fufu-cloud-cli 0.10.1__tar.gz → 0.11.0__tar.gz

{fufu_cloud_cli-0.10.1 → fufu_cloud_cli-0.11.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fufu-cloud-cli
-Version: 0.10.1
+Version: 0.11.0
 Summary: FUFU Cloud CLI for tenant-scoped mock cloud development and deployment
 License-Expression: LicenseRef-Proprietary
 Requires-Python: >=3.10
@@ -19,6 +19,7 @@ Provides-Extra: gcp
 Requires-Dist: google-cloud-bigquery==3.38.0; extra == "gcp"
 Requires-Dist: google-cloud-tasks==2.20.0; extra == "gcp"
 Requires-Dist: google-cloud-logging==3.12.1; extra == "gcp"
+Requires-Dist: google-cloud-storage==3.4.1; extra == "gcp"
 Dynamic: license-file
 
 # FUFU Cloud CLI
@@ -27,6 +28,27 @@ Dynamic: license-file
 `gcloud-fufu`、`az-fufu`、`wrangler-fufu`、`bq-fufu`。這是 AWS、Google Cloud、Azure 與 Cloudflare 的**明確子集**，
 只供 FUFU mock 環境使用；不會把部署轉送到正式雲端。
 
+0.11.0 新增獨占 GPU VM 的租用命令。需由平台啟用並驗證對應實體節點；
+支援的 RTX 3060 為整卡直通至 KVM 客體，可執行 NVIDIA 驅動與 CUDA。
+停止 VM 仍保留整卡，刪除後才釋放。GPU 使用中或已保留會明確拒絕，
+不會自動中斷其他工作。CLI 不包含節點 SSH 金鑰、主機裝置管理程式或平台設定。
+
+```bash
+gcloud-fufu compute instances create gpu-demo \
+  --zone=GPU_ZONE --machine-type=n1-standard-4 \
+  --accelerator=type=nvidia-geforce-rtx-3060,count=1 \
+  --maintenance-policy=TERMINATE
+gcloud-fufu compute ssh gpu-demo --zone=GPU_ZONE --command='nvidia-smi'
+gcloud-fufu compute instances delete gpu-demo --zone=GPU_ZONE
+
+aws-fufu ec2 run-instances --image-id=fufu-debian-12-gpu \
+  --instance-type=fufu.rtx3060.xlarge --placement=AvailabilityZone=GPU_ZONE
+```
+
+`GPU_ZONE` 使用平台 GPU 選單提供的區域。`nvidia-geforce-rtx-3060` 與
+`fufu.rtx3060.xlarge` 是 FUFU 的硬體擴充名稱；遷移到官方雲端時需改為官方
+提供的機型、加速器與區域。這不表示與官方 GPU 型號、HA、計費或 IAM 完全等價。
+
 0.10.1 新增官方 Terraform／OpenTofu／Pulumi 的 S3／GCS bucket 生命週期與
 S3 bucket tags。需配套 FUFU API；不支援 bucket versioning、retention、
 KMS、bucket IAM、GCS bucket labels 或 force destroy。
@@ -39,7 +61,7 @@ get-credentials／update-kubeconfig、waiter 與刪除。
 取得憑證後可使用標準 kubectl 部署 Deployment、Service、Job 及受管 GPU 容器。
 工作站需另安裝 kubectl；配套 Cloud Shell 已提供。
 
-VM 尚無公開 IP、複寫儲存、live migration 或自助 GPU passthrough；
+VM 尚無公開 IP、複寫儲存、live migration 或 GPU 熱插拔；
 叢集尚無 workload PVC、公開 LoadBalancer、互動式 exec／attach／port-forward。
 這批新 VM／cluster API 尚未支援官方 Terraform／OpenTofu／Pulumi provider。
 原有 firewall、global LB、Redis 等 typed configuration 仍明示 `MOCK ONLY`，
@@ -135,7 +157,7 @@ Python 預設識別而遇到 Cloudflare HTTP 403／1010。識別標頭不取代
 ## Cloudflare 前端部署與 R2
 
 ```bash
-pip install 'fufu-cloud-cli==0.10.1'
+pip install 'fufu-cloud-cli==0.11.0'
 export FUFU_CLOUDFLARE_CREDENTIAL_FILE=/run/secrets/fufu-cloudflare.json
 wrangler-fufu capabilities
 wrangler-fufu pages project create frontend --production-branch main

fufu_cloud_cli-0.10.1/src/fufu_cloud_cli.egg-info/PKG-INFO → fufu_cloud_cli-0.11.0/README.md

@@ -1,32 +1,30 @@
-Metadata-Version: 2.4
-Name: fufu-cloud-cli
-Version: 0.10.1
-Summary: FUFU Cloud CLI for tenant-scoped mock cloud development and deployment
-License-Expression: LicenseRef-Proprietary
-Requires-Python: >=3.10
-Description-Content-Type: text/markdown
-License-File: LICENSE
-Requires-Dist: PyYAML==6.0.3
-Requires-Dist: jmespath==1.1.0
-Requires-Dist: tomli==2.2.1; python_version < "3.11"
-Provides-Extra: yaml
-Requires-Dist: PyYAML==6.0.3; extra == "yaml"
-Provides-Extra: test
-Requires-Dist: boto3==1.40.66; extra == "test"
-Provides-Extra: terraform
-Requires-Dist: python-hcl2==7.3.1; extra == "terraform"
-Provides-Extra: gcp
-Requires-Dist: google-cloud-bigquery==3.38.0; extra == "gcp"
-Requires-Dist: google-cloud-tasks==2.20.0; extra == "gcp"
-Requires-Dist: google-cloud-logging==3.12.1; extra == "gcp"
-Dynamic: license-file
-
 # FUFU Cloud CLI
 
 以六個指令操作 FUFU Cloud 的租戶隔離開發環境：`fufu`、`aws-fufu`、
 `gcloud-fufu`、`az-fufu`、`wrangler-fufu`、`bq-fufu`。這是 AWS、Google Cloud、Azure 與 Cloudflare 的**明確子集**，
 只供 FUFU mock 環境使用；不會把部署轉送到正式雲端。
 
+0.11.0 新增獨占 GPU VM 的租用命令。需由平台啟用並驗證對應實體節點；
+支援的 RTX 3060 為整卡直通至 KVM 客體，可執行 NVIDIA 驅動與 CUDA。
+停止 VM 仍保留整卡，刪除後才釋放。GPU 使用中或已保留會明確拒絕，
+不會自動中斷其他工作。CLI 不包含節點 SSH 金鑰、主機裝置管理程式或平台設定。
+
+```bash
+gcloud-fufu compute instances create gpu-demo \
+  --zone=GPU_ZONE --machine-type=n1-standard-4 \
+  --accelerator=type=nvidia-geforce-rtx-3060,count=1 \
+  --maintenance-policy=TERMINATE
+gcloud-fufu compute ssh gpu-demo --zone=GPU_ZONE --command='nvidia-smi'
+gcloud-fufu compute instances delete gpu-demo --zone=GPU_ZONE
+
+aws-fufu ec2 run-instances --image-id=fufu-debian-12-gpu \
+  --instance-type=fufu.rtx3060.xlarge --placement=AvailabilityZone=GPU_ZONE
+```
+
+`GPU_ZONE` 使用平台 GPU 選單提供的區域。`nvidia-geforce-rtx-3060` 與
+`fufu.rtx3060.xlarge` 是 FUFU 的硬體擴充名稱；遷移到官方雲端時需改為官方
+提供的機型、加速器與區域。這不表示與官方 GPU 型號、HA、計費或 IAM 完全等價。
+
 0.10.1 新增官方 Terraform／OpenTofu／Pulumi 的 S3／GCS bucket 生命週期與
 S3 bucket tags。需配套 FUFU API；不支援 bucket versioning、retention、
 KMS、bucket IAM、GCS bucket labels 或 force destroy。
@@ -39,7 +37,7 @@ get-credentials／update-kubeconfig、waiter 與刪除。
 取得憑證後可使用標準 kubectl 部署 Deployment、Service、Job 及受管 GPU 容器。
 工作站需另安裝 kubectl；配套 Cloud Shell 已提供。
 
-VM 尚無公開 IP、複寫儲存、live migration 或自助 GPU passthrough；
+VM 尚無公開 IP、複寫儲存、live migration 或 GPU 熱插拔；
 叢集尚無 workload PVC、公開 LoadBalancer、互動式 exec／attach／port-forward。
 這批新 VM／cluster API 尚未支援官方 Terraform／OpenTofu／Pulumi provider。
 原有 firewall、global LB、Redis 等 typed configuration 仍明示 `MOCK ONLY`，
@@ -135,7 +133,7 @@ Python 預設識別而遇到 Cloudflare HTTP 403／1010。識別標頭不取代
 ## Cloudflare 前端部署與 R2
 
