fufu-cloud-cli 0.9.6__tar.gz → 0.9.8__tar.gz

{fufu_cloud_cli-0.9.6/src/fufu_cloud_cli.egg-info → fufu_cloud_cli-0.9.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fufu-cloud-cli
-Version: 0.9.6
+Version: 0.9.8
 Summary: FUFU Cloud CLI for tenant-scoped mock cloud development and deployment
 License-Expression: LicenseRef-Proprietary
 Requires-Python: >=3.10
@@ -27,6 +27,41 @@ Dynamic: license-file
 `gcloud-fufu`、`az-fufu`、`wrangler-fufu`、`bq-fufu`。這是 AWS、Google Cloud、Azure 與 Cloudflare 的**明確子集**，
 只供 FUFU mock 環境使用；不會把部署轉送到正式雲端。
 
+2026-09-10 後續原始碼與 Cloud Shell 新增 GKE、firewall、五類 global LB 與 Redis
+配置命令，typed configuration 合計 22 類；都有 `MOCK ONLY` 提示、引用存在性與
+相依刪除檢查，不建立 Kubernetes、VM、Redis 或網路資料面，也未增加 IaC 資源。
+這批包含在 0.9.8；需要配套的 FUFU Console 與運算服務。
+
+0.9.8 提供 Cloud Run／Functions 的原生形式日誌查詢、CloudWatch Logs
+tail／follow，以及 `fufu observability` 的日誌、請求指標與追蹤查詢。
+公開套件包含完整的日誌指令模組；重複建立 CloudWatch log group 的
+`ResourceAlreadyExistsException` 會保留至 CLI 與 boto3 例外處理。
+配套服務端持久化收集 Cloud Run、Functions Gen 1／Gen 2、Lambda 的
+stdout／stderr 與例外堆疊。支援租戶隔離、IAM、敏感值遮罩、查詢分頁、
+request ID／trace 關聯及重啟恢復。GCP log names 清單、dry run、欄位存在
+查詢，以及 AWS 10,000 筆／1 MiB 寫入批次均有契約驗收。
+
+```bash
+gcloud-fufu run services logs read hello --limit=100 --log-filter='severity>=ERROR'
+gcloud-fufu functions logs read hello --gen2 --limit=100
+aws-fufu logs tail /aws/lambda/hello --since 1h --follow --fufu-duration 300
+fufu observability status --provider gcp
+fufu observability logs --provider aws --request-id REQUEST_ID --since 1h
+```
+
+請求 metrics／traces 是明示的 FUFU 擴充，沒有實作完整 Cloud Monitoring、
+CloudWatch Metrics、Trace 或 X-Ray。Log Router sinks、Logs Insights、
+subscriptions、alerts 及完整 OpenTelemetry collector 尚未支援。
+
+0.9.7 補齊 Lambda 五種 `wait` 指令、設定／程式碼更新的 `--revision-id`，
+以及常用設定的 `--cli-input-json` 和 `Variables={KEY=value}` shorthand。
+過期 RevisionId 回 `PreconditionFailedException`，保留原部署；CLI 仍等待
+部署完成才返回，waiter 有有限次數與失敗退出碼 255。程式碼雜湊、大小、
+最新修改時間與執行架構來自實際部署；預設記憶體為 128 MiB、期限 3 秒。
+需要配套 Console／compute worker 更新。JSON 只接受明列欄位，ZIP 另以
+`--zip-file fileb://...` 傳入；不支援 Code.S3Bucket、Layers、Image、版本
+或 aliases。Function URL 的無效 AWS 簽名與匿名呼叫回 403。
+
 0.9.6 新增 AWS Lambda Event／DryRun、configuration 更新、JMESPath `--query`、
 json／text／yaml 輸出、SQS FIFO／batch、SSM path／history、DynamoDB Binary
 及 CloudWatch Logs。需要配套後端；Event 202 只表示持久化接受，並非 handler
@@ -53,8 +88,9 @@ fufu infrastructure catalog
 ```
 
 BigQuery 是 tenant emulator 的 GoogleSQL 子集，無 DML／DDL、load/export、
-外部表與效能／費用等價。Logging 保留每租戶最新 10,000 筆，不自動收集所有
-容器 stdout。Tasks 每 queue 每秒最多 1 次、每租戶 2 個同時投遞；耗盡 task
+外部表與效能／費用等價。配套新版 Logging 預設每租戶 2 GiB；GCP 保留
+30 天，AWS 依 log group retention 設定，未設定時不自動到期。只收集已
+驗證歸屬的 FUFU 工作負載容器。Tasks 每 queue 每秒最多 1 次、每租戶 2 個同時投遞；耗盡 task
 留待檢查，與官方刪除策略不同。新的 dependency flow 不代表完整應用都能遷移。
 
 0.9.4 新增 GCS generation／metageneration 條件、`storage objects describe/update/list`、8 KiB 自訂 metadata 與二進位 `cat`。競爭寫入、過期條件、CLI metadata 和官方 gcloud 輸出欄位已對照驗收；不相符條件回傳 `PRECONDITION_FAILED`／HTTP 412。新功能需要同步更新 FUFU Console、GCS 儲存映像和 Cloud Shell。儲存升級前須停寫並備份完整 volume；新 metadata 格式可讀舊資料，回滾須還原升級前備份。
@@ -71,7 +107,7 @@ Python 預設識別而遇到 Cloudflare HTTP 403／1010。識別標頭不取代
 ## Cloudflare 前端部署與 R2
 
