fufu-cloud-cli 0.8.0__tar.gz → 0.9.0__tar.gz

{fufu_cloud_cli-0.8.0/src/fufu_cloud_cli.egg-info → fufu_cloud_cli-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fufu-cloud-cli
-Version: 0.8.0
+Version: 0.9.0
 Summary: FUFU Cloud CLI for tenant-scoped mock cloud development and deployment
 License-Expression: LicenseRef-Proprietary
 Requires-Python: >=3.10
@@ -88,6 +88,13 @@ npx --no-install aws-fufu --help
 
 ## 憑證與 CI
 
+目前工作樹另提供 `fufu tofu`、`fufu pulumi`、`fufu state`。
+Terraform／OpenTofu 可選擇租戶遠端 HTTP state，具備鎖、加密、版本與
+復原；需配套 Console API 和平台金鑰。Pulumi 使用固定官方 Node.js SDK，
+已驗收 SQS、SSM String、Pub/Sub topic／pull subscription，採獨立本機
+DIY backend，秘密欄位需外部 passphrase。這些新能力尚未包含在已發布
+的 0.8.0，不能把套件安裝成功當成支援驗收。
+
 此工作樹也提供 `fufu terraform`：以官方 AWS／Google Terraform provider
 管理 Lambda ZIP、Cloud Run v2、IAM 與服務入口的明列子集，並使用獨立的
 FUFU state。Terraform 需另行安裝，Python 使用 `fufu-cloud-cli[terraform]`
@@ -96,6 +103,12 @@ GCS／S3、Functions Gen 1／Gen 2 等一般 CLI 能力
 不表示官方 Terraform 資源已相容。正式環境使用正常 Terraform、正式認證
 與獨立 state，不可直接搬用 FUFU state。
 
+後續開發版另接入 SQS queue、SSM String parameter、Pub/Sub topic／pull
+subscription；新增能力需要配套的 Console 與 Pub/Sub 後端更新，不能從
+已發布的 0.8.0 安裝成功就推定已具備。`gcloud-fufu pubsub` 提供建立、
+查詢、更新、刪除、publish／pull／ack 子集；不支援 push、ordering、
+exactly-once、Function trigger 或保留期限保證。
+
 向 FUFU Cloud 管理者取得該租戶、該 provider 的專用 credential JSON。
 CLI 不附預設帳號、共用金鑰或可用的租戶憑證，也不讀取 `.env`、瀏覽器
 Cookie 或正式雲端登入工作階段。
@@ -129,6 +142,32 @@ Lambda Function URL 的 AWS_IAM 支援長效 FUFU access key 的 SigV4 header si
 