 ```bash
-pip install 'fufu-cloud-cli==0.10.1'
+pip install 'fufu-cloud-cli==0.11.0'
 export FUFU_CLOUDFLARE_CREDENTIAL_FILE=/run/secrets/fufu-cloudflare.json
 wrangler-fufu capabilities
 wrangler-fufu pages project create frontend --production-branch main

{fufu_cloud_cli-0.10.1 → fufu_cloud_cli-0.11.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "fufu-cloud-cli"
-version = "0.10.1"
+version = "0.11.0"
 description = "FUFU Cloud CLI for tenant-scoped mock cloud development and deployment"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -16,7 +16,7 @@ license-files = ["LICENSE"]
 yaml = ["PyYAML==6.0.3"]
 test = ["boto3==1.40.66"]
 terraform = ["python-hcl2==7.3.1"]
-gcp = ["google-cloud-bigquery==3.38.0", "google-cloud-tasks==2.20.0", "google-cloud-logging==3.12.1"]
+gcp = ["google-cloud-bigquery==3.38.0", "google-cloud-tasks==2.20.0", "google-cloud-logging==3.12.1", "google-cloud-storage==3.4.1"]
 
 [project.scripts]
 fufu = "fufu_cloud_cli.cli:main"

{fufu_cloud_cli-0.10.1 → fufu_cloud_cli-0.11.0}/src/fufu_cloud_cli/__init__.py

@@ -1,3 +1,3 @@
 """FUFU CLI 與本機部署工具；相容範圍見 capabilities.json。"""
 
-__version__ = "0.10.1"
+__version__ = "0.11.0"

{fufu_cloud_cli-0.10.1 → fufu_cloud_cli-0.11.0}/src/fufu_cloud_cli/api_backend.py

@@ -184,6 +184,22 @@ class ApiClient:
                 return json.loads(raw)
         except HTTPError as exc:
             status = exc.code
+            if '/infrastructure/' in path and status in {409, 422, 503, 504}:
+                try:
+                    value = json.loads(exc.read(4096))
+                    code = value.get('code') if isinstance(value, dict) else None
+                    messages = {
+                        'GPU_IN_USE': '符合條件的 GPU 正在使用；未搶占現有工作或重複出租。',
+                        'GPU_RESERVED': 'GPU 已由另一台 VM 保留；停止 VM 仍保留 GPU，刪除後才會釋放。',
+                        'GPU_RECOVERY_REQUIRED': 'GPU 正在等待安全恢復；平台保留所有權，恢復前不接受再次租用。',
+                        'GPU_NODE_UNAVAILABLE': 'GPU 節點暫時無法連線；請稍後重試。',
+                        'GPU_TRANSITION_TIMEOUT': 'GPU 裝置交接逾時；所有權仍受保護，請檢查 VM 狀態。',
+                        'INSUFFICIENT_NODE_STORAGE': '目標 GPU 節點的 SSD 可用空間不足。',
+                    }
+                    if code in messages:
+                        raise FufuError(code, messages[code]) from None
+                except (ValueError, OSError): pass
+                finally: exc.close()
             if '/infrastructure/' in path and status == 429:
                 try:
                     value = json.loads(exc.read(4096))

{fufu_cloud_cli-0.10.1 → fufu_cloud_cli-0.11.0}/src/fufu_cloud_cli/capabilities.json

@@ -544,9 +544,9 @@
       "backend": "api",
       "mode": "simplified",
       "operations": [
-        "create-list-describe-delete", "stop-start", "guest-ssh-command"
+        "create-list-describe-delete", "stop-start", "guest-ssh-command", "exclusive-gpu-vm"
       ],
-      "limitations": ["requires-FUFU-infrastructure-backend", "Debian-12-only", "private-network", "single-node-disk", "no-self-service-GPU-passthrough", "no-official-IaC-provider"],
+      "limitations": ["requires-FUFU-infrastructure-backend", "Debian-12-only", "private-network", "single-node-disk", "GPU-requires-enabled-validated-node", "GPU-exclusive-until-delete", "no-GPU-hotplug-or-live-migration", "no-official-IaC-provider"],
       "reason": "實際 KVM／KubeVirt VM、持久磁碟與 SSH 指令；原生風格指令子集，無官方雲端資源。"
     },
     "gcp-gke": {
@@ -648,8 +648,8 @@
       "status": "implemented",
       "backend": "api",
       "mode": "simplified",
-      "operations": ["run-describe-terminate-instances", "stop-start", "instance-waiters"],
-      "limitations": ["requires-FUFU-infrastructure-backend", "Debian-12-only", "private-network", "single-node-disk", "no-self-service-GPU-passthrough", "no-official-IaC-provider"],
+      "operations": ["run-describe-terminate-instances", "stop-start", "instance-waiters", "exclusive-gpu-vm"],
+      "limitations": ["requires-FUFU-infrastructure-backend", "Debian-12-only", "private-network", "single-node-disk", "GPU-requires-enabled-validated-node", "GPU-exclusive-until-delete", "no-GPU-hotplug-or-live-migration", "no-official-IaC-provider"],
       "reason": "實際 KVM／KubeVirt VM；支援生命週期與 scoped instance ID，無官方 EC2 網路或完整 API。"
     },
     "aws-ecs": {

