devlift-cli 0.1.0__py3-none-any.whl

devlift_cli/commands/dynamodb.py

@@ -0,0 +1,121 @@
+"""devlift dynamodb …"""
+
+from __future__ import annotations
+
+import re
+
+import typer
+
+from devlift_cli.commands.manual import section_command
+from devlift_cli.api.infra_list import display_name
+from devlift_cli.context import Invocation
+from devlift_cli.errors import InputError
+from devlift_cli.ops.resources import ResourceKind, create_resource, describe_resource, list_resources
+from devlift_cli.render.output import kv_table, rows_table
+from devlift_cli.resolve import allowlist
+from devlift_cli.resolve.names import Resolver
+
+dynamodb_app = typer.Typer(help="DynamoDB tables.", no_args_is_help=True)
+
+_TABLE_RE = re.compile(r"^[a-zA-Z0-9._-]+$")
+_ATTRIBUTE_RE = re.compile(r"^[a-zA-Z0-9._-]{1,255}$")
+_KEY_TYPES = ("S", "N", "B")
+
+
+def validate_table_name(raw: str) -> str | None:
+    name = raw.strip()
+    if not name:
+        return "required."
+    if len(name) < 3:
+        return f"must be at least 3 characters (currently {len(name)})."
+    if len(name) > 200:
+        return f"must be 200 characters or fewer (currently {len(name)})."
+    if not _TABLE_RE.match(name):
+        return "use only letters, numbers, dots (.), underscores (_) and hyphens (-)."
+    return None
+
+
+DYNAMODB = ResourceKind(
+    noun="table",
+    infra_type="dynamodb_infrastructuretype_ref",
+    case_ref_code="table_management",
+    service=allowlist.SERVICE_DYNAMODB,
+    validate_name=validate_table_name,
+    labels={"partition_key": "Partition key", "partition_key_type": "Partition key type"},
+)
+
+
+@dynamodb_app.command("list")
+def dynamodb_list(
+    ctx: typer.Context,
+    app: str | None = typer.Option(None, "--app", "--product", help="Only this application."),
+    env: str | None = typer.Option(None, "--env", help="Only this environment."),
+    region: str | None = typer.Option(None, "--region", help="Only this region."),
+):
+    """List DynamoDB tables registered in DevLift."""
+    inv: Invocation = ctx.obj
+    rows = list_resources(inv, Resolver(inv.api, inv.profile.name), DYNAMODB, app=app, env=env, region=region)
+    inv.emit(rows, lambda d: rows_table(
+        ["Table", "Environment", "Region", "Partition key", "Status", "Code"],
+        [(display_name(r), r.get("environment"), r.get("geo_loc_mst_code"), f"{(r.get('locator') or {}).get('partition_key') or ''} ({(r.get('locator') or {}).get('partition_key_type') or ''})", r.get("status"), r.get("code")) for r in d],
+    ))
+
+
+@dynamodb_app.command("describe")
+def dynamodb_describe(ctx: typer.Context, name: str = typer.Argument(..., help="Table name or resource code."), env: str | None = typer.Option(None, "--env")):
+    """Show one table."""
+    inv: Invocation = ctx.obj
+    detail = describe_resource(inv, Resolver(inv.api, inv.profile.name), DYNAMODB, name, env=env)
+    loc = detail.get("locator") or {}
+    inv.emit(detail, lambda d: kv_table([
+        ("Table", display_name(d)),
+        ("Full name", loc.get("table_name") or loc.get("name")),
+        ("ARN", loc.get("table_arn")),
+        ("Code", d.get("code")),
+        ("Environment", d.get("environment")),
+        ("Region", f"{loc.get('region') or ''} ({d.get('geo_loc_mst_code')})"),
+        ("Partition key", f"{loc.get('partition_key') or ''} ({loc.get('partition_key_type') or ''})"),
+        ("Status", d.get("infra_status")),
+    ], title=display_name(d)))
+
+
+@dynamodb_app.command("create")
+def dynamodb_create(
+    ctx: typer.Context,
+    name: str | None = typer.Option(None, "--name", help="Table name."),
+    app: str | None = typer.Option(None, "--app", "--product", help="Application name or code."),
+    env: str | None = typer.Option(None, "--env", help="dev | stage | qa | prod"),
+    region: str | None = typer.Option(None, "--region", help="Region name or code."),
+    partition_key: str | None = typer.Option(None, "--partition-key", help="Partition (hash) key attribute name."),
+    partition_key_type: str | None = typer.Option(None, "--partition-key-type", help="S (string) | N (number) | B (binary). Default S."),
+    do_wait: bool = typer.Option(False, "--wait", help="Follow the deployment until it finishes."),
+):
+    """Create a DynamoDB table. Any flag you omit is asked for on a terminal.
