorate([
+    (0, typeorm_1.CreateDateColumn)({ type: 'timestamptz' }),
+    __metadata("design:type", Date)
+], WildcardCertificateEntity.prototype, "createdAt", void 0);
+__decorate([
+    (0, typeorm_1.UpdateDateColumn)({ type: 'timestamptz' }),
+    __metadata("design:type", Date)
+], WildcardCertificateEntity.prototype, "updatedAt", void 0);
+exports.WildcardCertificateEntity = WildcardCertificateEntity = __decorate([
+    (0, typeorm_1.Entity)('wildcard_certificates'),
+    (0, typeorm_1.Index)(['clusterId', 'scope'], { unique: true })
+], WildcardCertificateEntity);

package/lib/src/modules/dns/enums/cert-challenge.enum.d.ts

@@ -0,0 +1,4 @@
+export declare enum CertChallenge {
+    HTTP_01 = "http-01",
+    DNS_01 = "dns-01"
+}

package/lib/src/modules/dns/enums/cert-challenge.enum.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CertChallenge = void 0;
+var CertChallenge;
+(function (CertChallenge) {
+    CertChallenge["HTTP_01"] = "http-01";
+    CertChallenge["DNS_01"] = "dns-01";
+})(CertChallenge || (exports.CertChallenge = CertChallenge = {}));

package/lib/src/modules/dns/enums/endpoint-type.enum.d.ts

@@ -0,0 +1,4 @@
+export declare enum EndpointType {
+    PUBLIC = "public",
+    INTERNAL = "internal"
+}

package/lib/src/modules/dns/enums/endpoint-type.enum.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EndpointType = void 0;
+var EndpointType;
+(function (EndpointType) {
+    EndpointType["PUBLIC"] = "public";
+    EndpointType["INTERNAL"] = "internal";
+})(EndpointType || (exports.EndpointType = EndpointType = {}));

package/lib/src/modules/dns/enums/hostname-mode.enum.d.ts

@@ -0,0 +1,4 @@
+export declare enum HostnameMode {
+    IP = "ip",
+    DOMAIN = "domain"
+}

package/lib/src/modules/dns/enums/hostname-mode.enum.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HostnameMode = void 0;
+var HostnameMode;
+(function (HostnameMode) {
+    HostnameMode["IP"] = "ip";
+    HostnameMode["DOMAIN"] = "domain";
+})(HostnameMode || (exports.HostnameMode = HostnameMode = {}));

package/lib/src/modules/dns/services/cluster-dns-cleanup.service.d.ts

@@ -0,0 +1,12 @@
+import { Repository } from 'typeorm';
+import { DnsZoneEntity } from '../entities/dns-zone.entity';
+import { DnsProviderFactory } from '../../providers/services/dns-provider.factory';
+export declare class ClusterDnsCleanupService {
+    private readonly dnsZoneRepository;
+    private readonly dnsProviderFactory;
+    private readonly logger;
+    constructor(dnsZoneRepository: Repository<DnsZoneEntity>, dnsProviderFactory: DnsProviderFactory);
+    deleteRecordsByClusterId(clusterId: string): Promise<number>;
+    private deleteRecordsInZone;
+    private errMessage;
+}