{fufu_cloud_cli-0.10.1 → fufu_cloud_cli-0.11.0}/src/fufu_cloud_cli/cli.py

@@ -128,6 +128,7 @@ def fufu_parser():
     sub.add_parser('pulumi', help='官方 Pulumi Node.js SDK；使用獨立 FUFU 開發 state')
     sub.add_parser('state', help='管理 Terraform／OpenTofu 遠端 state、版本與鎖')
     sub.add_parser('infrastructure', help='GCP 基礎設施配置 mock 的查詢與 CRUD；不啟動資源')
+    sub.add_parser('usage', help='逐台 VM 的月用量、電量分攤估算與成本明細')
     for action in ("plan", "deploy"):
         q = sub.add_parser(action)
         q.add_argument("--file", required=True)
@@ -515,6 +516,12 @@ def entry(provider, argv=None):
         if provider == 'fufu' and argv[:1] == ['state']:
             from .iac_state import command
             emit(command(argv[1:], Parser)); return
+        if provider == 'fufu' and argv[:1] == ['usage']:
+            from .usage import command
+            value = command(argv[1:], Parser)
+            if isinstance(value, str): sys.stdout.write(value)
+            else: emit(value)
+            return
         if provider == 'fufu' and argv[:1] == ['infrastructure']:
             from .gcp_infra import configuration_command
             emit(configuration_command(argv[1:], Parser)); return

{fufu_cloud_cli-0.10.1 → fufu_cloud_cli-0.11.0}/src/fufu_cloud_cli/docker_backend.py

@@ -38,6 +38,7 @@ INGRESS_IMAGE = "fufu-cloud-cli-ingress:local"
 LABEL = "io.fufu.cloud-cli"
 KINDS = {"cloud-run-http", "cloud-run-functions-http", "cloud-functions-gen1-http", "aws-lambda-sync"}
 from .limits import compute_limits, MAX_SOURCE_FILES, size_label, workload_resources
+from .gateway_contract import api_gateway_labels
 from .capacity import run_admitted
 
 MAX_PAYLOAD = 32 * 1024 * 1024
@@ -284,8 +285,8 @@ class Backend:
                 require(gateway_container is not None, 'GATEWAY_UNAVAILABLE', 'Workload gateway 尚未配置。')
                 gateway = object_json(docker('container', 'inspect', gateway_container, '--format',
                     '{"id":{{json .Id}},"labels":{{json .Config.Labels}},"networks":{{json .NetworkSettings.Networks}},"running":{{json .State.Running}}}'))
-                require(gateway['running'] and gateway['labels'].get('com.docker.compose.service') == 'local-cloud-console',
-                        'GATEWAY_UNAVAILABLE', '指定 gateway 必須是正在執行的 FUFU Console。')
+                require(gateway['running'] and api_gateway_labels(gateway['labels']),
+                        'GATEWAY_UNAVAILABLE', '指定 gateway 必須是正在執行且已核准的 FUFU API 入口。')
                 if network not in gateway['networks']:
                     docker('network', 'connect', '--alias', 'fufu-api', network, gateway['id'])
             revision = str(uuid.uuid4()) if kind == 'aws-lambda-sync' else f"{service}-{uuid.uuid4().hex[:8]}"
@@ -325,7 +326,7 @@ class Backend:
                           'lastModified': datetime.now(timezone.utc).strftime('%Y-%m-%dT%H:%M:%S.%f')[:23] + '+0000',
                           'architecture': {'x86_64': 'x86_64', 'aarch64': 'arm64'}.get(platform.machine()),
                           **({'network': network, 'gateway_id': gateway['id']} if gateway else {}),
-                          **({'role': role, 'sdkTransport': 'fufu-workload-token', 'iamEnforced': True} if role else {}),
+                          **({'role': role, 'sdkTransport': 'aws-sigv4-wire' if (runtime_env or {}).get('FUFU_AWS_SDK_TRANSPORT') == 'native-v1' else 'fufu-workload-token', 'iamEnforced': True} if role else {}),
                           **({'build': build} if build else {}),
                           **({'source': source} if source else {}),
                           **({'imageReference': image_reference} if image_reference else {}),
@@ -354,7 +355,8 @@ class Backend:
                     "--network", self.ingress_network, "--publish", "127.0.0.1::8080",
                     "--user", "10001:10001", "--read-only", "--cap-drop", "ALL",
                     "--security-opt", "no-new-privileges:true", "--pids-limit", "64", "--memory", "64m", "--cpus", "0.25",
-                    "--log-opt", "max-size=1m", "--log-opt", "max-file=1",
+                    "--log-driver", "local", "--log-opt", "max-size=1m",
+                    "--log-opt", "max-file=2", "--log-opt", "compress=true",
                     "--env", "FUFU_UPSTREAM_HOST", "--env", "FUFU_UPSTREAM_PORT", ingress_image_id,
                     env={"FUFU_UPSTREAM_HOST": cname, "FUFU_UPSTREAM_PORT": str(port)})
                 docker("network", "connect", network, ingress_candidate)
@@ -566,11 +568,11 @@ def prepare_runtime(runtimes=("python3.12",)):
     return {"prepared": ["functions-python312", "ingress", *runtimes], "backend": "local-docker"}
 
 
-def build_function(source, target, *, network="default"):
+def build_function(source, target, *, network="default", image_store=None):
     require(re.fullmatch(r"[A-Za-z_][A-Za-z0-9_]*", target or ""), "INVALID_HANDLER", "入口必須是有效 Python 函式名稱。")
     src = Path(source).resolve()
     require(src.is_dir() and (src / "main.py").is_file(), "INVALID_SOURCE", "Python function 來源需包含 main.py。")
-    inspect_image(FUNCTIONS_IMAGE)
+    (image_store.inspect_image if image_store else inspect_image)(FUNCTIONS_IMAGE)
     base = FUNCTIONS_IMAGE
     with tempfile.TemporaryDirectory(prefix="fufu-function-") as tmp:
         dst = Path(tmp)
@@ -595,6 +597,12 @@ def build_function(source, target, *, network="default"):
         requirements = dst / "app/requirements.txt"
         if not requirements.exists():
             requirements.write_text("")
+        if image_store:
+            require(not requirements.read_text().strip(), 'DEPENDENCIES_NOT_PREPARED',
+                    '離線 Function 配方需要預先準備相依套件。')
+            return image_store.layer(base, dst / 'app', '/app', [
+                'functions-framework', '--target', target, '--signature-type', 'http',
+                '--host', '0.0.0.0', '--port', '8080'], workdir='/app')
         # 原始 requirements 可安裝應用相依；build 有網路，runtime 不開放 egress。
         dockerfile = (f"FROM {base}\nUSER 0\nCOPY app/requirements.txt /tmp/requirements.txt\n"
                       "RUN python -m pip install --index-url https://pypi.org/simple --disable-pip-version-check --no-cache-dir --retries 1 --timeout 20 -r /tmp/requirements.txt\n"
@@ -637,11 +645,11 @@ def extract_zip(archive, destination, *, kind="aws-lambda-sync"):
         raise FufuError("INVALID_ZIP", "ZIP 無法安全解壓縮。") from exc
 
 
-def build_lambda(archive, runtime, handler):
+def build_lambda(archive, runtime, handler, *, image_store=None):
     require(runtime in LAMBDA_IMAGES, "UNSUPPORTED_RUNTIME", "目前只支援 Python 3.10 與 3.12 Lambda ZIP。")
     require(re.fullmatch(r"[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)+", handler or ""), "INVALID_HANDLER", "Lambda handler 格式應為 module.function。")
     base = LAMBDA_IMAGES[runtime]
-    inspect_image(base)
+    (image_store.inspect_image if image_store else inspect_image)(base)
     with tempfile.TemporaryDirectory(prefix="fufu-lambda-") as tmp:
         dst = Path(tmp)
         app = dst / "app"
@@ -661,17 +669,20 @@ def build_lambda(archive, runtime, handler):
         require(not transfer.exists(), 'RESERVED_FILE', '來源與物件傳輸 helper 的保留檔名衝突。')
         shutil.copyfile(Path(__file__).with_name('object_transfer.py'), transfer)
         transfer.chmod(0o644)
+        if image_store:
+            return image_store.layer(base, app, '/var/task', ['_fufu_runtime_adapter.handler'],
+                                     {'FUFU_HANDLER': handler})
         (dst / "Dockerfile").write_text(f"FROM {base}\nENV FUFU_HANDLER={handler}\nCOPY --chown=10001:10001 app/ ${{LAMBDA_TASK_ROOT}}/\nCMD " + json.dumps(["_fufu_runtime_adapter.handler"]) + "\n")
         return build_image(dst, f"fufu-cli-lambda:{uuid.uuid4().hex}")
 