+
+    Example: devlift dynamodb create --name orders --app core --env stage --region mumbai --partition-key order_id -y
+    """
+    inv: Invocation = ctx.obj
+    res = Resolver(inv.api, inv.profile.name)
+    if name is None:
+        name = inv.ask("Table name", flag="--name")
+    if partition_key is None:
+        partition_key = inv.ask("Partition key attribute", flag="--partition-key")
+    if not _ATTRIBUTE_RE.match(partition_key.strip()):
+        raise InputError("--partition-key: 1-255 characters, letters, numbers, dots, underscores and hyphens.")
+    key_type = (partition_key_type or "S").strip().upper()
+    if key_type not in _KEY_TYPES:
+        raise InputError(f"--partition-key-type must be one of {', '.join(_KEY_TYPES)}.")
+    attributes = {"partition_key": partition_key.strip(), "partition_key_type": key_type}
+    result = create_resource(inv, res, DYNAMODB, name=name, app=app, env=env, region=region, attributes=attributes, do_wait=do_wait)
+    data = {"table": name, **result.to_dict()}
+    inv.emit(data, lambda d: kv_table([
+        ("Table", d["table"]),
+        ("Resource code", d["resource_code"]),
+        ("Queue item", d["queue_code"]),
+        ("Status", d.get("status")),
+        ("Workflow", d.get("workflow_id")),
+        ("Pull request", d.get("pr_url")),
+    ]))
+
+
+dynamodb_app.command("manual")(section_command("dynamodb"))

devlift_cli/commands/eks.py

@@ -0,0 +1,326 @@
+"""devlift eks …"""
+
+from __future__ import annotations
+
+import typer
+
+from devlift_cli.commands.manual import section_command
+from devlift_cli.context import Invocation
+from devlift_cli.ops.eks import create_eks_service, describe_settings, parse_set
+from devlift_cli.render.output import kv_table, rows_table
+from devlift_cli.resolve.names import Resolver
+
+eks_app = typer.Typer(help="EKS services.", no_args_is_help=True)
+
+
+@eks_app.command("create")
+def eks_create(
+    ctx: typer.Context,
+    name: str | None = typer.Option(None, "--name", help="Service name."),
+    app: str | None = typer.Option(None, "--app", "--product", help="Application name or code."),
+    env: str | None = typer.Option(None, "--env", help="dev | stage | qa | prod"),
+    region: str | None = typer.Option(None, "--region", help="Region name or code."),
+    resource_group: str | None = typer.Option(None, "--resource-group", help="Resource group name or code (asked when the application has several)."),
+    service_type: str | None = typer.Option(None, "--type", help="api (behind the shared ALB) | worker (no load balancer)."),
+    repository: str | None = typer.Option(None, "--repository", "--repo", help="Git repository, owner/name (see `devlift repositories list`)."),
+    branches: list[str] = typer.Option([], "--branch", help="Branch that triggers a build (repeatable; see `devlift repositories branches`). Required."),
+    language: str | None = typer.Option(None, "--language", help="Language name (see `devlift languages list`)."),
+    version: str | None = typer.Option(None, "--version", help="Language version, e.g. 1.24 or 3.12 (see `devlift languages list`)."),
+    cluster: str | None = typer.Option(None, "--cluster", help="EKS cluster name or code (asked when several are available)."),
+    sets: list[str] = typer.Option([], "--set", help="Override a setting: --set port=9000 (repeatable). `devlift eks settings` lists the keys."),
+    public: bool = typer.Option(False, "--public", help="Mark the service as publicly reachable."),
+):
+    """Create an EKS service and save its configuration as a draft for review.
