@flui-cloud/cli 0.0.1

package/lib/cli/src/commands/backup/destination/create.d.ts

@@ -0,0 +1,22 @@
+import { Command } from '@oclif/core';
+export default class BackupDestinationCreate extends Command {
+    static readonly description = "Create a backup destination (S3-compatible storage target for Velero)";
+    static readonly examples: string[];
+    static readonly flags: {
+        name: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        provider: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        endpoint: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        region: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        bucket: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'access-key': import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'secret-key': import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        prefix: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'encryption-mode': import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'encryption-passphrase': import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'force-path-style': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'use-sse': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'usable-for-etcd-l1': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'cost-per-gb-month-cents': import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}

package/lib/cli/src/commands/backup/destination/create.js

@@ -0,0 +1,102 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const chalk_1 = __importDefault(require("chalk"));
+const ora_1 = __importDefault(require("ora"));
+const backup_client_1 = require("../../../lib/backup-client");
+const context_banner_1 = require("../../../lib/context-banner");
+const PROVIDERS = [
+    'hetzner_object_storage',
+    'scaleway_object_storage',
+    'minio',
+    'generic_s3',
+];
+const ENCRYPTION_MODES = ['flui_managed', 'byo_passphrase', 'none'];
+class BackupDestinationCreate extends core_1.Command {
+    async run() {
+        const { flags } = await this.parse(BackupDestinationCreate);
+        (0, context_banner_1.printContextBanner)();
+        const client = backup_client_1.BackupClient.fromConfig();
+        const spinner = (0, ora_1.default)('Creating backup destination...').start();
+        try {
+            const dest = await client.createDestination({
+                name: flags.name,
+                provider: flags.provider,
+                endpoint: flags.endpoint,
+                region: flags.region,
+                bucket: flags.bucket,
+                pathPrefix: flags.prefix,
+                accessKey: flags['access-key'],
+                secretKey: flags['secret-key'],
+                encryptionMode: flags['encryption-mode'],
+                encryptionPassphrase: flags['encryption-passphrase'],
+                forcePathStyle: flags['force-path-style'],
+                useSse: flags['use-sse'],
+                usableForEtcdL1: flags['usable-for-etcd-l1'],
+                costPerGbMonthCents: flags['cost-per-gb-month-cents'],
+            });
+            spinner.succeed(`Created destination ${chalk_1.default.cyan(dest.id)}`);
+            this.log('');
+            this.log(`   ${chalk_1.default.bold('Name:')}     ${dest.name}`);
+            this.log(`   ${chalk_1.default.bold('Provider:')} ${dest.provider}`);
+            this.log(`   ${chalk_1.default.bold('Bucket:')}   ${dest.bucket}`);
+            this.log('');
+            this.log(chalk_1.default.dim(`   Test with: flui backup destination test ${dest.id}\n`));
+        }
+        catch (err) {
+            spinner.fail(`Create failed: ${err.message}`);
+            this.exit(1);
+        }
+    }
+}
+BackupDestinationCreate.description = 'Create a backup destination (S3-compatible storage target for Velero)';
+BackupDestinationCreate.examples = [
+    '<%= config.bin %> <%= command.id %> --name my-s3 --provider hetzner_object_storage --endpoint https://fsn1.your-objectstorage.com --region fsn1 --bucket flui-backups --access-key AK --secret-key SK',
+    '<%= config.bin %> <%= command.id %> --name scw --provider scaleway_object_storage --endpoint https://s3.fr-par.scw.cloud --region fr-par --bucket flui-bkp --access-key AK --secret-key SK',
+];
+BackupDestinationCreate.flags = {
+    name: core_1.Flags.string({
+        required: true,
+        description: 'Display name (≤120 chars)',
+    }),
+    provider: core_1.Flags.string({
+        required: true,
+        options: [...PROVIDERS],
+        description: 'Storage backend provider',
+    }),
+    endpoint: core_1.Flags.string({
+        required: true,
+        description: 'S3 endpoint URL (e.g. https://s3.fr-par.scw.cloud)',
+    }),
+    region: core_1.Flags.string({ required: true }),
+    bucket: core_1.Flags.string({ required: true }),
+    'access-key': core_1.Flags.string({ required: true }),
+    'secret-key': core_1.Flags.string({ required: true }),
+    prefix: core_1.Flags.string({
+        description: 'Optional path prefix inside the bucket',
+    }),
+    'encryption-mode': core_1.Flags.string({
+        options: [...ENCRYPTION_MODES],
+        description: 'Encryption mode (default: flui_managed)',
+    }),
+    'encryption-passphrase': core_1.Flags.string({
+        description: 'Required when --encryption-mode=byo_passphrase',
+    }),
+    'force-path-style': core_1.Flags.boolean({
+        description: 'Force path-style S3 URLs (needed for MinIO/some providers)',
+    }),
+    'use-sse': core_1.Flags.boolean({
+        description: 'Use server-side encryption (SSE-S3) at the provider',
+    }),
+    'usable-for-etcd-l1': core_1.Flags.boolean({
+        description: 'Allow this destination to receive L1 etcd snapshots',
+    }),
+    'cost-per-gb-month-cents': core_1.Flags.integer({
+        description: 'Provider cost in cents/GB·month (used for billing estimate)',
+        min: 0,
+    }),
+};
+exports.default = BackupDestinationCreate;