 
-def build_cloud_run(archive, handler, port, tag):
+def build_cloud_run(archive, handler, port, tag, *, image_store=None):
     """固定 Python ASGI 配方；不執行使用者 Dockerfile、安裝程式或建置 hook。"""
     require(isinstance(handler, str) and re.fullmatch(r"[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*:[A-Za-z_]\w*", handler),
             'INVALID_HANDLER', 'ASGI entry point 必須是 module:app。')
     require(type(port) is int and 1024 <= port <= 65535, 'INVALID_PORT', '容器 port 範圍為 1024–65535。')
     require(re.fullmatch(r'fufu-source:[a-f0-9]{64}', tag), 'INVALID_IMAGE', '來源映像名稱無效。')
-    inspect_image(PYTHON_IMAGE)
+    (image_store.inspect_image if image_store else inspect_image)(PYTHON_IMAGE)
     base = PYTHON_IMAGE
     with tempfile.TemporaryDirectory(prefix='fufu-asgi-') as tmp:
         context = Path(tmp)
@@ -707,6 +718,9 @@ def build_cloud_run(archive, handler, port, tag):
         shutil.copyfile(Path(__file__).with_name('object_transfer.py'), transfer)
         transfer.chmod(0o644)
         command = ['python', '-m', 'uvicorn', handler, '--host', '0.0.0.0', '--port', str(port)]
+        if image_store:
+            return image_store.layer(base, app, '/app', command,
+                                     {'PYTHONDONTWRITEBYTECODE': '1', 'PYTHONUNBUFFERED': '1'}, workdir='/app')
         (context / 'Dockerfile').write_text(
             f'FROM {base}\nCOPY --chown=10001:10001 app/ /app/\nWORKDIR /app\n'
             'ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1\nUSER 10001:10001\n'

fufu_cloud_cli-0.11.0/src/fufu_cloud_cli/gateway_contract.py

@@ -0,0 +1,8 @@
+"""管理者配置的 API gateway；容器標籤只能由受信任的宿主控制器設定。"""
+
+
+def api_gateway_labels(labels):
+    if not isinstance(labels, dict):
+        return False
+    return labels.get('com.docker.compose.service') == 'local-cloud-console' or \
+        labels.get('io.fufu.platform-bridge') == 'console-rke2-v1'

{fufu_cloud_cli-0.10.1 → fufu_cloud_cli-0.11.0}/src/fufu_cloud_cli/gcp_sdk.py

@@ -38,6 +38,13 @@ def tasks_client():
     return tasks_v2.CloudTasksClient(credentials=credentials, transport='rest', client_options={'api_endpoint': endpoint + '/tasks'})
 
 
+def storage_client():
+    """Official Storage JSON API with the same managed workload identity."""
+    from google.cloud import storage
+    endpoint, project, credentials = _configuration()
+    return storage.Client(project=project, credentials=credentials, client_options={'api_endpoint': endpoint + '/storage'})
+
+
 def logging_client():
     from google.cloud import logging_v2
     from google.cloud.logging_v2.resource import Resource

{fufu_cloud_cli-0.10.1 → fufu_cloud_cli-0.11.0}/src/fufu_cloud_cli/infrastructure.py

@@ -8,6 +8,7 @@ from pathlib import Path
 import re
 import shutil
 import ssl
+import stat
 import sys
 import tempfile
 import time
@@ -21,11 +22,12 @@ from .errors import FufuError, require
 BASE = '/infrastructure/resources/'
 VM_TYPES = {'e2-micro': (2, 1), 'e2-small': (2, 2), 'e2-medium': (2, 4), 'e2-standard-2': (2, 8),
     'e2-standard-4': (4, 16), 'e2-standard-8': (8, 32), 't3.micro': (2, 1), 't3.small': (2, 2),
-    't3.medium': (2, 4), 'm5.large': (2, 8), 'm5.xlarge': (4, 16), 'm5.2xlarge': (8, 32)}
+    't3.medium': (2, 4), 'm5.large': (2, 8), 'm5.xlarge': (4, 16), 'm5.2xlarge': (8, 32),
+    'n1-standard-4': (4, 15), 'n1-standard-8': (8, 30), 'fufu.rtx3060.xlarge': (4, 16)}
 
 
 def warn(kind):
-    sys.stderr.write('FUFU runtime: ' + ('KVM VM with a private network and one-node persistent disk; no GPU passthrough.\n' if kind == 'vm' else
+    sys.stderr.write('FUFU runtime: ' + ('KVM VM with a private network and one-node persistent disk; optional exclusive GPU on validated nodes, retained until deletion.\n' if kind == 'vm' else
         'Independent Kubernetes API with shared worker nodes; private ClusterIP services, no workload PVCs or native cloud IAM.\n'))
 
 
@@ -55,6 +57,8 @@ def gcp_shape(value, kind):
     if kind == 'vm':
         return {'name': value['name'], 'status': {'STOPPED': 'TERMINATED', 'DELETING': 'STOPPING'}.get(value['state'], value['state']),
             'machineType': spec.get('machineType'), 'zone': spec.get('location'),
+            **({'guestAccelerators': [{'acceleratorType': spec['gpu']['type'], 'acceleratorCount': spec['gpu']['count']}],
+                'scheduling': {'onHostMaintenance': 'TERMINATE'}} if spec.get('gpu') else {}),
             'disks': [{'boot': True, 'diskSizeGb': str(spec.get('diskGiB', 20))}], 'Fufu': fufu_fields(value)}
     return {'name': value['name'], 'status': {'PROVISIONING': 'PROVISIONING', 'RUNNING': 'RUNNING', 'ERROR': 'ERROR', 'DELETING': 'STOPPING'}.get(value['state'], value['state']),
         'location': spec.get('location'), 'currentMasterVersion': spec.get('version'), 'Fufu': fufu_fields(value)}
@@ -65,13 +69,41 @@ def aws_shape(value, kind, who):
     if kind == 'vm':
         identifier = 'i-' + hashlib.sha256((str(who['tenantId']) + value['name'] + value.get('resourceId', value.get('createdAt', ''))).encode()).hexdigest()[:17]
         state = {'RUNNING': (16, 'running'), 'STOPPED': (80, 'stopped'), 'STOPPING': (64, 'stopping'), 'DELETING': (32, 'shutting-down'), 'DELETED': (48, 'terminated')}.get(value['state'], (0, 'pending'))
-        return {'InstanceId': identifier, 'InstanceType': spec.get('machineType'), 'ImageId': 'fufu-debian-12',
+        return {'InstanceId': identifier, 'InstanceType': spec.get('machineType'), 'ImageId': 'fufu-debian-12-gpu' if spec.get('gpu') else 'fufu-debian-12',
+            'Placement': {'AvailabilityZone': spec.get('location')},
             'State': {'Code': state[0], 'Name': state[1]}, 'Tags': [{'Key': 'Name', 'Value': value['name']}], 'Fufu': fufu_fields(value)}
     return {'name': value['name'], 'arn': f"arn:aws:eks:{who['region']}:{who['accountId']}:cluster/{value['name']}",
         'status': {'RUNNING': 'ACTIVE', 'PROVISIONING': 'CREATING', 'DELETING': 'DELETING', 'ERROR': 'FAILED'}.get(value['state'], value['state']),
         'version': spec.get('version'), 'Fufu': fufu_fields(value)}
 