+
+    Registers the service, creates its configuration row for the chosen
+    environment and region, and parks the settings as a DRAFT queue item —
+    the same three steps as the dashboard's "Create & Add" plus Settings Save.
+    Nothing is deployed until the draft is submitted, approved and deployed.
+
+    You supply what no template can know: repository, branches, language and
+    version. Every other setting starts from the platform's template for that
+    language and is shown before you confirm; --set changes any of them.
+
+    Example: devlift eks create --name orders --app core --env stage --region mumbai
+             --type api --repo example-org/orders --branch main --language Go --version 1.24 -y
+    """
+    inv: Invocation = ctx.obj
+    res = Resolver(inv.api, inv.profile.name)
+    result = create_eks_service(
+        inv, res,
+        name=name, app=app, env=env, region=region, resource_group=resource_group, service_type=service_type,
+        repository=repository, branches=[b for b in branches if b.strip()], language=language, version=version,
+        cluster=cluster, overrides=parse_set(sets), public=public,
+    )
+    inv.emit(result.to_dict(), lambda d: kv_table([
+        ("Service", d["service"]),
+        ("Service code", d["service_code"]),
+        ("Configuration", d["service_config_code"]),
+        ("Environment", f"{d['environment']} / {d['region']}"),
+        ("Cluster", d["cluster"]),
+        ("Queue item", d.get("queue_code")),
+        ("Status", d.get("queue_status")),
+    ], title="Draft saved"))
+
+
+@eks_app.command("edit")
+def eks_edit(
+    ctx: typer.Context,
+    service: str = typer.Argument(..., help="Service name or code."),
+    env: str | None = typer.Option(None, "--env", help="Environment (asked when the service is configured in several)."),
+    region: str | None = typer.Option(None, "--region", help="Region, when the service runs in several."),
+    sets: list[str] = typer.Option([], "--set", help="Change a setting: --set cpu_limit=1 (repeatable). `devlift eks settings <service>` lists the keys and current values."),
+    repository: str | None = typer.Option(None, "--repository", "--repo", help="Change the repository (owner/name)."),
+    branches: list[str] = typer.Option([], "--branch", help="Replace the build branches (repeatable)."),
+    language: str | None = typer.Option(None, "--language", help="Change the language."),
+    version: str | None = typer.Option(None, "--version", help="Change the language version."),
+):
+    """Change an existing service's settings and save them as a draft for review.
+
+    Starts from the configuration as it stands — live values with your open
+    draft, if any, laid over them — applies your changes, shows Current / New,
+    and saves the whole result as a settings draft. An open draft of yours is
+    updated in place. A request under review blocks editing until it is
+    deployed, withdrawn or revoked.
+
+    Example: devlift eks edit orders --env stage --set cpu_limit=1 --set memory_limit=2 -y
+    """
+    from devlift_cli.ops.eks import edit_eks_service
+
+    inv: Invocation = ctx.obj
+    overrides = parse_set(sets)
+    if not overrides and not repository and not branches and not language and not version:
+        from devlift_cli.errors import InputError
+        raise InputError("Nothing to change.", hint="Pass --set key=value, --repository, --branch, --language or --version.")
+    result = edit_eks_service(inv, Resolver(inv.api, inv.profile.name), service, env=env, region=region, overrides=overrides,
+                              repository=repository, branches=[b for b in branches if b.strip()], language=language, version=version)
+    inv.emit(result.to_dict(), lambda d: kv_table([
+        ("Service", f"{d['service']} ({d['environment']})"),
+        ("Changed", "yes" if d["changed"] else "no"),
+        ("Queue item", d.get("queue_code")),
+        ("Status", d.get("queue_status")),
+    ]))
+
+
+@eks_app.command("show")
+def eks_show(
+    ctx: typer.Context,
+    service: str = typer.Argument(..., help="Service name or code."),
+    env: str | None = typer.Option(None, "--env", help="Environment (asked when the service is configured in several)."),
+    region: str | None = typer.Option(None, "--region", help="Region, when the service runs in several."),
+):
+    """Show a service's configuration as it stands, marking values pending in an open request."""