 ```bash
-pip install 'fufu-cloud-cli==0.9.6'
+pip install 'fufu-cloud-cli==0.9.8'
 export FUFU_CLOUDFLARE_CREDENTIAL_FILE=/run/secrets/fufu-cloudflare.json
 wrangler-fufu capabilities
 wrangler-fufu pages project create frontend --production-branch main

{fufu_cloud_cli-0.9.6 → fufu_cloud_cli-0.9.8}/README.md

@@ -4,6 +4,41 @@
 `gcloud-fufu`、`az-fufu`、`wrangler-fufu`、`bq-fufu`。這是 AWS、Google Cloud、Azure 與 Cloudflare 的**明確子集**，
 只供 FUFU mock 環境使用；不會把部署轉送到正式雲端。
 
+2026-09-10 後續原始碼與 Cloud Shell 新增 GKE、firewall、五類 global LB 與 Redis
+配置命令，typed configuration 合計 22 類；都有 `MOCK ONLY` 提示、引用存在性與
+相依刪除檢查，不建立 Kubernetes、VM、Redis 或網路資料面，也未增加 IaC 資源。
+這批包含在 0.9.8；需要配套的 FUFU Console 與運算服務。
+
+0.9.8 提供 Cloud Run／Functions 的原生形式日誌查詢、CloudWatch Logs
+tail／follow，以及 `fufu observability` 的日誌、請求指標與追蹤查詢。
+公開套件包含完整的日誌指令模組；重複建立 CloudWatch log group 的
+`ResourceAlreadyExistsException` 會保留至 CLI 與 boto3 例外處理。
+配套服務端持久化收集 Cloud Run、Functions Gen 1／Gen 2、Lambda 的
+stdout／stderr 與例外堆疊。支援租戶隔離、IAM、敏感值遮罩、查詢分頁、
+request ID／trace 關聯及重啟恢復。GCP log names 清單、dry run、欄位存在
+查詢，以及 AWS 10,000 筆／1 MiB 寫入批次均有契約驗收。
+
+```bash
+gcloud-fufu run services logs read hello --limit=100 --log-filter='severity>=ERROR'
+gcloud-fufu functions logs read hello --gen2 --limit=100
+aws-fufu logs tail /aws/lambda/hello --since 1h --follow --fufu-duration 300
+fufu observability status --provider gcp
+fufu observability logs --provider aws --request-id REQUEST_ID --since 1h
+```
+
+請求 metrics／traces 是明示的 FUFU 擴充，沒有實作完整 Cloud Monitoring、
+CloudWatch Metrics、Trace 或 X-Ray。Log Router sinks、Logs Insights、
+subscriptions、alerts 及完整 OpenTelemetry collector 尚未支援。
+
+0.9.7 補齊 Lambda 五種 `wait` 指令、設定／程式碼更新的 `--revision-id`，
+以及常用設定的 `--cli-input-json` 和 `Variables={KEY=value}` shorthand。
+過期 RevisionId 回 `PreconditionFailedException`，保留原部署；CLI 仍等待
+部署完成才返回，waiter 有有限次數與失敗退出碼 255。程式碼雜湊、大小、
+最新修改時間與執行架構來自實際部署；預設記憶體為 128 MiB、期限 3 秒。
+需要配套 Console／compute worker 更新。JSON 只接受明列欄位，ZIP 另以
+`--zip-file fileb://...` 傳入；不支援 Code.S3Bucket、Layers、Image、版本
+或 aliases。Function URL 的無效 AWS 簽名與匿名呼叫回 403。
+
 0.9.6 新增 AWS Lambda Event／DryRun、configuration 更新、JMESPath `--query`、
 json／text／yaml 輸出、SQS FIFO／batch、SSM path／history、DynamoDB Binary
 及 CloudWatch Logs。需要配套後端；Event 202 只表示持久化接受，並非 handler
@@ -30,8 +65,9 @@ fufu infrastructure catalog
 ```
 
 BigQuery 是 tenant emulator 的 GoogleSQL 子集，無 DML／DDL、load/export、
-外部表與效能／費用等價。Logging 保留每租戶最新 10,000 筆，不自動收集所有
-容器 stdout。Tasks 每 queue 每秒最多 1 次、每租戶 2 個同時投遞；耗盡 task
+外部表與效能／費用等價。配套新版 Logging 預設每租戶 2 GiB；GCP 保留
+30 天，AWS 依 log group retention 設定，未設定時不自動到期。只收集已
+驗證歸屬的 FUFU 工作負載容器。Tasks 每 queue 每秒最多 1 次、每租戶 2 個同時投遞；耗盡 task
 留待檢查，與官方刪除策略不同。新的 dependency flow 不代表完整應用都能遷移。
 
 0.9.4 新增 GCS generation／metageneration 條件、`storage objects describe/update/list`、8 KiB 自訂 metadata 與二進位 `cat`。競爭寫入、過期條件、CLI metadata 和官方 gcloud 輸出欄位已對照驗收；不相符條件回傳 `PRECONDITION_FAILED`／HTTP 412。新功能需要同步更新 FUFU Console、GCS 儲存映像和 Cloud Shell。儲存升級前須停寫並備份完整 volume；新 metadata 格式可讀舊資料，回滾須還原升級前備份。
@@ -48,7 +84,7 @@ Python 預設識別而遇到 Cloudflare HTTP 403／1010。識別標頭不取代
 ## Cloudflare 前端部署與 R2
 