package/lib/cli/src/commands/backup/destination/delete.d.ts

@@ -0,0 +1,11 @@
+import { Command } from '@oclif/core';
+export default class BackupDestinationDelete extends Command {
+    static readonly description = "Delete a backup destination";
+    static readonly args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static readonly flags: {
+        yes: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/lib/cli/src/commands/backup/destination/delete.js

@@ -0,0 +1,46 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const chalk_1 = __importDefault(require("chalk"));
+const ora_1 = __importDefault(require("ora"));
+const backup_client_1 = require("../../../lib/backup-client");
+const prompts_1 = require("../../../lib/prompts");
+const context_banner_1 = require("../../../lib/context-banner");
+class BackupDestinationDelete extends core_1.Command {
+    async run() {
+        const { args, flags } = await this.parse(BackupDestinationDelete);
+        (0, context_banner_1.printContextBanner)();
+        const client = backup_client_1.BackupClient.fromConfig();
+        if (!flags.yes) {
+            const ok = await (0, prompts_1.confirmPrompt)(chalk_1.default.yellow(`Delete destination ${args.id}? Existing artifacts at the bucket are NOT removed.`), false);
+            if (!ok) {
+                this.log(chalk_1.default.green('Cancelled'));
+                return;
+            }
+        }
+        const spinner = (0, ora_1.default)('Deleting destination...').start();
+        try {
+            await client.deleteDestination(args.id);
+            spinner.succeed(`Deleted ${args.id}`);
+        }
+        catch (err) {
+            spinner.fail(`Delete failed: ${err.message}`);
+            this.exit(1);
+        }
+    }
+}
+BackupDestinationDelete.description = 'Delete a backup destination';
+BackupDestinationDelete.args = {
+    id: core_1.Args.string({ required: true, description: 'Destination ID' }),
+};
+BackupDestinationDelete.flags = {
+    yes: core_1.Flags.boolean({
+        char: 'y',
+        description: 'Skip confirmation',
+        default: false,
+    }),
+};
+exports.default = BackupDestinationDelete;

package/lib/cli/src/commands/backup/destination/list.d.ts

@@ -0,0 +1,9 @@
+import { Command } from '@oclif/core';
+export default class BackupDestinationList extends Command {
+    static readonly description = "List backup destinations configured in the API";
+    static readonly examples: string[];
+    static readonly flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/lib/cli/src/commands/backup/destination/list.js