 ## 部署與支援範圍
 
+0.9.0 的配套後端新增 AWS／GCP Secrets Manager、GCP 部署秘密參照、
+Cloud Run SSE／WebSocket、HTTP Functions SSE，以及目前運行版本的身分續期。
+服務端須配置私有加密金鑰；未配置時會明確拒絕秘密操作。
+
+```bash
+aws-fufu secretsmanager create-secret --name app-key --secret-string file://./dev-secret.txt
+aws-fufu secretsmanager get-secret-value --secret-id app-key --out-file ./private-result.txt
+gcloud-fufu secrets create app-key --data-file ./dev-secret.txt
+gcloud-fufu run deploy example --source ./prepared-asgi.zip \
+  --service-account "$WORKLOAD_SERVICE_ACCOUNT" --set-secrets APP_KEY=app-key:1
+```
+
+秘密值只由受控檔案或 `--secret-env VARIABLE` 輸入；讀取需指定私有新檔案，
+不會輸出到終端。Cloud Run／Functions 的 service account 需 Secret Accessor
+權限。支援 `--update-secrets`、`--clear-secrets` 和 Knative `secretKeyRef`。
+這是本機加密版本管理子集：AWS 為 UTF-8 SecretString，單值最大 64 KiB；
+無 KMS、rotation、跨區域複寫、排程刪除與復原。立即刪除或銷毀後，加密
+備份與既有容器可能仍持有舊值。CLI metadata 採 FUFU 共用形狀，並非完整
+官方 JSON；GCP runtime 使用明確 helper，無全量 Google SDK／ADC 替換。
+新的秘密資源與 Terraform／OpenTofu／Pulumi 參照尚未接通。
+
+Cloud Run 串流回應不設原本的 32 MiB 緩衝上限，仍受服務期限及容量限制。
+HTTP Functions Gen 1／Gen 2 支援 SSE、無 WebSocket；Gen 2 保留較寬鬆的
+32 MiB response，而官方 streaming response 是 10 MB。Lambda 仍為 buffered。
+公網 DNS、TLS、WAF 及 CDN 期限須另外驗證。
+
 ```bash
 fufu capabilities
 fufu capabilities --remote --provider gcp --require cloud-run-http

{fufu_cloud_cli-0.8.0 → fufu_cloud_cli-0.9.0}/README.md

@@ -70,6 +70,13 @@ npx --no-install aws-fufu --help
 
 ## 憑證與 CI
 
+目前工作樹另提供 `fufu tofu`、`fufu pulumi`、`fufu state`。
+Terraform／OpenTofu 可選擇租戶遠端 HTTP state，具備鎖、加密、版本與
+復原；需配套 Console API 和平台金鑰。Pulumi 使用固定官方 Node.js SDK，
+已驗收 SQS、SSM String、Pub/Sub topic／pull subscription，採獨立本機
+DIY backend，秘密欄位需外部 passphrase。這些新能力尚未包含在已發布
+的 0.8.0，不能把套件安裝成功當成支援驗收。
+
 此工作樹也提供 `fufu terraform`：以官方 AWS／Google Terraform provider
 管理 Lambda ZIP、Cloud Run v2、IAM 與服務入口的明列子集，並使用獨立的
 FUFU state。Terraform 需另行安裝，Python 使用 `fufu-cloud-cli[terraform]`
@@ -78,6 +85,12 @@ GCS／S3、Functions Gen 1／Gen 2 等一般 CLI 能力
 不表示官方 Terraform 資源已相容。正式環境使用正常 Terraform、正式認證
 與獨立 state，不可直接搬用 FUFU state。
 
+後續開發版另接入 SQS queue、SSM String parameter、Pub/Sub topic／pull
+subscription；新增能力需要配套的 Console 與 Pub/Sub 後端更新，不能從
+已發布的 0.8.0 安裝成功就推定已具備。`gcloud-fufu pubsub` 提供建立、
+查詢、更新、刪除、publish／pull／ack 子集；不支援 push、ordering、
+exactly-once、Function trigger 或保留期限保證。
+
 向 FUFU Cloud 管理者取得該租戶、該 provider 的專用 credential JSON。
 CLI 不附預設帳號、共用金鑰或可用的租戶憑證，也不讀取 `.env`、瀏覽器
 Cookie 或正式雲端登入工作階段。
@@ -111,6 +124,32 @@ Lambda Function URL 的 AWS_IAM 支援長效 FUFU access key 的 SigV4 header si
 
 ## 部署與支援範圍
 
+0.9.0 的配套後端新增 AWS／GCP Secrets Manager、GCP 部署秘密參照、
+Cloud Run SSE／WebSocket、HTTP Functions SSE，以及目前運行版本的身分續期。
+服務端須配置私有加密金鑰；未配置時會明確拒絕秘密操作。
+
+```bash
+aws-fufu secretsmanager create-secret --name app-key --secret-string file://./dev-secret.txt
+aws-fufu secretsmanager get-secret-value --secret-id app-key --out-file ./private-result.txt
+gcloud-fufu secrets create app-key --data-file ./dev-secret.txt
+gcloud-fufu run deploy example --source ./prepared-asgi.zip \
+  --service-account "$WORKLOAD_SERVICE_ACCOUNT" --set-secrets APP_KEY=app-key:1
+```
+
+秘密值只由受控檔案或 `--secret-env VARIABLE` 輸入；讀取需指定私有新檔案，
+不會輸出到終端。Cloud Run／Functions 的 service account 需 Secret Accessor
+權限。支援 `--update-secrets`、`--clear-secrets` 和 Knative `secretKeyRef`。
+這是本機加密版本管理子集：AWS 為 UTF-8 SecretString，單值最大 64 KiB；
+無 KMS、rotation、跨區域複寫、排程刪除與復原。立即刪除或銷毀後，加密
+備份與既有容器可能仍持有舊值。CLI metadata 採 FUFU 共用形狀，並非完整
+官方 JSON；GCP runtime 使用明確 helper，無全量 Google SDK／ADC 替換。
+新的秘密資源與 Terraform／OpenTofu／Pulumi 參照尚未接通。
+
+Cloud Run 串流回應不設原本的 32 MiB 緩衝上限，仍受服務期限及容量限制。
+HTTP Functions Gen 1／Gen 2 支援 SSE、無 WebSocket；Gen 2 保留較寬鬆的
+32 MiB response，而官方 streaming response 是 10 MB。Lambda 仍為 buffered。
+公網 DNS、TLS、WAF 及 CDN 期限須另外驗證。
+
 ```bash
 fufu capabilities
 fufu capabilities --remote --provider gcp --require cloud-run-http

{fufu_cloud_cli-0.8.0 → fufu_cloud_cli-0.9.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "fufu-cloud-cli"
-version = "0.8.0"
+version = "0.9.0"
 description = "FUFU Cloud CLI for tenant-scoped mock cloud development and deployment"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -28,4 +28,4 @@ wrangler-fufu = "fufu_cloud_cli.cli:wrangler_main"
 where = ["src"]
 
 [tool.setuptools.package-data]
-fufu_cloud_cli = ["capabilities.json", "runtime/*/Dockerfile", "runtime/ingress/proxy.py"]
+fufu_cloud_cli = ["capabilities.json", "pulumi-endpoints.json", "runtime/*/Dockerfile", "runtime/ingress/proxy.py"]

{fufu_cloud_cli-0.8.0 → fufu_cloud_cli-0.9.0}/src/fufu_cloud_cli/__init__.py

@@ -1,3 +1,3 @@
 """FUFU CLI 與本機部署工具；相容範圍見 capabilities.json。"""
 
-__version__ = "0.8.0"
+__version__ = "0.9.0"

{fufu_cloud_cli-0.8.0 → fufu_cloud_cli-0.9.0}/src/fufu_cloud_cli/api_backend.py

@@ -183,7 +183,7 @@ class ApiClient:
             raise FufuError("API_UNREACHABLE", "無法在時限內安全連線至 FUFU API。") from None
 
     def request(self, method, path, body=None):
-        return self._request(method, f"/api/cloud/{self.provider}" + path, body, large=path.startswith(('/compute/', '/s3/', '/storage/', '/control/native', '/sites')))
+        return self._request(method, f"/api/cloud/{self.provider}" + path, body, large=path.startswith(('/compute/', '/s3/', '/storage/', '/control/native', '/control/pubsub', '/sites')))
 
     def whoami(self):
         data = self._request("GET", "/api/auth/whoami")

{fufu_cloud_cli-0.8.0 → fufu_cloud_cli-0.9.0}/src/fufu_cloud_cli/capabilities.json