+    from devlift_cli.ops.eks import LABELS, load_effective, _show
+    from devlift_cli.render import output
+
+    inv: Invocation = ctx.obj
+    eff = load_effective(inv, Resolver(inv.api, inv.profile.name), service, env, region, for_edit=False)
+    live = eff.live
+    request = eff.draft
+    data = {
+        "service": eff.target.service_name, "service_config_code": eff.target.config_code,
+        "environment": live.get("environment"), "region": eff.target.region_name, "cluster": live.get("infrastructure_mst_code"),
+        "type": eff.service.get("service_type"), "repository": eff.config.get("repository"),
+        "branches": eff.config.get("branches") or eff.config.get("selected_branches"),
+        "language": f"{eff.language_label or ''} {eff.language_version or ''}".strip() or None,
+        "settings": eff.settings, "pending_request": {"code": request["code"], "status": request["status"]} if request else None,
+        "pending_keys": sorted(eff.pending_keys),
+    }
+
+    def table(d):
+        output.err_console.print(kv_table([
+            ("Service", d["service"]), ("Type", d["type"]), ("Environment", f"{d['environment']} / {d['region']}"),
+            ("Cluster", d["cluster"]), ("Repository", d["repository"] or "–"),
+            ("Branches", ", ".join(d["branches"] or []) or "–"), ("Language", d["language"] or "–"),
+            ("Pending request", f"{d['pending_request']['code']} ({d['pending_request']['status']})" if d["pending_request"] else "none"),
+        ], title=d["service"]))
+        pend = set(d["pending_keys"])
+        def mark(k):
+            hit = k in pend or (k in ("hpa_enabled", "min_replicas", "max_replicas") and "hpa" in pend)
+            return f"pending ({d['pending_request']['status']})" if hit and d["pending_request"] else ""
+        return rows_table(["Setting", "Value", ""], [(LABELS.get(k, k), _show(v), mark(k)) for k, v in d["settings"].items()], title="Configuration")
+    inv.emit(data, table)
+
+
+@eks_app.command("diff")
+def eks_diff(
+    ctx: typer.Context,
+    service: str = typer.Argument(..., help="Service name or code."),
+    env: str | None = typer.Option(None, "--env", help="Environment (asked when the service is configured in several)."),
+    region: str | None = typer.Option(None, "--region", help="Environment's region, when the service runs in several."),
+    deployed: bool = typer.Option(False, "--deployed", help="Instead: what the live configuration holds versus what was last deployed."),
+):
+    """Preview the pending change: what a request would alter, Deployed to Requested.
+
+    The same table the dashboard's Preview tab and the assistant show, built
+    from the request DevLift computed against the live configuration. With no
+    request pending, the service has nothing to preview, and `--deployed`
+    compares the live configuration against the last deployment instead.
+    """
+    from devlift_cli.api import approvals as approvals_api
+    from devlift_cli.api import services as services_api
+    from devlift_cli.ops.approvals import diff_rows, kind_of
+    from devlift_cli.ops.kong import resolve_target
+    from devlift_cli.render import output
+
+    inv: Invocation = ctx.obj
+    target = resolve_target(inv, Resolver(inv.api, inv.profile.name), service, env, region)
+    where = f"{target.service_name} ({target.environment} / {target.region_name})"
+
+    if deployed:
+        diff = services_api.settings_diff(inv.api, target.config_code)
+
+        def drift(d):
+            if not d.get("has_deployed_baseline"):
+                output.info("Never deployed, so everything below is pending its first deploy." if d.get("items")
+                            else "No settings have been saved for this configuration yet.")