 
+def read_shell_certificate(certificate):
+    """Read a bounded CA file, including a Kubernetes projected Secret link.
+
+    Kubelet projects each Secret key through ``..data``. Resolve it inside the
+    fixed session mount, then inspect and read one non-following file descriptor.
+    External links, special files and writable trust files remain rejected.
+    """
+    fd = None
+    try:
+        target = certificate.resolve(strict=True)
+        target.relative_to(certificate.parent.resolve(strict=True))
+        fd = os.open(target, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK | os.O_CLOEXEC)
+        info = os.fstat(fd)
+        require(stat.S_ISREG(info.st_mode) and not info.st_mode & 0o022 and 0 < info.st_size <= 16384,
+                'INVALID_SESSION', 'Cloud Shell TLS 憑證不存在或無效，請重新開啟 Shell。')
+        data = os.read(fd, 16385)
+        require(0 < len(data) <= 16384, 'INVALID_SESSION', 'Cloud Shell TLS 憑證大小無效。')
+        content = data.decode('ascii')
+        ssl.PEM_cert_to_DER_cert(content)
+        return content
+    except (OSError, ValueError, UnicodeError):
+        raise FufuError('INVALID_SESSION', 'Cloud Shell TLS 憑證不存在或無效，請重新開啟 Shell。') from None
+    finally:
+        if fd is not None:
+            os.close(fd)
+
+
 def kubernetes_transport(api, name, who):
     endpoint = api.endpoint
     cluster = {}
@@ -79,13 +111,7 @@ def kubernetes_transport(api, name, who):
         require(os.environ.get('FUFU_SESSION_FILE') == '/run/fufu/session.json',
             'INVALID_SESSION', 'Cloud Shell 工作階段來源不符。')
         certificate = Path('/run/fufu/kubernetes-ca.crt')
-        require(certificate.is_file() and not certificate.is_symlink() and certificate.stat().st_size <= 16384,
-            'INVALID_SESSION', 'Cloud Shell TLS 憑證不存在或無效，請重新開啟 Shell。')
-        content = certificate.read_text(encoding='ascii')
-        try:
-            ssl.PEM_cert_to_DER_cert(content)
-        except ValueError:
-            raise FufuError('INVALID_SESSION', 'Cloud Shell TLS 憑證無效。') from None
+        content = read_shell_certificate(certificate)
         endpoint = 'https://127.0.0.1:8788'
         cluster['certificate-authority-data'] = base64.b64encode(content.encode('ascii')).decode('ascii')
     cluster['server'] = endpoint + f'/api/cloud/{api.provider}/infrastructure/clusters/{segment(name)}/kubernetes'
@@ -179,6 +205,7 @@ def gcp_command(argv, Parser):
             if kind == 'vm':
                 q.add_argument('--machine-type', default='e2-small'); q.add_argument('--image-family', default='debian-12')
                 q.add_argument('--image-project', default='debian-cloud'); q.add_argument('--boot-disk-size', default='20GB')
+                q.add_argument('--accelerator'); q.add_argument('--maintenance-policy', choices=['MIGRATE', 'TERMINATE'], default='MIGRATE')
             else:
                 q.add_argument('--cluster-version', default='1.36')
     a = p.parse_args(tail)
@@ -197,12 +224,20 @@ def gcp_command(argv, Parser):
             who = api.whoami()
             spec = {'location': a.zone or a.location or who.get('region')}
             if kind == 'vm':
-                require(a.machine_type in VM_TYPES and a.machine_type.startswith('e2-') and a.image_family == 'debian-12' and a.image_project == 'debian-cloud',
+                require(a.machine_type in VM_TYPES and a.machine_type.startswith(('e2-', 'n1-')) and a.image_family == 'debian-12' and a.image_project == 'debian-cloud',
                     'UNSUPPORTED_CONFIG', '目前提供已驗證的 Debian 12 映像與列明的 VM 規格。')
                 match = re.fullmatch(r'(\d+)(?:GB|GiB)?', a.boot_disk_size, re.I)
                 require(match is not None, 'INVALID_CONFIG', '磁碟大小須為整數 GB。')
                 cpu, memory = VM_TYPES[a.machine_type]
                 spec.update(cpu=cpu, memoryGiB=memory, machineType=a.machine_type, diskGiB=int(match[1]), image=a.image_family)
+                if a.accelerator:
+                    parts = a.accelerator.split(',')
+                    require(len(parts) == 2 and all('=' in p for p in parts), 'INVALID_CONFIG', 'Accelerator 格式為 type=nvidia-geforce-rtx-3060,count=1。')
+                    gpu = dict(p.split('=', 1) for p in parts)
+                    require(gpu == {'type': 'nvidia-geforce-rtx-3060', 'count': '1'}, 'UNSUPPORTED_CONFIG', '目前 GPU VM 僅開放已驗證的 RTX 3060；此型號為 FUFU 硬體擴充。')
+                    require(a.machine_type.startswith('n1-') and a.maintenance_policy == 'TERMINATE', 'INVALID_CONFIG',
+                            'GPU VM 請使用 n1-standard-4 或 n1-standard-8，並指定 --maintenance-policy=TERMINATE。')
+                    spec['gpu'] = {'type': gpu['type'], 'count': 1}
             else: spec['version'] = a.cluster_version
             value = api.request('POST', route(kind, a.name), {'spec': spec})
         elif a.action == 'delete': value = api.request('DELETE', route(kind, a.name))
@@ -226,6 +261,7 @@ def aws_command(argv, Parser):
     else:
         q = actions.add_parser('run-instances'); q.add_argument('--image-id', required=True); q.add_argument('--instance-type', default='t3.small')
         q.add_argument('--count', type=int, default=1); q.add_argument('--tag-specifications')
+        q.add_argument('--placement')
         for action in ['describe-instances', 'start-instances', 'stop-instances', 'terminate-instances']:
             q = actions.add_parser(action); q.add_argument('--instance-ids', nargs='+', required=action != 'describe-instances')
         q = actions.add_parser('wait'); q.add_argument('waiter', choices=['instance-running', 'instance-stopped', 'instance-terminated']); q.add_argument('--instance-ids', nargs='+', required=True)
@@ -242,7 +278,8 @@ def aws_command(argv, Parser):
             else: value = api.request('GET', route(kind, a.name))
             return {'cluster': aws_shape(value, kind, who)}
         if a.action == 'run-instances':
-            require(a.count == 1 and a.image_id == 'fufu-debian-12' and a.instance_type in VM_TYPES and not a.instance_type.startswith('e2-'), 'UNSUPPORTED_CONFIG',
+            gpu = a.instance_type == 'fufu.rtx3060.xlarge'
+            require(a.count == 1 and a.image_id == ('fufu-debian-12-gpu' if gpu else 'fufu-debian-12') and a.instance_type in VM_TYPES and not a.instance_type.startswith(('e2-', 'n1-')), 'UNSUPPORTED_CONFIG',
                 '目前使用 fufu-debian-12，且每次建立一台 VM；不會將官方 AMI 冒充為本地映像。')
             name = 'vm-' + uuid.uuid4().hex[:12]
             if a.tag_specifications:
@@ -251,7 +288,19 @@ def aws_command(argv, Parser):
                     and len(tags[0].get('Tags', [])) == 1 and tags[0]['Tags'][0].get('Key') == 'Name', 'UNSUPPORTED_CONFIG', '目前只接受一個 Name 標籤。')
                 name = tags[0]['Tags'][0]['Value']
             cpu, memory = VM_TYPES[a.instance_type]
-            api.request('POST', route(kind, name), {'spec': {'image': 'debian-12', 'machineType': a.instance_type, 'cpu': cpu, 'memoryGiB': memory, 'location': who['region']}})
+            location = who['region']
+            if a.placement:
+                if a.placement.startswith('{'):
+                    placement = json.loads(a.placement)
+                else:
+                    parts = a.placement.split(',')
+                    require(len(parts) == 1 and all('=' in p for p in parts), 'UNSUPPORTED_CONFIG', 'Placement 格式為 AvailabilityZone=fufu-m1 或 AvailabilityZone=fufu-m6。')
+                    placement = dict(p.split('=', 1) for p in parts)
+                require(type(placement) is dict and set(placement) == {'AvailabilityZone'} and placement['AvailabilityZone'] in {'fufu-m1', 'fufu-m6'},
+                        'UNSUPPORTED_CONFIG', '目前 placement 僅支援已配置的 FUFU AvailabilityZone。')
+                location = placement['AvailabilityZone']
+            api.request('POST', route(kind, name), {'spec': {'image': 'debian-12', 'machineType': a.instance_type, 'cpu': cpu, 'memoryGiB': memory, 'location': location,
+                **({'gpu': {'type': 'nvidia-geforce-rtx-3060', 'count': 1}, 'diskGiB': 20} if gpu else {})}})
             value = api.request('GET', route(kind, name))
             return {'Instances': [aws_shape(value, kind, who)]}
         rows = api.request('GET', route(kind))['items']