@@ -0,0 +1,42 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const chalk_1 = __importDefault(require("chalk"));
+const backup_client_1 = require("../../../lib/backup-client");
+const context_banner_1 = require("../../../lib/context-banner");
+class BackupDestinationList extends core_1.Command {
+    async run() {
+        const { flags } = await this.parse(BackupDestinationList);
+        (0, context_banner_1.printContextBanner)();
+        const client = backup_client_1.BackupClient.fromConfig();
+        const items = await client.listDestinations();
+        if (flags.json) {
+            this.log(JSON.stringify(items, null, 2));
+            return;
+        }
+        if (items.length === 0) {
+            this.log(chalk_1.default.yellow('\n   No backup destinations configured.\n'));
+            this.log(chalk_1.default.dim('   Create one with: flui backup destination create --help\n'));
+            return;
+        }
+        this.log('');
+        for (const d of items) {
+            const usage = d.usageBytes
+                ? ` · ${(d.usageBytes / 1024 ** 3).toFixed(2)} GB`
+                : '';
+            const health = d.health ? chalk_1.default.dim(` [${d.health}]`) : '';
+            this.log(`   ${chalk_1.default.cyan(d.id)}  ${chalk_1.default.bold(d.name)}  ${d.provider}  ` +
+                `${d.region}/${d.bucket}${usage}${health}`);
+        }
+        this.log('');
+    }
+}
+BackupDestinationList.description = 'List backup destinations configured in the API';
+BackupDestinationList.examples = ['<%= config.bin %> <%= command.id %>'];
+BackupDestinationList.flags = {
+    json: core_1.Flags.boolean({ description: 'Output as JSON', default: false }),
+};
+exports.default = BackupDestinationList;

package/lib/cli/src/commands/backup/destination/show.d.ts

@@ -0,0 +1,11 @@
+import { Command } from '@oclif/core';
+export default class BackupDestinationShow extends Command {
+    static readonly description = "Show a backup destination by ID";
+    static readonly args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static readonly flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/lib/cli/src/commands/backup/destination/show.js

@@ -0,0 +1,45 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const chalk_1 = __importDefault(require("chalk"));
+const backup_client_1 = require("../../../lib/backup-client");
+const context_banner_1 = require("../../../lib/context-banner");
+class BackupDestinationShow extends core_1.Command {
+    async run() {
+        const { args, flags } = await this.parse(BackupDestinationShow);
+        (0, context_banner_1.printContextBanner)();
+        const client = backup_client_1.BackupClient.fromConfig();
+        const d = await client.getDestination(args.id);
+        if (flags.json) {
+            this.log(JSON.stringify(d, null, 2));
+            return;
+        }
+        this.log('');
+        this.log(`   ${chalk_1.default.bold('ID:')}         ${d.id}`);
+        this.log(`   ${chalk_1.default.bold('Name:')}       ${d.name}`);
+        this.log(`   ${chalk_1.default.bold('Provider:')}   ${d.provider}`);
+        this.log(`   ${chalk_1.default.bold('Endpoint:')}   ${d.endpoint}`);
+        this.log(`   ${chalk_1.default.bold('Region:')}     ${d.region}`);
+        this.log(`   ${chalk_1.default.bold('Bucket:')}     ${d.bucket}`);
+        if (d.pathPrefix)
+            this.log(`   ${chalk_1.default.bold('Prefix:')}     ${d.pathPrefix}`);
+        if (d.encryptionMode)
+            this.log(`   ${chalk_1.default.bold('Encryption:')} ${d.encryptionMode}`);
+        if (d.health)
+            this.log(`   ${chalk_1.default.bold('Health:')}     ${d.health}`);
+        if (typeof d.usageBytes === 'number')
+            this.log(`   ${chalk_1.default.bold('Usage:')}      ${(d.usageBytes / 1024 ** 3).toFixed(2)} GB`);
+        this.log('');
+    }
+}
+BackupDestinationShow.description = 'Show a backup destination by ID';
+BackupDestinationShow.args = {
+    id: core_1.Args.string({ required: true, description: 'Destination ID (UUID)' }),
+};
+BackupDestinationShow.flags = {
+    json: core_1.Flags.boolean({ description: 'Output as JSON', default: false }),
+};
+exports.default = BackupDestinationShow;