 ```bash
-pip install 'fufu-cloud-cli==0.9.6'
+pip install 'fufu-cloud-cli==0.9.8'
 export FUFU_CLOUDFLARE_CREDENTIAL_FILE=/run/secrets/fufu-cloudflare.json
 wrangler-fufu capabilities
 wrangler-fufu pages project create frontend --production-branch main

{fufu_cloud_cli-0.9.6 → fufu_cloud_cli-0.9.8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "fufu-cloud-cli"
-version = "0.9.6"
+version = "0.9.8"
 description = "FUFU Cloud CLI for tenant-scoped mock cloud development and deployment"
 readme = "README.md"
 requires-python = ">=3.10"

{fufu_cloud_cli-0.9.6 → fufu_cloud_cli-0.9.8}/src/fufu_cloud_cli/__init__.py

@@ -1,3 +1,3 @@
 """FUFU CLI 與本機部署工具；相容範圍見 capabilities.json。"""
 
-__version__ = "0.9.6"
+__version__ = "0.9.8"

{fufu_cloud_cli-0.9.6 → fufu_cloud_cli-0.9.8}/src/fufu_cloud_cli/api_backend.py

@@ -184,6 +184,14 @@ class ApiClient:
                 return json.loads(raw)
         except HTTPError as exc:
             status = exc.code
+            if self.provider == 'aws' and '/compute/' in path and status in {400, 412}:
+                try:
+                    value = json.loads(exc.read(4096))
+                    code = value.get('error', {}).get('code') if isinstance(value, dict) and isinstance(value.get('error'), dict) else None
+                    if code in {'PreconditionFailedException', 'InvalidRequestContentException'}:
+                        raise FufuError(code, 'Lambda 操作遭拒；未輸出原始設定或錯誤內容。') from None
+                except (ValueError, OSError): pass
+                finally: exc.close()
             if self.provider == 'aws' and '/control/native' in path:
                 from .aws_errors import AWS_ERRORS
                 try:

{fufu_cloud_cli-0.9.6 → fufu_cloud_cli-0.9.8}/src/fufu_cloud_cli/aws_errors.py

@@ -1,5 +1,5 @@
 """Only documented provider error codes may cross the public transport boundary."""
-AWS_ERRORS = frozenset('''ConditionalCheckFailedException ResourceNotFoundException ResourceInUseException ValidationException
+AWS_ERRORS = frozenset('''ConditionalCheckFailedException ResourceNotFoundException ResourceInUseException ResourceAlreadyExistsException ValidationException
 NoSuchKey NoSuchBucket NotFound NotModified ParameterNotFound ParameterAlreadyExists ParameterVersionNotFound QueueDoesNotExist
 PreconditionFailed InvalidRange InvalidParameterException InvalidParameterValue InvalidAttributeName InvalidAttributeValue QueueNameExists
 PurgeQueueInProgress ReceiptHandleIsInvalid BatchEntryIdsNotDistinct EmptyBatchRequest BatchRequestTooLong InvalidBatchEntryId

fufu_cloud_cli-0.9.8/src/fufu_cloud_cli/aws_lambda.py

@@ -0,0 +1,125 @@
+"""Lambda command inputs and bounded AWS waiter semantics for the supported subset."""
+import json
+import re
+import time
+
+from .aws_output import configuration
+from .errors import FufuError, require
+
+
+WAITERS = {
+    'function-exists': ('describe', None, None, 1, 20),
+    'function-active': ('configuration', 'State', 'Active', 5, 60),
+    'function-active-v2': ('describe', 'State', 'Active', 1, 300),
+    'function-updated': ('configuration', 'LastUpdateStatus', 'Successful', 5, 60),
+    'function-updated-v2': ('describe', 'LastUpdateStatus', 'Successful', 1, 300),
+}
+
+
+def wait(backend, waiter, name):
+    method, field, success, delay, attempts = WAITERS[waiter]
+    deadline = time.monotonic() + delay * attempts
+    for attempt in range(attempts):
+        try:
+            value = configuration(getattr(backend, method)('aws-lambda-sync', name))
+        except FufuError as error:
+            if waiter != 'function-exists' or error.code not in {'NOT_FOUND', 'RESOURCE_NOT_FOUND', 'ResourceNotFoundException'}:
+                raise FufuError('WAITER_FAILED', '等待服務時查詢失敗；請確認權限與服務狀態。', 255) from None
+        else:
+            if field is None or value.get(field) == success: return
+            if value.get(field) == 'Failed':
+                raise FufuError('WAITER_FAILED', '服務回報失敗狀態；未達到等待條件。', 255)
+        remaining = deadline - time.monotonic()
+        if attempt + 1 == attempts or remaining <= 0: break
+        time.sleep(min(delay, remaining))
+    raise FufuError('WAITER_FAILED', '等待超過期限；服務操作可能仍在執行，請重新查詢。', 255)
+
+
+def environment(value):
+    """Native JSON or Variables={KEY=value,...}; malformed/ambiguous input fails closed."""
+    from .control import read_json
+    if value.startswith(('{', 'file://')):
+        return read_json(value)
+    require(value.startswith('Variables={') and value.endswith('}'), 'INVALID_INPUT',
+            'Environment 請使用 JSON、file:// JSON 或 Variables={KEY=value,...}。')
+    text = value[len('Variables={'):-1]
+    values = {}; position = 0
+    # Quotes and escaped commas are supported without shell execution or expansion.
+    pattern = re.compile(r'\s*([A-Za-z_][A-Za-z0-9_]*)\s*=\s*')
+    while position < len(text):
+        matched = pattern.match(text, position)
+        require(matched is not None, 'INVALID_INPUT', 'Environment shorthand 格式無效。')
+        key = matched[1]; position = matched.end(); chars = []; quote = None
+        require(key not in values, 'INVALID_INPUT', 'Environment 不可重複指定相同變數。')
+        if position < len(text) and text[position] in {'"', "'"}:
+            quote = text[position]; position += 1
+        closed = quote is None
+        while position < len(text):
+            character = text[position]; position += 1
+            if character == '\\':
+                require(position < len(text), 'INVALID_INPUT', 'Environment 跳脫序列未完成。')