+            return rows_table(["Setting", "Deployed", "Live"],
+                              [(i.get("label") or i.get("field"), i.get("deployed_value") or "–", i.get("current_value") or "–") for i in d.get("items", [])],
+                              title=where)
+        inv.emit(diff, drift)
+        return
+
+    open_rows = [r for r in approvals_api.list_requests(inv.api, resource_code=target.config_code)
+                 if r.get("status") in ("draft", "submit", "approved")]
+    if not open_rows:
+        output.info(f"Nothing pending on {where}.")
+        output.info("`devlift eks diff --deployed` compares the live configuration against the last deployment.")
+    full = [approvals_api.get_request(inv.api, r["code"]) for r in open_rows]
+    data = [{"code": r["code"], "kind": kind_of(r), "status": r["status"],
+             "requested_by": r.get("requested_by_name") or r.get("requested_by"),
+             "changes": [{"field": f, "deployed": a, "requested": b} for f, a, b in diff_rows(r)]} for r in full]
+
+    def table(d):
+        for row in d:
+            output.err_console.print(rows_table(
+                ["Field", "Deployed", "Requested"],
+                [(c["field"], c["deployed"], c["requested"]) for c in row["changes"]] or [("–", "–", "nothing yet")],
+                title=f"{where} · {row['kind']} · {row['status']} ({row['code']}, by {row['requested_by']})",
+            ))
+        return kv_table([])
+    inv.emit(data, table)
+
+
+@eks_app.command("deploy")
+def eks_deploy(
+    ctx: typer.Context,
+    service: str = typer.Argument(..., help="Service name or code."),
+    env: str | None = typer.Option(None, "--env", help="Environment (asked when the service is configured in several)."),
+    region: str | None = typer.Option(None, "--region", help="Region, when the service runs in several."),
+    confirm_name: str | None = typer.Option(None, "--confirm-name", help="Production only: the service name typed back."),
+    do_wait: bool = typer.Option(False, "--wait", help="Follow the deployment until it finishes."),
+):
+    """Deploy the approved change of a service (settings, routes and variables together).
+
+    One call, as the dashboard makes it: the backend resolves what is approved
+    on the configuration, checks it is still exactly what was approved, and
+    starts one deployment. Production asks for the service name typed back.
+    """
+    from devlift_cli.ops.approvals import deploy
+
+    inv: Invocation = ctx.obj
+    result = deploy(inv, Resolver(inv.api, inv.profile.name), service, env=env, region=region, confirm_name=confirm_name, do_wait=do_wait)
+    inv.emit(result.to_dict(), lambda d: kv_table([
+        ("Service", f"{d['service']} ({d['environment']})"),
+        ("Deployed requests", ", ".join(f"{r['code']} ({r['kind']})" for r in d["requests"])),
+        ("Workflow", d.get("workflow_id")),
+        ("Status", d.get("status")),
+    ], title="Deployment"))
+
+
+@eks_app.command("status")
+def eks_status(
+    ctx: typer.Context,
+    service: str = typer.Argument(..., help="Service name or code."),
+    env: str | None = typer.Option(None, "--env", help="Environment (asked when the service is configured in several)."),
+    region: str | None = typer.Option(None, "--region", help="Region, when the service runs in several."),
+    do_wait: bool = typer.Option(False, "--wait", help="Follow the deployment to its end, then ArgoCD until the app settles."),
+    no_argo: bool = typer.Option(False, "--no-argo", help="Deployment pipeline only; skip the ArgoCD check."),
+):
+    """Where a service stands: its latest deployment, and whether ArgoCD reports it running.
+
+    Two answers, because they differ: DevLift's pipeline is done when the
+    manifests are merged; ArgoCD then still has to roll the pods, and for new
+    code the image is built outside DevLift. The ArgoCD reading is compared
+    against the deploy's finish time so the previous revision's "Healthy" is
+    not reported as the new one.