package/lib/cli/src/commands/backup/destination/test.d.ts

@@ -0,0 +1,8 @@
+import { Command } from '@oclif/core';
+export default class BackupDestinationTest extends Command {
+    static readonly description = "Test connectivity to a backup destination (S3 PUT/GET/DELETE round-trip)";
+    static readonly args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    run(): Promise<void>;
+}

package/lib/cli/src/commands/backup/destination/test.js

@@ -0,0 +1,39 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const chalk_1 = __importDefault(require("chalk"));
+const ora_1 = __importDefault(require("ora"));
+const backup_client_1 = require("../../../lib/backup-client");
+const context_banner_1 = require("../../../lib/context-banner");
+class BackupDestinationTest extends core_1.Command {
+    async run() {
+        const { args } = await this.parse(BackupDestinationTest);
+        (0, context_banner_1.printContextBanner)();
+        const client = backup_client_1.BackupClient.fromConfig();
+        const spinner = (0, ora_1.default)(`Testing destination ${args.id}...`).start();
+        try {
+            const res = await client.testDestination(args.id);
+            if (res.healthy) {
+                spinner.succeed('Destination reachable');
+            }
+            else {
+                const suffix = res.error ? ` — ${res.error}` : '';
+                spinner.fail(`Test failed${suffix}`);
+                this.exit(1);
+            }
+        }
+        catch (err) {
+            spinner.fail(`Test failed: ${err.message}`);
+            this.exit(1);
+        }
+        void chalk_1.default;
+    }
+}
+BackupDestinationTest.description = 'Test connectivity to a backup destination (S3 PUT/GET/DELETE round-trip)';
+BackupDestinationTest.args = {
+    id: core_1.Args.string({ required: true, description: 'Destination ID' }),
+};
+exports.default = BackupDestinationTest;

package/lib/cli/src/commands/backup/job/list.d.ts

@@ -0,0 +1,9 @@
+import { Command } from '@oclif/core';
+export default class BackupJobList extends Command {
+    static readonly description = "List backup jobs for a cluster";
+    static readonly flags: {
+        cluster: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/lib/cli/src/commands/backup/job/list.js

@@ -0,0 +1,38 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const chalk_1 = __importDefault(require("chalk"));
+const backup_client_1 = require("../../../lib/backup-client");
+const context_banner_1 = require("../../../lib/context-banner");
+class BackupJobList extends core_1.Command {
+    async run() {
+        const { flags } = await this.parse(BackupJobList);
+        (0, context_banner_1.printContextBanner)();
+        const client = backup_client_1.BackupClient.fromConfig();
+        const items = await client.listJobsForCluster(flags.cluster);
+        if (flags.json) {
+            this.log(JSON.stringify(items, null, 2));
+            return;
+        }
+        if (items.length === 0) {
+            this.log(chalk_1.default.yellow('\n   No jobs.\n'));
+            return;
+        }
+        this.log('');
+        for (const j of items) {
+            this.log(`   ${chalk_1.default.cyan(j.id)}  ${j.status}  policy=${j.policyId}` +
+                (j.startedAt ? ` started=${j.startedAt}` : '') +
+                (j.completedAt ? ` done=${j.completedAt}` : ''));
+        }
+        this.log('');
+    }
+}
+BackupJobList.description = 'List backup jobs for a cluster';
+BackupJobList.flags = {
+    cluster: core_1.Flags.string({ required: true, description: 'Cluster ID' }),
+    json: core_1.Flags.boolean({ default: false }),
+};
+exports.default = BackupJobList;

package/lib/cli/src/commands/backup/job/run.d.ts

@@ -0,0 +1,8 @@
+import { Command } from '@oclif/core';
+export default class BackupJobRun extends Command {
+    static readonly description = "Trigger an on-demand backup job for a given policy";
+    static readonly flags: {
+        policy: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}