+                chars.append(text[position]); position += 1
+            elif quote and character == quote:
+                closed = True
+                while position < len(text) and text[position].isspace(): position += 1
+                require(position == len(text) or text[position] == ',', 'INVALID_INPUT', 'Environment 引號後有多餘內容。')
+                if position < len(text): position += 1
+                break
+            elif not quote and character == ',': break
+            else:
+                require(quote is not None or character not in {'{', '}', '[', ']', '"', "'"},
+                        'UNSUPPORTED_ARGUMENT', '複雜 Environment 值請使用 JSON 或引號。')
+                chars.append(character)
+        require(closed, 'INVALID_INPUT', 'Environment 引號未關閉。')
+        values[key] = ''.join(chars) if quote else ''.join(chars).rstrip()
+        require(position != len(text) or not text.endswith(','), 'INVALID_INPUT', 'Environment 不可有結尾逗號。')
+    return {'Variables': values}
+
+
+FIELDS = {
+    'FunctionName': ('--function-name', str), 'Runtime': ('--runtime', str),
+    'Handler': ('--handler', str), 'Role': ('--role', str),
+    'Environment': ('--environment', dict), 'MemorySize': ('--memory-size', int),
+    'Timeout': ('--timeout', int), 'EphemeralStorage': ('--ephemeral-storage', dict),
+    'RevisionId': ('--revision-id', str), 'InvocationType': ('--invocation-type', str),
+    'Payload': ('--payload', str),
+}
+INPUTS = {
+    'create-function': {'FunctionName', 'Runtime', 'Handler', 'Role', 'Environment', 'MemorySize', 'Timeout', 'EphemeralStorage'},
+    'update-function-code': {'FunctionName', 'RevisionId'},
+    'update-function-configuration': {'FunctionName', 'Role', 'Environment', 'MemorySize', 'Timeout', 'EphemeralStorage', 'RevisionId'},
+    'get-function': {'FunctionName'}, 'get-function-configuration': {'FunctionName'},
+    'delete-function': {'FunctionName'}, 'invoke': {'FunctionName', 'InvocationType', 'Payload'},
+    'list-functions': set(),
+}
+
+
+def input_json(argv):
+    """Expand validated native JSON before argparse; explicit flags take precedence."""
+    from .control import read_json
+    if len(argv) < 2: return argv
+    rest = []; documents = []; index = 2
+    while index < len(argv):
+        flag, separator, value = argv[index].partition('=')
+        if flag == '--cli-input-json':
+            if not separator:
+                index += 1
+                require(index < len(argv), 'INVALID_INPUT', 'cli-input-json 缺少值。')
+                value = argv[index]
+            documents.append(value)
+        else: rest.append(argv[index])
+        index += 1
+    if not documents: return argv
+    require(len(documents) == 1 and argv[1] in INPUTS, 'UNSUPPORTED_ARGUMENT', '此操作不支援指定的 cli-input-json。')
+    value = read_json(documents[0])
+    require(isinstance(value, dict) and not value.keys() - INPUTS[argv[1]], 'UNSUPPORTED_ARGUMENT',
+            'Lambda JSON 含未支援的欄位；ZIP 請另用 --zip-file fileb:// 傳入，未執行操作。')
+    explicit = {arg.partition('=')[0] for arg in rest if arg.startswith('--')}
+    # FUFU memory alias selects the same official field.
+    if '--memory' in explicit: explicit.add('--memory-size')
+    expanded = []
+    for key, item in value.items():
+        flag, expected = FIELDS[key]
+        require(type(item) is expected, 'INVALID_INPUT', 'Lambda JSON 欄位型別無效。')
+        if flag not in explicit: expanded.extend([flag + '=' + (json.dumps(item) if expected is dict else str(item))])
+    return argv[:2] + expanded + rest

{fufu_cloud_cli-0.9.6 → fufu_cloud_cli-0.9.8}/src/fufu_cloud_cli/aws_output.py

@@ -1,6 +1,7 @@
 """AWS JMESPath and native text formatting over the supported response subset."""
 import io
 import json
+import base64
 