@@ -27,9 +27,23 @@
       "backend": "api",
       "compatibility": "official-provider-subset",
       "providers": { "hashicorp/aws": "6.63.0", "hashicorp/google": "8.1.0" },
-      "resources": ["aws_iam_role", "aws_iam_role_policy", "aws_lambda_function", "aws_lambda_function_url", "aws_lambda_permission", "google_service_account", "google_cloud_run_v2_service", "google_cloud_run_v2_service_iam_member"],
+      "resources": ["aws_iam_role", "aws_iam_role_policy", "aws_lambda_function", "aws_lambda_function_url", "aws_lambda_permission", "google_service_account", "google_cloud_run_v2_service", "google_cloud_run_v2_service_iam_member", "aws_sqs_queue", "aws_ssm_parameter", "google_pubsub_topic", "google_pubsub_subscription"],
       "operations": ["init", "plan", "saved-plan-apply", "refresh", "update", "import", "destroy"],
-      "limitations": ["Linux-amd64-verified", "terraform-extra-required", "root-default-providers-only", "independent-local-DEV-state", "no-remote-state-service", "no-full-cloud-IAM-or-runtime-equivalence", "no-Terraform-storage-or-Functions-Gen1-Gen2", "unsupported-APIs-and-fields-fail-explicitly"]
+      "engines": { "terraform": "1.16.1", "opentofu": "1.12.6" },
+      "state": ["isolated-local", "tenant-remote-http", "context-binding"],
+      "limitations": ["Linux-amd64-verified", "terraform-extra-required", "root-default-providers-only", "OpenTofu-data-resources-verified-compute-not-retested", "no-full-cloud-IAM-or-runtime-equivalence", "no-Terraform-storage-or-Functions-Gen1-Gen2", "PubSub-requires-patched-emulator", "unsupported-APIs-and-fields-fail-explicitly"]
+    },
+    "iac-remote-state": {
+      "status": "implemented", "backend": "api", "mode": "simplified",
+      "operations": ["http-backend", "atomic-lock", "encrypted-state", "history", "restore", "private-export", "delete-empty", "AWS-GCP-console"],
+      "limitations": ["key-file-required", "single-host-local-SQLite", "64MiB-per-state", "32-versions", "1000-state-list-limit", "no-lock-auto-expiry", "unrestricted-provider-credential-required", "no-terminal-or-role-sessions", "no-multi-host-HA", "no-Pulumi-remote-backend", "no-online-key-rotation"]
+    },
+    "pulumi-data": {
+      "status": "implemented", "backend": "api", "compatibility": "official-provider-subset",
+      "providers": { "pulumi": "3.261.0", "aws": "7.45.0", "gcp": "9.36.1" },
+      "resources": ["aws:sqs/queue:Queue", "aws:ssm/parameter:Parameter", "gcp:pubsub/topic:Topic", "gcp:pubsub/subscription:Subscription"],
+      "operations": ["preview", "up", "refresh", "update", "import", "destroy"],
+      "limitations": ["Node.js-runtime", "default-providers", "separate-local-DIY-state", "external-passphrase-required", "secret-fields-encrypted-not-whole-state", "no-remote-backend", "no-compute-resource-acceptance", "trusted-programs-only"]
     },
     "cloud-run-http": {
       "status": "implemented",
@@ -41,6 +55,9 @@
         "describe",
         "list",
         "invoke-http",
+        "SSE-streaming",
+        "WebSocket",
+        "secret-env-references",
         "delete"
       ],
       "limitations": [
@@ -99,7 +116,7 @@
         "no-async-Invoke",
         "remote-ZIP-50MiB-expanded-250MiB",
         "synchronous-payload-6MiB",
-        "workload-token-24h",
+        "workload-lease-24h-renewable-while-active",
         "per-revision-network"
       ],
       "backends": [
@@ -111,8 +128,8 @@
       "status": "implemented",
       "backend": "api",
       "mode": "simplified",
-      "operations": ["stable-service-https-url", "enable-disable", "service-invoker-policy", "cloud-run-ingress-annotation", "audience-bound-id-token", "lambda-function-url-config", "lambda-url-resource-policy", "aws-sigv4-header-auth"],
-      "limitations": ["operator-DNS-TLS-WAF-required", "Cloud-Run-and-HTTP-Functions-and-Lambda-only", "buffered-Lambda-6MiB-Gen1-10MiB-Run-Gen2-32MiB", "configured-service-timeout-up-to-900s-540s-3600s", "external-edge-timeouts-independent", "no-WebSocket-or-SSE", "no-STS-or-presigned-URL", "FUFU-ID-token-issuer-not-Google", "internal-means-platform-not-VPC", "6000-requests-per-minute-per-service-and-host-capacity", "no-custom-domain-or-CORS-management", "no-full-cloud-IAM-equivalence"]