package/lib/cli/src/commands/backup/job/run.js

@@ -0,0 +1,32 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const chalk_1 = __importDefault(require("chalk"));
+const ora_1 = __importDefault(require("ora"));
+const backup_client_1 = require("../../../lib/backup-client");
+const context_banner_1 = require("../../../lib/context-banner");
+class BackupJobRun extends core_1.Command {
+    async run() {
+        const { flags } = await this.parse(BackupJobRun);
+        (0, context_banner_1.printContextBanner)();
+        const client = backup_client_1.BackupClient.fromConfig();
+        const spinner = (0, ora_1.default)('Queuing backup job...').start();
+        try {
+            const job = await client.runJobForPolicy(flags.policy);
+            spinner.succeed(`Queued job ${chalk_1.default.cyan(job.id)} (status=${job.status})`);
+            this.log(chalk_1.default.dim(`   Track with: flui backup job show ${job.id}`));
+        }
+        catch (err) {
+            spinner.fail(`Run failed: ${err.message}`);
+            this.exit(1);
+        }
+    }
+}
+BackupJobRun.description = 'Trigger an on-demand backup job for a given policy';
+BackupJobRun.flags = {
+    policy: core_1.Flags.string({ required: true, description: 'Policy ID' }),
+};
+exports.default = BackupJobRun;

package/lib/cli/src/commands/backup/job/show.d.ts

@@ -0,0 +1,11 @@
+import { Command } from '@oclif/core';
+export default class BackupJobShow extends Command {
+    static readonly description = "Show a backup job by ID";
+    static readonly args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static readonly flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/lib/cli/src/commands/backup/job/show.js

@@ -0,0 +1,38 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const chalk_1 = __importDefault(require("chalk"));
+const backup_client_1 = require("../../../lib/backup-client");
+const context_banner_1 = require("../../../lib/context-banner");
+class BackupJobShow extends core_1.Command {
+    async run() {
+        const { args, flags } = await this.parse(BackupJobShow);
+        (0, context_banner_1.printContextBanner)();
+        const client = backup_client_1.BackupClient.fromConfig();
+        const j = await client.getJob(args.id);
+        if (flags.json) {
+            this.log(JSON.stringify(j, null, 2));
+            return;
+        }
+        this.log('');
+        this.log(`   ${chalk_1.default.bold('ID:')}        ${j.id}`);
+        this.log(`   ${chalk_1.default.bold('Policy:')}    ${j.policyId}`);
+        this.log(`   ${chalk_1.default.bold('Status:')}    ${j.status}`);
+        if (j.startedAt)
+            this.log(`   ${chalk_1.default.bold('Started:')}   ${j.startedAt}`);
+        if (j.completedAt)
+            this.log(`   ${chalk_1.default.bold('Completed:')} ${j.completedAt}`);
+        if (j.bytesTransferred)
+            this.log(`   ${chalk_1.default.bold('Bytes:')}     ${(j.bytesTransferred / 1024 ** 2).toFixed(2)} MB`);
+        if (j.errorMessage)
+            this.log(chalk_1.default.red(`   ${chalk_1.default.bold('Error:')}     ${j.errorMessage}`));
+        this.log('');
+    }
+}
+BackupJobShow.description = 'Show a backup job by ID';
+BackupJobShow.args = { id: core_1.Args.string({ required: true }) };
+BackupJobShow.flags = { json: core_1.Flags.boolean({ default: false }) };
+exports.default = BackupJobShow;

package/lib/cli/src/commands/backup/policy/create.d.ts

@@ -0,0 +1,21 @@
+import { Command } from '@oclif/core';
+export default class BackupPolicyCreate extends Command {
+    static readonly description = "Create a backup policy";
+    static readonly examples: string[];
+    static readonly flags: {
+        name: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        cluster: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        scope: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'scope-namespaces': import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'scope-apps': import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        profile: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        schedule: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'retention-days': import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'retention-max-copies': import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'include-pvcs': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'include-etcd-l1': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        enabled: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        destination: import("@oclif/core/lib/interfaces").OptionFlag<string[], import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}