+    """
+    from devlift_cli.ops.approvals import resolve_target
+    from devlift_cli.ops.status import application_status, deployment_detail, latest_deployment_for, print_application, print_deployment
+    from devlift_cli.render import output
+
+    inv: Invocation = ctx.obj
+    res = Resolver(inv.api, inv.profile.name)
+    target = resolve_target(inv, res, service, env, region)
+    application_code = res.service(service)["application_code"]
+    latest = latest_deployment_for(inv, application_code=application_code, environment=target.environment or "", config_code=target.config_code)
+    detail = deployment_detail(inv, latest["workflow_id"], do_wait=do_wait) if latest else None
+    argo = None if no_argo else application_status(inv, target.config_code, (latest or {}).get("workflow_id"), do_wait=do_wait)
+
+    data = {"service": target.service_name, "service_config_code": target.config_code, "environment": target.environment,
+            "deployment": detail, "application": argo}
+
+    def table(d):
+        if d["deployment"]:
+            print_deployment(d["deployment"])
+        else:
+            output.info(f"No deployment recorded yet for {d['service']} in {d['environment']}.")
+        if d["application"]:
+            print_application(d["application"])
+        return kv_table([])
+    inv.emit(data, table)
+
+
+@eks_app.command("settings")
+def eks_settings(
+    ctx: typer.Context,
+    service: str | None = typer.Argument(None, help="Narrow to one service: only the keys that apply to it, with its current values."),
+    env: str | None = typer.Option(None, "--env", help="Environment, when the service is configured in several."),
+    region: str | None = typer.Option(None, "--region", help="Region, when the service runs in several."),
+    language: str | None = typer.Option(None, "--language", help="Narrow to a language without naming a service (Go, Python, …)."),
+    service_type: str | None = typer.Option(None, "--type", help="Narrow to api or worker without naming a service."),
+):
+    """The keys `--set` accepts on `eks create` and `eks edit`.
+
+    With no arguments this is every key, with the rule for when each applies.
+    Name a service and it narrows to the keys that apply to that service,
+    each with the value it holds today, which is the list to work from when
+    editing it.
+    """
+    from devlift_cli.ops.eks import SERVICE_TYPES, _show, applies, load_effective
+
+    inv: Invocation = ctx.obj
+    rows = describe_settings()
+    current: dict = {}
+    shown = None
+
+    if service:
+        eff = load_effective(inv, Resolver(inv.api, inv.profile.name), service, env, region, for_edit=False)
+        language = language or eff.language_label
+        service_type = service_type or eff.service.get("service_type")
+        current = eff.settings
+        shown = f"{eff.target.service_name} ({eff.target.environment})"
+    if service_type:
+        service_type = SERVICE_TYPES.get(service_type.strip().lower(), service_type.strip().upper())
+
+    if language or service_type:
+        rows = [r for r in rows
+                if applies(r["key"], language=language or "", service_type=service_type or "API", settings=current)[0]]
+        for r in rows:
+            r["current"] = current.get(r["key"])
+        inv.emit(rows, lambda d: rows_table(
+            ["Key", "Setting", "Values", "Current", "Required"],
+            [(r["key"], r["label"], r["values"],
+              _show(r.get("current")) if r.get("current") is not None else "–",
+              "yes" if r["required"] else "") for r in d],
+            title=shown or " ".join(x for x in (language, service_type) if x),
+        ))
+        return
+
+    inv.emit(rows, lambda d: rows_table(
+        ["Key", "Setting", "Values", "Applies", "Required"],
+        [(r["key"], r["label"], r["values"], r["applies"], "yes" if r["required"] else "") for r in d],
+    ))
+
+
+eks_app.command("manual")(section_command("eks"))

devlift_cli/commands/kong.py

@@ -0,0 +1,145 @@
+"""devlift kong …"""
+
+from __future__ import annotations
+
+import typer
+
+from devlift_cli.commands.manual import section_command
+from devlift_cli.api import kong as kong_api
+from devlift_cli.context import Invocation
+from devlift_cli.errors import InputError
+from devlift_cli.ops.kong import (
+    AUTH, METHODS, RouteChange, apply_change, normalise_plugin, resolve_target, route_cards, routes_table,
+    validate_path, validate_tag,
+)
+from devlift_cli.render.output import kv_table
+from devlift_cli.resolve.names import Resolver
+
+kong_app = typer.Typer(help="Kong gateway routes of a service.", no_args_is_help=True)
+routes_app = typer.Typer(help="Read the gateway.", no_args_is_help=True)
+route_app = typer.Typer(help="Change one route group (add / remove / rename paths).", no_args_is_help=True)
+plugin_app = typer.Typer(help="Plugins on a route group.", no_args_is_help=True)
+kong_app.add_typer(routes_app, name="routes")
+kong_app.add_typer(route_app, name="route")
+kong_app.add_typer(plugin_app, name="plugin")
+
+_SERVICE = typer.Argument(..., help="Service name or code.")