package/lib/src/modules/dns/services/cluster-dns-cleanup.service.js

@@ -0,0 +1,79 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var ClusterDnsCleanupService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClusterDnsCleanupService = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const typeorm_2 = require("typeorm");
+const dns_zone_entity_1 = require("../entities/dns-zone.entity");
+const dns_provider_factory_1 = require("../../providers/services/dns-provider.factory");
+let ClusterDnsCleanupService = ClusterDnsCleanupService_1 = class ClusterDnsCleanupService {
+    constructor(dnsZoneRepository, dnsProviderFactory) {
+        this.dnsZoneRepository = dnsZoneRepository;
+        this.dnsProviderFactory = dnsProviderFactory;
+        this.logger = new common_1.Logger(ClusterDnsCleanupService_1.name);
+    }
+    async deleteRecordsByClusterId(clusterId) {
+        const zones = await this.dnsZoneRepository.find();
+        let deleted = 0;
+        for (const zone of zones) {
+            deleted += await this.deleteRecordsInZone(zone, clusterId);
+        }
+        if (deleted > 0) {
+            this.logger.log(`Removed ${deleted} DNS record(s) tagged with flui-cluster-id=${clusterId}`);
+        }
+        return deleted;
+    }
+    async deleteRecordsInZone(zone, clusterId) {
+        const provider = this.dnsProviderFactory.getDnsProvider(zone.dnsProvider);
+        if (!provider)
+            return 0;
+        let records;
+        try {
+            records = await provider.listRecords(zone.providerZoneId);
+        }
+        catch (err) {
+            this.logger.warn(`Failed to list DNS records on zone ${zone.zoneName}: ${this.errMessage(err)}`);
+            return 0;
+        }
+        const matching = records.filter((r) => {
+            const labels = r.labels ?? {};
+            return (labels['flui-cluster-id'] === clusterId &&
+                labels['managed-by'] === 'flui-cloud');
+        });
+        let deleted = 0;
+        for (const record of matching) {
+            try {
+                await provider.deleteRecord(zone.providerZoneId, record.recordId);
+                deleted++;
+                this.logger.log(`Deleted DNS record ${record.type} ${record.name} -> ${record.value} from zone ${zone.zoneName} (cluster ${clusterId})`);
+            }
+            catch (err) {
+                this.logger.warn(`Failed to delete DNS record ${record.recordId} from zone ${zone.zoneName}: ${this.errMessage(err)}`);
+            }
+        }
+        return deleted;
+    }
+    errMessage(err) {
+        return err instanceof Error ? err.message : String(err);
+    }
+};
+exports.ClusterDnsCleanupService = ClusterDnsCleanupService;
+exports.ClusterDnsCleanupService = ClusterDnsCleanupService = ClusterDnsCleanupService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, typeorm_1.InjectRepository)(dns_zone_entity_1.DnsZoneEntity)),
+    __metadata("design:paramtypes", [typeorm_2.Repository,
+        dns_provider_factory_1.DnsProviderFactory])
+], ClusterDnsCleanupService);

package/lib/src/modules/dns/utils/nip-hostname.util.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Centralized nip.io hostname builders. Keep these in sync between bootstrap
+ * (system services) and user-facing endpoints so cluster-wide hostname
+ * conventions stay coherent.
+ *
+ * The IP is encoded with dashes (`162-55-56-10.nip.io`) rather than dots so
+ * that any token between the service prefix and the IP cannot collide with
+ * nip.io's greedy IPv4 extraction across labels (which historically caused
+ * `app.royal-gecko-72.162.55.56.10.nip.io` to resolve to `72.162.55.56`).
+ */
+export declare function buildSystemNipHostname(service: 'auth' | 'app' | 'grafana' | 'api', masterIp: string, token?: string | null): string;
+export declare function buildAppNipHostname(slug: string, masterIp: string): string;

package/lib/src/modules/dns/utils/nip-hostname.util.js

@@ -0,0 +1,27 @@
+"use strict";
+/**
+ * Centralized nip.io hostname builders. Keep these in sync between bootstrap
+ * (system services) and user-facing endpoints so cluster-wide hostname
+ * conventions stay coherent.
+ *
+ * The IP is encoded with dashes (`162-55-56-10.nip.io`) rather than dots so
+ * that any token between the service prefix and the IP cannot collide with
+ * nip.io's greedy IPv4 extraction across labels (which historically caused
+ * `app.royal-gecko-72.162.55.56.10.nip.io` to resolve to `72.162.55.56`).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildSystemNipHostname = buildSystemNipHostname;
+exports.buildAppNipHostname = buildAppNipHostname;
+function encodeNipIp(masterIp) {
+    return masterIp.replaceAll('.', '-');
+}
+function buildSystemNipHostname(service, masterIp, token) {
+    const ip = encodeNipIp(masterIp);
+    if (token) {
+        return `${service}.${token}.${ip}.nip.io`;
+    }
+    return `${service}.${ip}.nip.io`;
+}
+function buildAppNipHostname(slug, masterIp) {
+    return `${slug}.${encodeNipIp(masterIp)}.nip.io`;
+}