{fufu_cloud_cli-0.10.1 → fufu_cloud_cli-0.11.0}/src/fufu_cloud_cli/runtime_sdk.py

@@ -153,6 +153,35 @@ def access_secret_version(name):
 
 
 _installed = False
+_pending_import = None
+
+
+def _install_when_sdk_imports():
+    """Patch under the SDK module import lock, before application code can use it."""
+    global _pending_import
+    if _pending_import is not None: return
+    import sys
+    from importlib.machinery import PathFinder
+
+    class Finder:
+        def find_spec(self, fullname, path=None, target=None):
+            if fullname != 'botocore.session': return None
+            spec = PathFinder.find_spec(fullname, path, target)
+            if spec is None or spec.loader is None: return None
+            original = spec.loader
+            class Loader:
+                def create_module(self, spec):
+                    return original.create_module(spec) if hasattr(original, 'create_module') else None
+                def exec_module(self, module):
+                    original.exec_module(module)
+                    install()
+                    if finder in sys.meta_path: sys.meta_path.remove(finder)
+                def __getattr__(self, key): return getattr(original, key)
+            spec.loader = Loader()
+            return spec
+    finder = Finder()
+    _pending_import = finder
+    sys.meta_path.insert(0, finder)
 
 
 def modeled_response(value, shape):
@@ -177,14 +206,32 @@ def install():
     global _installed
     if _installed or not os.environ.get('FUFU_RUNTIME_ENDPOINT'):
         return
-    import botocore.session
+    import sys
+    if 'botocore.session' not in sys.modules:
+        _install_when_sdk_imports()
+        return
+    session_module = sys.modules['botocore.session']
     from botocore.awsrequest import AWSResponse
     from botocore.response import StreamingBody
-    original = botocore.session.Session.create_client
+    original = session_module.Session.create_client
 
     def create_client(session, service_name, *args, **kwargs):
         if service_name not in {'dynamodb', 's3', 'sqs', 'ssm', 'secretsmanager', 'logs', 'lambda'}:
             raise FufuCapabilityError('FUFU SDK service is not implemented: ' + service_name)
+        if service_name in {'s3', 'logs'} and os.environ.get('FUFU_AWS_SDK_TRANSPORT') == 'native-v1':
+            # Preserve the official serializer, signer, HTTP transport and paginator.
+            # The control plane injects credentials scoped to this live deployment.
+            from botocore.config import Config
+            endpoint = os.environ.get('FUFU_RUNTIME_ENDPOINT', '')
+            if endpoint != 'http://fufu-api:8080/api/runtime/aws':
+                raise FufuCapabilityError('Native AWS SDK requires the managed workload endpoint')
+            kwargs['endpoint_url'] = endpoint + '/sdk/' + service_name
+            kwargs['aws_access_key_id'] = os.environ['AWS_ACCESS_KEY_ID']
+            kwargs['aws_secret_access_key'] = os.environ['AWS_SECRET_ACCESS_KEY']
+            kwargs['aws_session_token'] = os.environ['AWS_SESSION_TOKEN']
+            config = kwargs.get('config') or Config()
+            kwargs['config'] = config.merge(Config(s3={'addressing_style': 'path'}, request_checksum_calculation='when_required'))
+            return original(session, service_name, *args, **kwargs)
         kwargs['aws_access_key_id'] = 'FUFU_WORKLOAD'
         kwargs['aws_secret_access_key'] = 'fufu-transport-does-not-use-sigv4'
         kwargs['endpoint_url'] = 'http://fufu-api:8080'
@@ -219,5 +266,5 @@ def install():
         client.meta.events.register('before-call', call)
         return client
 
-    botocore.session.Session.create_client = create_client
+    session_module.Session.create_client = create_client
     _installed = True