+      "operations": ["stable-service-https-url", "enable-disable", "service-invoker-policy", "cloud-run-ingress-annotation", "audience-bound-id-token", "lambda-function-url-config", "lambda-url-resource-policy", "aws-sigv4-header-auth", "Cloud-Run-SSE-WebSocket", "Functions-Gen1-Gen2-SSE"],
+      "limitations": ["operator-DNS-TLS-WAF-required", "Cloud-Run-and-HTTP-Functions-and-Lambda-only", "buffered-Lambda-6MiB-Gen1-10MiB-Gen2-32MiB", "Cloud-Run-streaming-no-response-size-quota", "Gen2-streaming-more-generous-than-official-10MB", "configured-service-timeout-up-to-900s-540s-3600s", "external-edge-timeouts-independent", "no-Lambda-streaming-or-Functions-WebSocket", "no-STS-or-presigned-URL", "FUFU-ID-token-issuer-not-Google", "internal-means-platform-not-VPC", "6000-requests-per-minute-per-service-and-host-capacity", "no-custom-domain-or-CORS-management", "no-full-cloud-IAM-equivalence"]
     },
     "serverless-framework": {
       "status": "unsupported",
@@ -257,7 +274,13 @@
         "delete-queue",
         "send-message",
         "receive-message",
-        "delete-message"
+        "delete-message",
+        "get-queue-attributes",
+        "set-queue-attributes",
+        "list-queue-tags",
+        "tag-queue",
+        "untag-queue",
+        "terraform-lifecycle"
       ],
       "limitations": [
         "standard-queues",
@@ -266,6 +289,7 @@
         "receive-max-10",
         "fufu-QueueUrl",
         "no-FIFO",
+        "no-KMS-or-SQS-encryption",
         "manual-Lambda-drain-only",
         "no-background-poller"
       ]
@@ -277,7 +301,12 @@
         "put-parameter",
         "get-parameter",
         "get-parameters",
-        "delete-parameter"
+        "delete-parameter",
+        "describe-parameters-exact-name",
+        "list-tags-for-resource",
+        "add-tags-to-resource",
+        "remove-tags-from-resource",
+        "terraform-lifecycle"
       ],
       "limitations": [
         "String-only",
@@ -298,8 +327,11 @@
     },
     "gcp-pubsub": {
       "name": "Pub/Sub",
-      "status": "partial",
-      "reason": "已有 emulator 與 Console 檢視；尚未接入 CLI 部署或函式事件。"
+      "status": "implemented",
+      "backend": "api",
+      "mode": "simplified",
+      "operations": ["topic-crud", "pull-subscription-crud", "labels", "ack-deadline", "publish", "pull", "ack", "terraform-lifecycle"],
+      "limitations": ["patched-PubSub-emulator-required", "no-push", "no-ordering", "no-exactly-once", "no-Function-trigger", "no-retention-timing-guarantee", "no-Google-Python-SDK-injection"]
     },
     "gcp-cloud-tasks": {
       "name": "Cloud Tasks",
@@ -308,8 +340,9 @@
     },
     "gcp-secret-manager": {
       "name": "Secret Manager",
-      "status": "partial",
-      "reason": "已有 emulator 與 Console 檢視；CLI 未接入。"
+      "status": "implemented", "backend": "api", "mode": "simplified",
+      "operations": ["create-list-describe-delete", "version-add-list-access-enable-disable-destroy", "encrypted-at-rest", "IAM-project-bindings", "deployment-env-references", "explicit-runtime-helper", "AWS-GCP-console-three-locales"],
+      "limitations": ["private-key-file-required", "64KiB-payload", "same-project-env-only", "no-secret-volumes", "no-Google-ADC-SDK-injection", "no-per-secret-IAM", "no-KMS-rotation-replication", "immediate-logical-deletion-backups-may-retain-ciphertext", "common-FUFU-metadata-response", "new-IaC-secret-resources-not-integrated"]
     },
     "gcp-firebase-auth": {
       "name": "Firebase Authentication",
@@ -318,8 +351,9 @@
     },
     "aws-secrets-manager": {
       "name": "Secrets Manager",
-      "status": "partial",
-      "reason": "已有每租戶 LocalStack 與 Console 目錄；CLI 未接入。"
+      "status": "implemented", "backend": "api", "mode": "simplified",
+      "operations": ["create-list-describe-delete", "put-get-list-versions", "encrypted-at-rest", "boto3-runtime-reads", "IAM-action-resource-enforcement", "AWS-GCP-console-three-locales"],
+      "limitations": ["private-key-file-required", "64KiB-UTF8-SecretString", "no-SecretBinary", "AWSCURRENT-stage-only", "no-KMS-rotation-replication", "force-delete-no-recovery-window", "backups-may-retain-ciphertext", "common-FUFU-CLI-metadata-response", "no-cross-provider-workload-binding", "new-IaC-secret-resources-not-integrated"]
     },
     "aws-eventbridge-scheduler": {
       "name": "EventBridge Scheduler",