+_ENV = typer.Option(None, "--env", help="dev | stage | qa | prod (asked when the service has several).")
+_REGION = typer.Option(None, "--region", help="Region name or code (only when the service runs in several).")
+_METHOD = typer.Option(..., "--method", help="GET | POST | PUT | PATCH | DELETE | OPTIONS")
+_TAG_REQ = typer.Option(..., "--tag", help="Route group (tag); see `devlift kong routes list`.")
+
+
+def _method(value: str) -> str:
+    m = value.strip().upper()
+    if m not in METHODS:
+        raise InputError(f"--method must be one of {', '.join(METHODS)}.")
+    return m
+
+
+def _emit(inv: Invocation, result) -> None:
+    inv.emit(result.to_dict(), lambda d: kv_table([
+        ("Service", d["service"]),
+        ("Configuration", d["service_config_code"]),
+        ("Route group", f"{d['change']['tag']} · {d['change']['method']}"),
+        ("Changed", "yes" if d["changed"] else "no"),
+        ("Queue item", d.get("queue_code")),
+        ("Status", d.get("queue_status")),
+    ]))
+
+
+@routes_app.command("list")
+def routes_list(ctx: typer.Context, service: str = _SERVICE, env: str | None = _ENV, region: str | None = _REGION):
+    """List a service's route groups: method, auth, tag, paths, pending edits."""
+    inv: Invocation = ctx.obj
+    target = resolve_target(inv, Resolver(inv.api, inv.profile.name), service, env, region)
+    cards = route_cards(kong_api.gateway_state(inv.api, target.config_code))
+    inv.emit(cards, lambda d: routes_table(d, f"{target.service_name} — {target.environment} / {target.region_name}"))
+
+
+@route_app.command("add")
+def route_add(
+    ctx: typer.Context,
+    service: str = _SERVICE,
+    env: str | None = _ENV,
+    region: str | None = _REGION,
+    method: str = _METHOD,
+    auth: str = typer.Option(..., "--auth", help="jwt (token required) | public"),
+    paths: list[str] = typer.Option(..., "--path", help="Kong regex path, e.g. '~/api/v1/orders$' (repeatable)."),
+    tag: str | None = typer.Option(None, "--tag", help="Route group to add to. Default: the service name (public: '<service>-open')."),
+    priority: int | None = typer.Option(None, "--priority", help="Regex priority 0-10000, only when two route regexes overlap."),
+    plugins: list[str] = typer.Option([], "--plugin", help="Extra plugin (repeatable). JWT comes from --auth."),
+):
+    """Add paths to a route group, creating the group if needed. Saved as a draft.
+
+    Example: devlift kong route add orders --env stage --method GET --auth jwt --path '~/api/v1/orders$' -y
+    """
+    inv: Invocation = ctx.obj
+    if auth.strip().lower() not in AUTH:
+        raise InputError("--auth must be jwt or public.")
+    if priority is not None and not 0 <= priority <= 10000:
+        raise InputError("--priority must be between 0 and 10000.")
+    change = RouteChange(
+        method=_method(method), secured=AUTH[auth.strip().lower()], tag=validate_tag(tag) if tag else None,
+        add=[validate_path(p) for p in paths], plugins=[normalise_plugin(p) for p in plugins], priority=priority,
+    )
+    target = resolve_target(inv, Resolver(inv.api, inv.profile.name), service, env, region)
+    _emit(inv, apply_change(inv, target, change))
+
+
+@route_app.command("remove")
+def route_remove(
+    ctx: typer.Context,
+    service: str = _SERVICE,
+    env: str | None = _ENV,
+    region: str | None = _REGION,
+    method: str = _METHOD,
+    tag: str = _TAG_REQ,
+    paths: list[str] = typer.Option(..., "--path", help="Path to remove, exactly as listed (repeatable)."),
+):
+    """Remove paths from a route group. Saved as a draft."""