fufu_cloud_cli-0.11.0/src/fufu_cloud_cli/s3_highlevel.py

@@ -0,0 +1,106 @@
+"""Native high-level S3 output; JSON callers use s3api."""
+import mimetypes
+import sys
+import time
+from datetime import datetime
+from pathlib import Path
+from urllib.parse import urlsplit
+
+from .api_backend import ApiClient
+from .cloud_data import s3_path
+from .errors import require
+from .object_transfer import download_file, upload_file
+
+
+def timestamp(value):
+    return datetime.fromisoformat(value.replace('Z', '+00:00')).astimezone().strftime('%Y-%m-%d %H:%M:%S')
+
+
+def size_text(size, human=False):
+    if not human: return str(size)
+    for unit in ['Bytes', 'KiB', 'MiB', 'GiB', 'TiB', 'PiB']:
+        if size < 1024 or unit == 'PiB': return f'{size:.1f} {unit}' if unit != 'Bytes' else f'{size} Bytes'
+        size /= 1024
+
+
+def list_pages(native, params):
+    params = dict(params); seen = set(); deadline = time.monotonic()+300
+    while True:
+        require(time.monotonic() < deadline, 'LIST_TIMEOUT', 'S3 清單超過五分鐘；請縮小 prefix。')
+        page = native('ListObjectsV2', params)
+        yield page
+        if not page.get('IsTruncated'): return
+        token = page.get('NextContinuationToken')
+        require(isinstance(token, str) and token and token not in seen, 'INVALID_PAGINATION', 'S3 分頁回應無效；未將部分清單視為完整結果。')
+        seen.add(token); params['ContinuationToken'] = token
+
+
+def command(argv, Parser):
+    parser = Parser(prog='aws-fufu s3', description='S3 ls、單檔 cp、mb/rb/rm；recursive 僅支援清單。同步、遞迴傳輸與跨 bucket copy 尚未支援。')
+    root = parser.add_subparsers(dest='action', required=True)
+    ls = root.add_parser('ls'); ls.add_argument('url', nargs='?')
+    ls.add_argument('--recursive', action='store_true'); ls.add_argument('--human-readable', action='store_true')
+    ls.add_argument('--summarize', action='store_true'); ls.add_argument('--no-paginate', action='store_true')
+    ls.add_argument('--page-size', type=int, default=1000)
+    for verb in ['mb', 'rb', 'rm', 'cp']:
+        p = root.add_parser(verb)
+        if verb == 'cp':
+            p.add_argument('source'); p.add_argument('destination'); p.add_argument('--content-type')
+            p.add_argument('--no-progress', action='store_true')
+        else: p.add_argument('url')
+        if verb in ['cp', 'rm']:
+            p.add_argument('--quiet', action='store_true'); p.add_argument('--only-show-errors', action='store_true')
+            p.add_argument('--dryrun', action='store_true')
+    args = parser.parse_args(argv)
+    if args.action == 'ls': require(1 <= args.page_size <= 1000, 'INVALID_INPUT', 'page-size 必須為 1 到 1000。')
+    downloading = args.action == 'cp' and args.source.startswith('s3://')
+    if args.action == 'cp':
+        require(downloading != args.destination.startswith('s3://'), 'CAPABILITY_NOT_SUPPORTED', 'cp 目前支援本機與 S3 單檔傳輸；跨 bucket copy 尚未支援。')
+    with ApiClient('aws', read_only=args.action == 'ls' or downloading or getattr(args, 'dryrun', False)) as api:
+        native = lambda op, params: api.request('POST', '/control/native', {'service': 's3', 'operation': op, 'params': params})
+        if args.action == 'ls' and not args.url:
+            for bucket in native('ListBuckets', {}).get('Buckets', []):
+                print(timestamp(bucket['CreationDate']) + ' ' + bucket['Name'])
+            return
+        url = args.source if downloading else args.destination if args.action == 'cp' else args.url
+        _, key = s3_path(url); bucket = urlsplit(url).netloc
+        if args.action == 'ls':
+            params = {'Bucket': bucket, 'Prefix': key, 'MaxKeys': args.page_size}
+            if not args.recursive: params['Delimiter'] = '/'
+            count = total = 0
+            for page in list_pages(native, params):
+                for prefix in page.get('CommonPrefixes', []): print(' '*27 + 'PRE ' + prefix['Prefix'].rstrip('/').rsplit('/', 1)[-1] + '/')
+                for obj in page.get('Contents', []):
+                    name = obj['Key'] if args.recursive else obj['Key'].rsplit('/', 1)[-1]
+                    print(f"{timestamp(obj['LastModified'])} {size_text(obj['Size'], args.human_readable):>10} {name}")
+                    count += 1; total += obj['Size']
+            if args.summarize: print(f'\nTotal Objects: {count}\n   Total Size: {size_text(total, args.human_readable)}')
+            return
+        quiet = getattr(args, 'quiet', False) or getattr(args, 'only_show_errors', False)
+        dryrun = getattr(args, 'dryrun', False)
+        message = ''
+        if args.action == 'cp':
+            if downloading:
+                require(bool(key), 'INVALID_RESOURCE', '下載必須指定 object key。')
+                destination = Path(args.destination)
+                if destination.is_dir(): destination /= key.rsplit('/', 1)[-1]
+                if not dryrun: download_file(api, destination, bucket, key, overwrite=True)
+                message = f'download: {args.source} to {destination}'
+            else:
+                require(Path(args.source).is_file(), 'INVALID_INPUT', '上傳來源必須是檔案。')
+                if not key or key.endswith('/'): key += Path(args.source).name
+                if not dryrun: upload_file(api, args.source, bucket, key, content_type=args.content_type or mimetypes.guess_type(args.source)[0] or 'application/octet-stream')
+                message = f'upload: {args.source} to s3://{bucket}/{key}'
+        elif args.action == 'rm':
+            require(bool(key), 'INVALID_RESOURCE', '刪除必須指定 object key；遞迴刪除尚未支援。')
+            if not dryrun: native('DeleteObject', {'Bucket': bucket, 'Key': key})
+            message = f'delete: {url}'
+        else:
+            require(not key, 'INVALID_RESOURCE', 'Bucket 操作不接受 object key。')
+            params = {'Bucket': bucket}
+            if args.action == 'mb':
+                region = api.whoami()['region']
+                if region != 'us-east-1': params['CreateBucketConfiguration'] = {'LocationConstraint': region}
+            native('CreateBucket' if args.action == 'mb' else 'DeleteBucket', params)
+            message = ('make_bucket: ' if args.action == 'mb' else 'remove_bucket: ') + bucket
+        if not quiet: sys.stdout.write(('(dryrun) ' if dryrun else '') + message + '\n')

fufu_cloud_cli-0.11.0/src/fufu_cloud_cli/usage.py

@@ -0,0 +1,48 @@
+"""FUFU metering is a platform extension, not an invented native AWS/GCP command."""
+import csv
+from datetime import datetime, timedelta, timezone
+import io
+import json
+import re
+
+from .api_backend import ApiClient
+from .errors import require
+
+
+def csv_report(report):
+    output = io.StringIO(newline='')
+    columns = ['month', 'timezone', 'billingStatus', 'resourceId', 'name', 'observationPercent',
+        'cpuEnergyPercentOfObservedRunning', 'unobservedSeconds', 'cpuPackageKwh', 'gpuKwh', 'wholeHostAttributedKwh',
+        'vcpuHours', 'cpuCoreHours', 'memoryGiBHours', 'diskGiBHours', 'gpuHours', 'costStatus', 'flags',
+        'costEstimatesJson', 'ratePlansJson', 'missingRates']
+    writer = csv.DictWriter(output, fieldnames=columns)
+    writer.writeheader()
+    for item in report['items']:
+        row = {**report, **item, **item['measures'], **item['coverage'], 'flags': ';'.join(item['flags'])}
+        row.update(costEstimatesJson=json.dumps(item.get('costs', {}), sort_keys=True),
+                   ratePlansJson=json.dumps(item.get('ratePlans', []), sort_keys=True),
+                   missingRates=';'.join(item.get('missingRates', [])))
+        # Blank means unknown; do not convert absent measurements into zero.
+        selected = {k: '' if row.get(k) is None else str(row[k]) for k in columns}
+        for key, value in selected.items():
+            if value.lstrip().startswith(('=', '+', '-', '@')):
+                selected[key] = "'" + value
+        writer.writerow(selected)
+    return output.getvalue()
+
+
+def command(argv, parser_class):
+    parser = parser_class(prog='fufu usage', description='逐台 VM 的月用量與電量分攤估算；不是正式帳單。')
+    sub = parser.add_subparsers(dest='action', required=True)
+    report = sub.add_parser('report')
+    report.add_argument('--provider', required=True, choices=['aws', 'gcp'])
+    # All supported months are 2000–2099, when Taipei uses fixed UTC+08:00.
+    report.add_argument('--month', default=datetime.now(timezone(timedelta(hours=8))).strftime('%Y-%m'), help='YYYY-MM；Asia/Taipei')
+    report.add_argument('--format', choices=['json', 'csv'], default='json')
+    args = parser.parse_args(argv)
+    require(bool(re.fullmatch(r'20\d{2}-(?:0[1-9]|1[0-2])', args.month)), 'INVALID_ARGUMENT', '月份必須是 YYYY-MM。')
+    with ApiClient(args.provider) as api:
+        value = api.request('GET', '/infrastructure/usage/monthly?month=' + args.month)
+    if args.format == 'csv':
+        return csv_report(value)
+    return value

fufu_cloud_cli-0.10.1/README.md → fufu_cloud_cli-0.11.0/src/fufu_cloud_cli.egg-info/PKG-INFO