{fufu_cloud_cli-0.8.0 → fufu_cloud_cli-0.9.0}/src/fufu_cloud_cli/cli.py

@@ -122,6 +122,9 @@ def fufu_parser():
     c.add_argument('--remote', action='store_true')
     c.add_argument('--provider', choices=['aws', 'gcp', 'cloudflare'], default='gcp')
     sub.add_parser('terraform', help='官方 AWS / Google Terraform provider 的 FUFU 開發環境；使用獨立 state')
+    sub.add_parser('tofu', help='官方 OpenTofu；支援本機或遠端 FUFU state')
+    sub.add_parser('pulumi', help='官方 Pulumi Node.js SDK；使用獨立 FUFU 開發 state')
+    sub.add_parser('state', help='管理 Terraform／OpenTofu 遠端 state、版本與鎖')
     for action in ("plan", "deploy"):
         q = sub.add_parser(action)
         q.add_argument("--file", required=True)
@@ -198,10 +201,11 @@ def fufu_command(argv):
                 "images": available, "auth": "local-docker-permission", "remote_cloud": False}
     if a.action == "deploy":
         spec = manifest.load(a.file)
+        require(not spec.get('secret_references') or api_selected(), 'API_BACKEND_REQUIRED', 'Secret references 需要 FUFU API 模式。')
         configure_manifest(spec)
         spec["env"].update(env_from_names(a.env))
         return configure_manifest(spec, compute_backend('cloud-run-http').deploy(kind="cloud-run-http", service=spec["name"], image=spec["image"],
-                                port=spec["port"], env=spec["env"], startup_timeout=a.startup_timeout, resources={**spec.get('resources', {}), **resource_options(a, 'cloud-run-http')}, **({'role': spec['role']} if spec.get('role') else {})))
+                                port=spec["port"], env=spec["env"], startup_timeout=a.startup_timeout, resources={**spec.get('resources', {}), **resource_options(a, 'cloud-run-http')}, **({'secret_references': spec['secret_references']} if spec.get('secret_references') else {}), **({'role': spec['role']} if spec.get('role') else {})))
     if a.action == "down":
         require(not api_selected(), 'UNSUPPORTED_ARGUMENT', 'API 模式請逐一刪除指定服務；不提供整個租戶清空。')
         return Backend().down()
@@ -232,6 +236,8 @@ def gcloud_command(argv):
     d.add_argument('--entry-point', default='main:app', help='FUFU ASGI 來源子集，預設 main:app')
     d.add_argument("--port", type=int, default=8080)
     d.add_argument('--service-account')
+    secrets = d.add_mutually_exclusive_group()
+    secrets.add_argument('--set-secrets'); secrets.add_argument('--update-secrets'); secrets.add_argument('--clear-secrets', action='store_true')
     deployment_options(d)
     deployment_flags(d); run_iam_flags(d)
     services = run_sub.add_parser("services").add_subparsers(dest="service_action", required=True)
@@ -248,6 +254,8 @@ def gcloud_command(argv):
     d.add_argument("--runtime", choices=["python312"], required=True)
     d.add_argument("--entry-point", required=True)
     d.add_argument('--service-account')
+    secrets = d.add_mutually_exclusive_group()
+    secrets.add_argument('--set-secrets'); secrets.add_argument('--update-secrets'); secrets.add_argument('--clear-secrets', action='store_true')
     generation_options(d)
     d.add_argument("--trigger-http", required=True, action="store_true")
     deployment_options(d)
@@ -264,28 +272,34 @@ def gcloud_command(argv):
     action = a.service_action if a.action == "services" else a.action
     if action == "replace":
         spec = manifest.load(a.file)
+        require(not spec.get('secret_references') or api_selected(), 'API_BACKEND_REQUIRED', 'Secret references 需要 FUFU API 模式。')
         configure_manifest(spec)
         spec["env"].update(env_from_names(a.env))
         return configure_manifest(spec, compute_backend(kind).deploy(kind=kind, service=spec["name"], image=spec["image"], port=spec["port"],
-                                env=spec["env"], startup_timeout=a.startup_timeout, resources={**spec.get('resources', {}), **resource_options(a, kind)}, **({'role': spec['role']} if spec.get('role') else {})))
+                                env=spec["env"], startup_timeout=a.startup_timeout, resources={**spec.get('resources', {}), **resource_options(a, kind)}, **({'secret_references': spec['secret_references']} if spec.get('secret_references') else {}), **({'role': spec['role']} if spec.get('role') else {})))
     if action == "deploy":
         manifest.name(a.name)
         configuration(a, kind)
         finish = lambda deployed: configure_gcp(a, kind, a.name, deployed)
         env = env_from_names(a.env)
+        from .secrets import references
+        secret_options = {}
+        if a.set_secrets is not None or a.clear_secrets: secret_options['secret_references'] = references(a.set_secrets)
+        if a.update_secrets is not None: secret_options['secret_updates'] = references(a.update_secrets)
+        require(not secret_options or api_selected(), 'API_BACKEND_REQUIRED', 'Secret references 需要 FUFU API 模式。')
         if a.service == 'run' and a.source:
             require(api_selected(), 'API_BACKEND_REQUIRED', 'Cloud Run --source 自動核准需要 FUFU API 模式。')
             return finish(RemoteBackend(kind).deploy(kind=kind, service=a.name, env=env, port=a.port,
                 archive=cloud_run_archive(a.source), runtime='python312', handler=a.entry_point,
-                startup_timeout=a.startup_timeout, role=a.service_account, resources=resource_options(a, kind)))
+                startup_timeout=a.startup_timeout, role=a.service_account, resources=resource_options(a, kind), **secret_options))
         if a.service == 'run':
             require(a.entry_point == 'main:app', 'UNSUPPORTED_ARGUMENT', '--entry-point 只用於 --source。')
         if a.service == 'functions' and api_selected():
             return finish(RemoteBackend(kind).deploy(kind=kind, service=a.name, env=env,
-                archive=source_archive(a.source, kind), runtime=a.runtime, handler=a.entry_point, startup_timeout=a.startup_timeout, role=a.service_account, resources=resource_options(a, kind)))
+                archive=source_archive(a.source, kind), runtime=a.runtime, handler=a.entry_point, startup_timeout=a.startup_timeout, role=a.service_account, resources=resource_options(a, kind), **secret_options))
         image = a.image if a.service == "run" else build_function(a.source, a.entry_point)
         return finish(compute_backend(kind).deploy(kind=kind, service=a.name, image=image, port=getattr(a, "port", 8080),
-                                env=env, startup_timeout=a.startup_timeout, resources=resource_options(a, kind), **({'role': a.service_account} if a.service_account else {})))
+                                env=env, startup_timeout=a.startup_timeout, resources=resource_options(a, kind), **secret_options, **({'role': a.service_account} if a.service_account else {})))
     b = compute_backend(kind)
     if action == "describe":
         return b.describe(kind, a.name)
@@ -386,9 +400,15 @@ def entry(provider, argv=None):
             result = command(argv, Parser)
             if type(result) is int: raise SystemExit(result)
             emit(result); return
-        if provider == 'fufu' and argv[:1] == ['terraform']:
+        if provider == 'fufu' and argv[:1] in [['terraform'], ['tofu']]:
             from .terraform_bridge.runner import command
+            raise SystemExit(command(argv[1:], Parser, engine=argv[0]))
+        if provider == 'fufu' and argv[:1] == ['pulumi']:
+            from .pulumi_bridge import command
             raise SystemExit(command(argv[1:], Parser))
+        if provider == 'fufu' and argv[:1] == ['state']:
+            from .iac_state import command
+            emit(command(argv[1:], Parser)); return
         # Native global selectors are checked against the authenticated tenant scope.
         if provider in {'aws-fufu', 'gcloud-fufu'}:
             rest = []; i = 0
@@ -408,6 +428,9 @@ def entry(provider, argv=None):
                 else: rest.append(argv[i]); i += 1
             argv = rest
         from . import public_access
+        if provider == 'aws-fufu' and argv[:1] == ['secretsmanager'] or provider == 'gcloud-fufu' and argv[:1] == ['secrets']:
+            from .secrets import command
+            emit(command('aws' if provider == 'aws-fufu' else 'gcp', argv[1:], Parser)); return
         public_command = None
         if provider == 'aws-fufu' and len(argv) > 1 and argv[0] == 'lambda' and argv[1] in public_access.AWS_ACTIONS:
             public_command = public_access.aws_command
@@ -431,6 +454,9 @@ def entry(provider, argv=None):
         if provider == 'gcloud-fufu' and argv and argv[0] in {'iam', 'projects'}:
             from .control import gcp_command
             emit(gcp_command(argv, Parser)); return
+        if provider == 'gcloud-fufu' and argv and argv[0] == 'pubsub':
+            from .pubsub import command
+            emit(command(argv[1:], Parser)); return
         if provider == 'aws-fufu' and argv and argv[0] == 'apigatewayv2':
             from .control import gateway_command
             emit(gateway_command(argv[1:], Parser)); return