+    inv: Invocation = ctx.obj
+    change = RouteChange(method=_method(method), tag=validate_tag(tag), remove=[p.strip() for p in paths])
+    target = resolve_target(inv, Resolver(inv.api, inv.profile.name), service, env, region)
+    _emit(inv, apply_change(inv, target, change))
+
+
+@route_app.command("rename")
+def route_rename(
+    ctx: typer.Context,
+    service: str = _SERVICE,
+    env: str | None = _ENV,
+    region: str | None = _REGION,
+    method: str = _METHOD,
+    tag: str = _TAG_REQ,
+    old: str = typer.Option(..., "--from", help="The path as it is now."),
+    new: str = typer.Option(..., "--to", help="The new path."),
+):
+    """Rename one path on a route group (keeps its identity). Saved as a draft."""
+    inv: Invocation = ctx.obj
+    change = RouteChange(method=_method(method), tag=validate_tag(tag), rename=[(old.strip(), validate_path(new))])
+    target = resolve_target(inv, Resolver(inv.api, inv.profile.name), service, env, region)
+    _emit(inv, apply_change(inv, target, change))
+
+
+@plugin_app.command("add")
+def plugin_add(
+    ctx: typer.Context,
+    service: str = _SERVICE,
+    env: str | None = _ENV,
+    region: str | None = _REGION,
+    method: str = _METHOD,
+    tag: str = _TAG_REQ,
+    plugins: list[str] = typer.Option(..., "--plugin", help="Plugin to add (repeatable), e.g. 'User ID Injection'."),
+    priority: int | None = typer.Option(None, "--priority", help="Also set the regex priority (0-10000)."),
+):
+    """Add plugins (and optionally set the priority) on an existing route group. Saved as a draft."""
+    inv: Invocation = ctx.obj
+    if priority is not None and not 0 <= priority <= 10000:
+        raise InputError("--priority must be between 0 and 10000.")
+    change = RouteChange(method=_method(method), tag=validate_tag(tag), plugins=[normalise_plugin(p) for p in plugins], priority=priority)
+    target = resolve_target(inv, Resolver(inv.api, inv.profile.name), service, env, region)
+    _emit(inv, apply_change(inv, target, change))
+
+
+kong_app.command("manual")(section_command("kong"))

devlift_cli/commands/languages.py

@@ -0,0 +1,40 @@
+"""devlift languages … — the languages and versions `eks create` accepts."""
+
+from __future__ import annotations
+
+import typer
+
+from devlift_cli.commands.manual import section_command
+from devlift_cli.api import services as services_api
+from devlift_cli.context import Invocation
+from devlift_cli.render.output import rows_table
+
+languages_app = typer.Typer(help="Languages and versions a service can be built with.", no_args_is_help=True)
+
+
+@languages_app.command("list")
+def languages_list(ctx: typer.Context):
+    """List languages and their versions (the --language / --version values).
+
+    "Template" says whether the platform has starting values for that
+    language; without one every setting must be given with --set.
+    """
+    inv: Invocation = ctx.obj
+    groups = services_api.language_versions_grouped(inv.api)
+    templated = {name.lower() for name in services_api.eks_language_templates(inv.api)}
+    data = [
+        {
+            "language": g["language_name"],
+            "versions": [v.get("version") for v in g.get("versions", [])],
+            "codes": [v.get("code") for v in g.get("versions", [])],
+            "template": g["language_name"].lower() in templated,
+        }
+        for g in groups
+    ]
+    inv.emit(data, lambda d: rows_table(
+        ["Language", "Versions", "Template"],
+        [(r["language"], ", ".join(str(v) for v in r["versions"]), "yes" if r["template"] else "no") for r in d],
+    ))
+
+
+languages_app.command("manual")(section_command("languages"))