@@ -1,9 +1,54 @@
+Metadata-Version: 2.4
+Name: fufu-cloud-cli
+Version: 0.11.0
+Summary: FUFU Cloud CLI for tenant-scoped mock cloud development and deployment
+License-Expression: LicenseRef-Proprietary
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: PyYAML==6.0.3
+Requires-Dist: jmespath==1.1.0
+Requires-Dist: tomli==2.2.1; python_version < "3.11"
+Provides-Extra: yaml
+Requires-Dist: PyYAML==6.0.3; extra == "yaml"
+Provides-Extra: test
+Requires-Dist: boto3==1.40.66; extra == "test"
+Provides-Extra: terraform
+Requires-Dist: python-hcl2==7.3.1; extra == "terraform"
+Provides-Extra: gcp
+Requires-Dist: google-cloud-bigquery==3.38.0; extra == "gcp"
+Requires-Dist: google-cloud-tasks==2.20.0; extra == "gcp"
+Requires-Dist: google-cloud-logging==3.12.1; extra == "gcp"
+Requires-Dist: google-cloud-storage==3.4.1; extra == "gcp"
+Dynamic: license-file
+
 # FUFU Cloud CLI
 
 以六個指令操作 FUFU Cloud 的租戶隔離開發環境：`fufu`、`aws-fufu`、
 `gcloud-fufu`、`az-fufu`、`wrangler-fufu`、`bq-fufu`。這是 AWS、Google Cloud、Azure 與 Cloudflare 的**明確子集**，
 只供 FUFU mock 環境使用；不會把部署轉送到正式雲端。
 
+0.11.0 新增獨占 GPU VM 的租用命令。需由平台啟用並驗證對應實體節點；
+支援的 RTX 3060 為整卡直通至 KVM 客體，可執行 NVIDIA 驅動與 CUDA。
+停止 VM 仍保留整卡，刪除後才釋放。GPU 使用中或已保留會明確拒絕，
+不會自動中斷其他工作。CLI 不包含節點 SSH 金鑰、主機裝置管理程式或平台設定。
+
+```bash
+gcloud-fufu compute instances create gpu-demo \
+  --zone=GPU_ZONE --machine-type=n1-standard-4 \
+  --accelerator=type=nvidia-geforce-rtx-3060,count=1 \
+  --maintenance-policy=TERMINATE
+gcloud-fufu compute ssh gpu-demo --zone=GPU_ZONE --command='nvidia-smi'
+gcloud-fufu compute instances delete gpu-demo --zone=GPU_ZONE
+
+aws-fufu ec2 run-instances --image-id=fufu-debian-12-gpu \
+  --instance-type=fufu.rtx3060.xlarge --placement=AvailabilityZone=GPU_ZONE
+```
+
+`GPU_ZONE` 使用平台 GPU 選單提供的區域。`nvidia-geforce-rtx-3060` 與
+`fufu.rtx3060.xlarge` 是 FUFU 的硬體擴充名稱；遷移到官方雲端時需改為官方
+提供的機型、加速器與區域。這不表示與官方 GPU 型號、HA、計費或 IAM 完全等價。
+
 0.10.1 新增官方 Terraform／OpenTofu／Pulumi 的 S3／GCS bucket 生命週期與
 S3 bucket tags。需配套 FUFU API；不支援 bucket versioning、retention、
 KMS、bucket IAM、GCS bucket labels 或 force destroy。
@@ -16,7 +61,7 @@ get-credentials／update-kubeconfig、waiter 與刪除。
 取得憑證後可使用標準 kubectl 部署 Deployment、Service、Job 及受管 GPU 容器。
 工作站需另安裝 kubectl；配套 Cloud Shell 已提供。
 
-VM 尚無公開 IP、複寫儲存、live migration 或自助 GPU passthrough；
+VM 尚無公開 IP、複寫儲存、live migration 或 GPU 熱插拔；
 叢集尚無 workload PVC、公開 LoadBalancer、互動式 exec／attach／port-forward。
 這批新 VM／cluster API 尚未支援官方 Terraform／OpenTofu／Pulumi provider。
 原有 firewall、global LB、Redis 等 typed configuration 仍明示 `MOCK ONLY`，
@@ -112,7 +157,7 @@ Python 預設識別而遇到 Cloudflare HTTP 403／1010。識別標頭不取代
 ## Cloudflare 前端部署與 R2
 
 ```bash
-pip install 'fufu-cloud-cli==0.10.1'
+pip install 'fufu-cloud-cli==0.11.0'
 export FUFU_CLOUDFLARE_CREDENTIAL_FILE=/run/secrets/fufu-cloudflare.json
 wrangler-fufu capabilities
 wrangler-fufu pages project create frontend --production-branch main

{fufu_cloud_cli-0.10.1 → fufu_cloud_cli-0.11.0}/src/fufu_cloud_cli.egg-info/SOURCES.txt

@@ -17,6 +17,7 @@ src/fufu_cloud_cli/cloudflare.py
 src/fufu_cloud_cli/control.py
 src/fufu_cloud_cli/docker_backend.py
 src/fufu_cloud_cli/errors.py
+src/fufu_cloud_cli/gateway_contract.py
 src/fufu_cloud_cli/gcloud_environment.py
 src/fufu_cloud_cli/gcloud_output.py
 src/fufu_cloud_cli/gcp_infra.py
@@ -36,8 +37,10 @@ src/fufu_cloud_cli/pulumi-endpoints.json
 src/fufu_cloud_cli/pulumi_bridge.py
 src/fufu_cloud_cli/remote_compute.py
 src/fufu_cloud_cli/runtime_sdk.py
+src/fufu_cloud_cli/s3_highlevel.py
 src/fufu_cloud_cli/secrets.py
 src/fufu_cloud_cli/serverless.py
+src/fufu_cloud_cli/usage.py
 src/fufu_cloud_cli.egg-info/PKG-INFO
 src/fufu_cloud_cli.egg-info/SOURCES.txt
 src/fufu_cloud_cli.egg-info/dependency_links.txt

{fufu_cloud_cli-0.10.1 → fufu_cloud_cli-0.11.0}/src/fufu_cloud_cli.egg-info/requires.txt

@@ -8,6 +8,7 @@ tomli==2.2.1
 google-cloud-bigquery==3.38.0
 google-cloud-tasks==2.20.0
 google-cloud-logging==3.12.1
+google-cloud-storage==3.4.1
 
 [terraform]
 python-hcl2==7.3.1