{fufu_cloud_cli-0.8.0 → fufu_cloud_cli-0.9.0}/src/fufu_cloud_cli/control.py

@@ -32,15 +32,18 @@ AWS_OPERATIONS = {
   'GetObject': 'Bucket Key ChecksumMode', 'HeadObject': 'Bucket Key ChecksumMode', 'DeleteObject': 'Bucket Key',
  },
  'sqs': {
-  'CreateQueue': 'QueueName Attributes', 'GetQueueUrl': 'QueueName', 'ListQueues': 'QueueNamePrefix MaxResults NextToken', 'DeleteQueue': 'QueueUrl',
+  'CreateQueue': 'QueueName Attributes tags', 'GetQueueUrl': 'QueueName', 'ListQueues': 'QueueNamePrefix MaxResults NextToken', 'DeleteQueue': 'QueueUrl',
+  'ListQueueTags': 'QueueUrl', 'TagQueue': 'QueueUrl Tags', 'UntagQueue': 'QueueUrl TagKeys',
   'GetQueueAttributes': 'QueueUrl AttributeNames', 'SetQueueAttributes': 'QueueUrl Attributes',
   'SendMessage': 'QueueUrl MessageBody DelaySeconds MessageAttributes', 'ReceiveMessage': 'QueueUrl MaxNumberOfMessages VisibilityTimeout WaitTimeSeconds MessageAttributeNames AttributeNames',
   'DeleteMessage': 'QueueUrl ReceiptHandle', 'ChangeMessageVisibility': 'QueueUrl ReceiptHandle VisibilityTimeout',
  },
- 'ssm': { 'PutParameter': 'Name Value Type Overwrite Description', 'GetParameter': 'Name WithDecryption', 'GetParameters': 'Names WithDecryption', 'DeleteParameter': 'Name' },
+ 'ssm': { 'PutParameter': 'Name Value Type Overwrite Description Tags', 'GetParameter': 'Name WithDecryption', 'GetParameters': 'Names WithDecryption', 'DeleteParameter': 'Name',
+          'DescribeParameters': 'ParameterFilters', 'ListTagsForResource': 'ResourceType ResourceId',
+          'AddTagsToResource': 'ResourceType ResourceId Tags', 'RemoveTagsFromResource': 'ResourceType ResourceId TagKeys' },
 }
-JSON_FIELDS = set('AssumeRolePolicyDocument PolicyDocument AttributeDefinitions KeySchema ProvisionedThroughput GlobalSecondaryIndexes LocalSecondaryIndexes StreamSpecification Item Key ExpressionAttributeNames ExpressionAttributeValues ExclusiveStartKey RequestItems CreateBucketConfiguration Metadata Attributes MessageAttributes'.split())
-LIST_FIELDS = set('ActionNames ResourceArns Names AttributeNames MessageAttributeNames'.split())
+JSON_FIELDS = set('AssumeRolePolicyDocument PolicyDocument AttributeDefinitions KeySchema ProvisionedThroughput GlobalSecondaryIndexes LocalSecondaryIndexes StreamSpecification Item Key ExpressionAttributeNames ExpressionAttributeValues ExclusiveStartKey RequestItems CreateBucketConfiguration Metadata Attributes MessageAttributes Tags tags ParameterFilters'.split())
+LIST_FIELDS = set('ActionNames ResourceArns Names AttributeNames MessageAttributeNames TagKeys'.split())
 BOOL_FIELDS = set('ConsistentRead ScanIndexForward WithDecryption Overwrite Enabled'.split())
 INT_FIELDS = set('Limit MaxKeys MaxResults MaxNumberOfMessages VisibilityTimeout WaitTimeSeconds DelaySeconds BatchSize'.split())
 