package/lib/src/modules/dns/utils/nip-token.util.d.ts

@@ -0,0 +1,2 @@
+export declare function generateNipHostnameToken(): string;
+export declare function isValidNipHostnameToken(token: string): boolean;

package/lib/src/modules/dns/utils/nip-token.util.js

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateNipHostnameToken = generateNipHostnameToken;
+exports.isValidNipHostnameToken = isValidNipHostnameToken;
+const node_crypto_1 = require("node:crypto");
+const ADJECTIVES = [
+    'clever',
+    'silent',
+    'cosmic',
+    'gentle',
+    'brave',
+    'swift',
+    'mellow',
+    'sunny',
+    'lucky',
+    'witty',
+    'breezy',
+    'cheerful',
+    'eager',
+    'fancy',
+    'jolly',
+    'kind',
+    'lively',
+    'merry',
+    'noble',
+    'plucky',
+    'quiet',
+    'royal',
+    'shiny',
+    'tidy',
+    'vivid',
+    'warm',
+    'zesty',
+    'amber',
+    'cobalt',
+    'jade',
+];
+const NOUNS = [
+    'otter',
+    'panda',
+    'falcon',
+    'mole',
+    'lynx',
+    'badger',
+    'heron',
+    'koala',
+    'puffin',
+    'gecko',
+    'beaver',
+    'meerkat',
+    'narwhal',
+    'oryx',
+    'quokka',
+    'raven',
+    'sparrow',
+    'tapir',
+    'urchin',
+    'vole',
+    'walrus',
+    'yak',
+    'zebra',
+    'finch',
+    'marmot',
+    'newt',
+    'owl',
+    'pika',
+    'robin',
+    'seal',
+];
+const TOKEN_REGEX = /^[a-z0-9-]+$/;
+const TOKEN_MAX_LENGTH = 30;
+// nip.io extracts the IPv4 from the rightmost numeric labels of the FQDN.
+// A token whose trailing chunk is purely digits collides with that scan and
+// the IP gets mis-parsed (e.g. `royal-gecko-72.162.55.56.10.nip.io` resolves
+// to `72.162.55.56`). Forcing a letter at the tail prevents the collision.
+function randomLowerLetter() {
+    const buf = (0, node_crypto_1.randomBytes)(1);
+    return String.fromCodePoint(97 + (buf[0] % 26));
+}
+function generateNipHostnameToken() {
+    const adj = ADJECTIVES[Math.floor(Math.random() * ADJECTIVES.length)];
+    const noun = NOUNS[Math.floor(Math.random() * NOUNS.length)];
+    const suffix = randomLowerLetter() + randomLowerLetter();
+    return `${adj}-${noun}-${suffix}`;
+}
+function isValidNipHostnameToken(token) {
+    return (typeof token === 'string' &&
+        token.length > 0 &&
+        token.length <= TOKEN_MAX_LENGTH &&
+        TOKEN_REGEX.test(token) &&
+        !token.startsWith('-') &&
+        !token.endsWith('-') &&
+        !/\d$/.test(token));
+}

package/lib/src/modules/frameworks/framework-core/enums/build-stage.enum.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Docker build stages
+ */
+export declare enum BuildStage {
+    DEPENDENCIES = "dependencies",
+    BUILD = "build",
+    RUNTIME = "runtime",
+    CUSTOM = "custom"
+}
+/**
+ * Build mode for frameworks that support multiple output modes
+ */
+export declare enum BuildMode {
+    SSR = "ssr",
+    STATIC = "static",
+    STANDALONE = "standalone",
+    SPA = "spa",
+    SSR_ANGULAR = "ssr-angular",
+    PRODUCTION = "production",
+    DEVELOPMENT = "development"
+}