package/lib/cli/src/commands/backup/policy/create.js

@@ -0,0 +1,97 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const chalk_1 = __importDefault(require("chalk"));
+const ora_1 = __importDefault(require("ora"));
+const backup_client_1 = require("../../../lib/backup-client");
+const context_banner_1 = require("../../../lib/context-banner");
+const SCOPES = [
+    'cluster_all',
+    'namespaces',
+    'applications',
+    'label_selector',
+];
+const PROFILES = ['single', 'mirrored', 'custom'];
+class BackupPolicyCreate extends core_1.Command {
+    async run() {
+        const { flags } = await this.parse(BackupPolicyCreate);
+        (0, context_banner_1.printContextBanner)();
+        const destinations = flags.destination.map((spec) => {
+            const [id, role = 'primary', prio] = spec.split(':');
+            return {
+                destinationId: id,
+                role: role,
+                ...(prio ? { priority: Number.parseInt(prio, 10) } : {}),
+            };
+        });
+        let scopeSelector;
+        if (flags['scope-namespaces']) {
+            scopeSelector = {
+                namespaces: flags['scope-namespaces'].split(',').map((s) => s.trim()),
+            };
+        }
+        else if (flags['scope-apps']) {
+            scopeSelector = {
+                applicationIds: flags['scope-apps'].split(',').map((s) => s.trim()),
+            };
+        }
+        const client = backup_client_1.BackupClient.fromConfig();
+        const spinner = (0, ora_1.default)('Creating policy...').start();
+        try {
+            const p = await client.createPolicy({
+                name: flags.name,
+                clusterId: flags.cluster,
+                scope: flags.scope,
+                profile: flags.profile,
+                schedule: flags.schedule,
+                retentionDays: flags['retention-days'],
+                retentionMaxCopies: flags['retention-max-copies'],
+                enabled: flags.enabled,
+                destinations,
+                scopeSelector,
+            });
+            spinner.succeed(`Created policy ${chalk_1.default.cyan(p.id)}`);
+        }
+        catch (err) {
+            spinner.fail(`Create failed: ${err.message}`);
+            this.exit(1);
+        }
+    }
+}
+BackupPolicyCreate.description = 'Create a backup policy';
+BackupPolicyCreate.examples = [
+    '<%= config.bin %> <%= command.id %> --name daily-all --cluster <id> --scope cluster_all --schedule "0 2 * * *" --retention-days 14 --destination <destId>',
+    '<%= config.bin %> <%= command.id %> --name app-snap --cluster <id> --scope applications --scope-namespaces ns1,ns2 --destination <destId>',
+];
+BackupPolicyCreate.flags = {
+    name: core_1.Flags.string({ required: true }),
+    cluster: core_1.Flags.string({ required: true, description: 'Cluster ID' }),
+    scope: core_1.Flags.string({ required: true, options: [...SCOPES] }),
+    'scope-namespaces': core_1.Flags.string({
+        description: 'Comma-separated namespaces (for scope=namespaces)',
+    }),
+    'scope-apps': core_1.Flags.string({
+        description: 'Comma-separated application IDs (for scope=applications)',
+    }),
+    profile: core_1.Flags.string({
+        options: [...PROFILES],
+        default: 'single',
+    }),
+    schedule: core_1.Flags.string({
+        description: 'Cron schedule (e.g. "0 2 * * *" for daily 02:00 UTC)',
+    }),
+    'retention-days': core_1.Flags.integer({ min: 1, default: 30 }),
+    'retention-max-copies': core_1.Flags.integer({ min: 1 }),
+    'include-pvcs': core_1.Flags.boolean(),
+    'include-etcd-l1': core_1.Flags.boolean(),
+    enabled: core_1.Flags.boolean({ default: true, allowNo: true }),
+    destination: core_1.Flags.string({
+        required: true,
+        multiple: true,
+        description: 'Destination spec: <destId>[:primary|replica[:priority]] (repeatable)',
+    }),
+};
+exports.default = BackupPolicyCreate;

package/lib/cli/src/commands/backup/policy/delete.d.ts

@@ -0,0 +1,11 @@
+import { Command } from '@oclif/core';
+export default class BackupPolicyDelete extends Command {
+    static readonly description = "Delete a backup policy (existing artifacts are retained)";
+    static readonly args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static readonly flags: {
+        yes: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}