@@ -105,7 +108,7 @@ def command(argv, Parser):
         params.setdefault('Overwrite', False)
         params.setdefault('Type', 'String')
     if a.service == 'sqs' and 'QueueUrl' in params:
-        require(isinstance(params['QueueUrl'], str) and re.fullmatch(r'fufu://sqs/[A-Za-z0-9_-]{1,80}', params['QueueUrl']), 'INVALID_RESOURCE', 'QueueUrl 必須是 FUFU 租戶資源識別。')
+        require(isinstance(params['QueueUrl'], str) and re.fullmatch(r'(?:fufu://sqs/|https://sqs\.[a-z0-9-]+\.fufu\.invalid/[0-9]{12}/)[A-Za-z0-9_-]{1,80}', params['QueueUrl']), 'INVALID_RESOURCE', 'QueueUrl 必須是 FUFU 租戶資源識別。')
     with ApiClient('aws', read_only=bool(re.match(r'^(Get|List|Describe|Query|Scan|BatchGet|Simulate|Head)', a.native_operation))) as api:
         if a.service == 's3api' and a.native_operation == 'PutObject' and isinstance(params.get('Body'), Path):
             from .object_transfer import upload_file

{fufu_cloud_cli-0.8.0 → fufu_cloud_cli-0.9.0}/src/fufu_cloud_cli/docker_backend.py

@@ -239,17 +239,20 @@ class Backend:
     def public(self, r):
         return {"name": r["name"], "kind": r["kind"], "workspace": self.workspace,
                 "revision": r["revision"], "serviceId": self.service_id(r), "url": self.url(r), "readiness": "tcp",
-                **{k: r[k] for k in ("runtime", "handler", "role", "sdkTransport", "iamEnforced", "build", "resources") if k in r},
+                **{k: r[k] for k in ("runtime", "handler", "role", "sdkTransport", "iamEnforced", "build", "resources", "secretReferences") if k in r},
                 "status": "running", "backend": "local-docker"}
 
     def deploy(self, *, kind, service, image, port=8080, env=None, command=None,
                startup_timeout=30, replace=True, require_existing=False, runtime=None, handler=None, preserve_environment=False,
-               runtime_env=None, role=None, gateway_container=None, build=None, resources=None, source=None, image_reference=None, provider_options=None):
+               runtime_env=None, role=None, gateway_container=None, build=None, resources=None, source=None, image_reference=None, provider_options=None,
+               secret_env=None, secret_references=None):
         name(service)
         require(kind in KINDS, "UNSUPPORTED_SERVICE", "未支援此服務。")
         require(type(port) is int and 1024 <= port <= 65535, "INVALID_PORT", "無效的容器 port。")
         require(1 <= startup_timeout <= 240, "INVALID_TIMEOUT", "啟動期限須介於 1–240 秒。")
         env = environment(dict(env or {}))
+        secrets = environment(dict(secret_env or {}))
+        require(set(secrets) == set(secret_references or {}) and (not secrets or role), 'INVALID_SECRET_REFERENCE', 'Secret injection 需要對應參照與 workload role。')
         require(not role or (runtime_env and gateway_container), 'IAM_BACKEND_REQUIRED', 'IAM workload role 需要已配置的遠端 gateway；本機 Docker 模式不假裝執行 IAM。')
         image_id = inspect_image(image)
         ingress_image_id = inspect_image(INGRESS_IMAGE)
@@ -284,6 +287,8 @@ class Backend:
             revision = f"{service}-{uuid.uuid4().hex[:8]}"
             cname = f"fufu-cli-{self.scope}-{uuid.uuid4().hex[:12]}"
             supplied = dict(env)
+            require(not set(env).intersection(secrets), 'INVALID_SECRET_REFERENCE', '秘密與一般環境變數名稱衝突。')
+            supplied.update(secrets)
             supplied.update(runtime_env or {})
             supplied["AWS_EC2_METADATA_DISABLED"] = "true"
             if kind == "aws-lambda-sync":
@@ -317,6 +322,7 @@ class Backend:
                           **({'source': source} if source else {}),
                           **({'imageReference': image_reference} if image_reference else {}),
                           'providerOptions': provider_options or {},
+                          **({'secretReferences': secret_references} if secret_references else {}),
                           "environment_names": sorted(env),
                           **({"runtime": runtime, "handler": handler} if runtime is not None else {})}
                 deadline = time.monotonic() + startup_timeout
@@ -420,6 +426,20 @@ class Backend:
                     'source': record.get('source', {}), 'providerOptions': record.get('providerOptions', {}),
                     '_imageId': current['image'], '_build': record.get('build')}
 
+    def workload_active(self, kind, service, token_hash):
+        """Confirm the lease belongs to the currently running revision, without returning its environment."""
+        import hmac
+        require(isinstance(token_hash, str) and re.fullmatch(r'[a-f0-9]{64}', token_hash), 'INVALID_REQUEST', 'Workload hash 無效。')
+        name(service)
+        with self.locked():
+            record = self.read_state()['services'].get(f'{kind}:{service}')
+            if not record or not record.get('role'): return False
+            self.url(record)
+            values = object_json(docker('container', 'inspect', record['container_id'], '--format', '{{json .Config.Env}}'))
+            env = dict(item.split('=', 1) for item in values if '=' in item)
+            token = env.get('FUFU_WORKLOAD_TOKEN', '')
+            return bool(token) and hmac.compare_digest(hashlib.sha256(token.encode()).hexdigest(), token_hash)
+
     def listing(self, kind=None):
         with self.locked():
             return [self.public(r) for r in self.read_state()["services"].values() if kind is None or r["kind"] == kind]

fufu_cloud_cli-0.9.0/src/fufu_cloud_cli/iac_state.py

@@ -0,0 +1,61 @@
+"""Tenant-scoped remote Terraform/OpenTofu state administration."""
+import json
+import os
+from pathlib import Path
+import uuid
+
+from .api_backend import ApiClient
+from .errors import FufuError, require
+from .terraform_bridge.remote_state import request, state_name
+
+
+def call(api, method, suffix='', body=None, *, missing=False):
+    status, data = request(api, method, suffix, body)
+    if missing and status == 404: return None
+    require(200 <= status < 300, 'STATE_REQUEST_REJECTED',
+            'State 請求被拒絕（HTTP ' + str(status) + '）；請確認 scope、鎖與目前版本。')
+    return json.loads(data) if data else {}
+
+
+def command(argv, Parser):
+    parser = Parser(prog='fufu state', description='AWS／GCP 的 Terraform、OpenTofu 遠端 state；預設只輸出 metadata。')
+    parser.add_argument('--provider', choices=['aws', 'gcp'], default='aws')
+    sub = parser.add_subparsers(dest='action', required=True)
+    sub.add_parser('list')
+    for action in ['history', 'export', 'restore', 'unlock', 'delete-empty']:
+        entry = sub.add_parser(action)
+        entry.add_argument('name', type=state_name)
+        if action == 'export': entry.add_argument('--output', type=Path, required=True)
+        if action == 'restore': entry.add_argument('--version', type=int, required=True)
+        if action == 'unlock': entry.add_argument('--lock-id', required=True)
+        if action in {'restore', 'unlock', 'delete-empty'}: entry.add_argument('--yes', action='store_true', required=True)
+    args = parser.parse_args(argv)
+    with ApiClient(args.provider, read_only=args.action in {'list', 'history', 'export'}) as api:
+        if args.action == 'list': return call(api, 'GET')
+        suffix = '/' + args.name
+        if args.action == 'history': return call(api, 'GET', suffix + '/history')
+        if args.action == 'export':
+            state = call(api, 'GET', suffix)
+            target = args.output.absolute()
+            require(target.parent.is_dir() and not target.is_symlink(), 'INVALID_STATE_OUTPUT', '請使用已存在的安全目錄與新的輸出檔案。')
+            try: fd = os.open(target, os.O_CREAT | os.O_EXCL | os.O_WRONLY | os.O_NOFOLLOW, 0o600)
+            except FileExistsError: raise FufuError('STATE_OUTPUT_EXISTS', '輸出檔已存在；不會覆寫既有備份。') from None
+            try:
+                with os.fdopen(fd, 'w') as stream:
+                    json.dump(state, stream); stream.write('\n'); stream.flush(); os.fsync(stream.fileno())
+            except BaseException: target.unlink(missing_ok=True); raise
+            return {'exported': True, 'serial': state['serial'], 'sensitiveFile': True}
+        if args.action == 'unlock':
+            call(api, 'UNLOCK', suffix + '/lock', {'ID': args.lock_id})
+            return {'unlocked': True}
+        lock_id = str(uuid.uuid4())
+        call(api, 'LOCK', suffix + '/lock', {'ID': lock_id, 'Operation': 'StateMaintenance'})
+        try:
+            if args.action == 'restore':
+                require(args.version >= 1, 'INVALID_STATE_VERSION', '版本必須是正整數。')
+                call(api, 'POST', suffix + '/restore', {'id': lock_id, 'version': args.version})
+                return {'restored': True, 'nextStep': 'Run refresh and plan; restoring state does not roll back cloud resources.'}
+            call(api, 'DELETE', suffix + '?ID=' + lock_id)
+            return {'deleted': True}
+        finally:
+            call(api, 'UNLOCK', suffix + '/lock', {'ID': lock_id})

{fufu_cloud_cli-0.8.0 → fufu_cloud_cli-0.9.0}/src/fufu_cloud_cli/manifest.py

@@ -122,16 +122,23 @@ def parse(d):
     p = fields(ports[0], {"containerPort"}, "ports")
     port = p.get("containerPort")
     require(type(port) is int and 1024 <= port <= 65535, "INVALID_PORT", "本機容器 port 範圍為 1024–65535。")
-    env = {}
+    env, secrets = {}, {}
     items = c.get("env", [])
     require(isinstance(items, list), "INVALID_ENV", "env 必須是陣列。")
     for item in items:
-        fields(item, {"name", "value"}, "env")
+        fields(item, {"name", "value", "valueFrom"}, "env")
         k = item.get("name")
-        require(isinstance(k, str) and k not in env, "INVALID_ENV", "環境變數名稱重複或無效。")
-        env[k] = item.get("value")
+        require(isinstance(k, str) and k not in env and k not in secrets, "INVALID_ENV", "環境變數名稱重複或無效。")
+        if 'valueFrom' in item:
+            require('value' not in item, 'INVALID_ENV', 'Secret reference 不能同時配置 value。')
+            ref = fields(fields(item['valueFrom'], {'secretKeyRef'}, 'valueFrom').get('secretKeyRef'), {'name', 'key'}, 'secretKeyRef')
+            require(isinstance(ref.get('name'), str) and re.fullmatch(r'[A-Za-z0-9_-]{1,255}', ref['name'])
+                    and re.fullmatch(r'latest|[1-9][0-9]*', str(ref.get('key', ''))), 'INVALID_SECRET_REFERENCE', 'Secret reference 必須是同專案秘密與有效版本。')
+            secrets[k] = {'name': ref['name'], 'version': str(ref['key'])}
+            environment({k: ''})
+        else: env[k] = item.get("value")
     environment(env)
-    return {"name": service, "image": image, "port": port, "env": env, **({'resources': allocation} if allocation else {}), **({'role': role} if role else {}), **({'publicAccess': access} if access else {})}
+    return {"name": service, "image": image, "port": port, "env": env, **({'secret_references': secrets} if secrets else {}), **({'resources': allocation} if allocation else {}), **({'role': role} if role else {}), **({'publicAccess': access} if access else {})}
 
 
 def public_plan(spec):