 import jmespath
 from jmespath.exceptions import JMESPathError
@@ -25,10 +26,17 @@ def configuration(value):
     fields = {'FunctionName': value.get('name'), 'FunctionArn': value.get('functionArn'),
               'Runtime': value.get('runtime'), 'Handler': value.get('handler'), 'Role': value.get('role'),
               'MemorySize': resources.get('memoryMiB'), 'Timeout': resources.get('timeoutSeconds'),
-              'RevisionId': value.get('revision'), 'LastModified': value.get('createdAt')}
+              'RevisionId': value.get('revision'), 'LastModified': value.get('lastModified', value.get('createdAt'))}
     result = {key: item for key, item in fields.items() if item is not None}
     if resources.get('tmpMiB') is not None: result['EphemeralStorage'] = {'Size': resources['tmpMiB']}
     if value.get('status') == 'running': result.update(State='Active', LastUpdateStatus='Successful')
+    if value.get('state'): result['State'] = value['state']
+    if value.get('lastUpdateStatus'): result['LastUpdateStatus'] = value['lastUpdateStatus']
+    result.update(Version='$LATEST', PackageType='Zip')
+    if value.get('architecture'): result['Architectures'] = [value['architecture']]
+    source = value.get('source', {})
+    if source.get('sha256'): result['CodeSha256'] = base64.b64encode(bytes.fromhex(source['sha256'])).decode()
+    if source.get('size') is not None: result['CodeSize'] = source['size']
     if 'env' in value: result['Environment'] = {'Variables': value['env']}
     result['Fufu'] = {key: value[key] for key in ['mode', 'backend', 'readiness', 'serviceId', 'publicAccess', 'iamEnforced'] if key in value}
     result['Fufu'].setdefault('mode', 'simplified')

{fufu_cloud_cli-0.9.6 → fufu_cloud_cli-0.9.8}/src/fufu_cloud_cli/capabilities.json

@@ -226,7 +226,8 @@
         "no-Entra-STS"
       ]
     },
-    "aws-cloudwatch-logs": {"status": "implemented", "backend": "api", "mode": "simplified", "operations": ["log-group-crud", "log-stream-crud", "put-get-filter-events", "retention-policy", "CLI-UI-boto3"], "limitations": ["no-automatic-stdout-collection", "simple-text-filters-only", "no-Insights-subscriptions-or-KMS", "no-guaranteed-retention-deletion", "service-page-tokens-no-CLI-auto-pagination"]},
+    "aws-cloudwatch-logs": {"status": "implemented", "backend": "api", "mode": "simplified", "operations": ["log-group-crud", "log-stream-crud", "put-get-filter-events", "retention-policy-expiry", "CLI-UI-boto3", "owned-Lambda-stdout-stderr", "logs-tail-follow", "SQLite-persistence", "signed-pagination", "credential-redaction"], "limitations": ["single-host-configurable-storage-capacity", "simple-text-filters-only", "no-Insights-subscriptions-or-KMS", "follow-default-300s-max-3600s", "service-page-tokens-except-tail-auto-pagination"]},
+    "fufu-observability": {"status": "implemented", "backend": "api", "mode": "simplified", "operations": ["logs", "request-metrics", "request-traces", "collector-status", "GCP-AWS-IAM", "structured-trace-links"], "limitations": ["explicit-FUFU-extension-not-native-Monitoring-CloudWatch-Trace-XRay-API", "gateway-request-duration-not-handler-or-billing-metrics", "no-automatic-SDK-spans-alerts-or-cross-service-trace-assembly", "plain-stdout-correlates-by-service-revision", "async-Lambda-logs-without-request-metrics", "single-host-no-HA"]},
     "aws-lambda-async": {"status": "implemented", "backend": "api", "mode": "simplified", "operations": ["invoke-Event", "invoke-DryRun", "CLI-UI-boto3-Invoke"], "limitations": ["1MiB-payload", "single-host-SQLite-two-dispatchers", "at-least-once", "two-handler-retries-60s-120s", "system-retries-up-to-6h", "no-destinations-or-DLQ", "no-AWS-scaling-or-managed-timeout-equivalence", "10000-events-or-512MiB-encoded-queue-per-tenant"]},
     "aws-cli-output": {"status": "implemented", "mode": "simplified", "operations": ["JMESPath-query", "json", "text", "yaml"], "limitations": ["no-table-or-yaml-stream", "no-full-CLI-auto-pagination", "Lambda-response-subset-no-Code-download"]},
     "aws-data-services": {
@@ -345,17 +346,21 @@
       "mode": "simplified",
       "operations": [
         "write-read",
-        "filter-AND-severity-timestamp-logName-resourceType",
+        "filter-AND-OR-NOT-structured-fields-severity-timestamp-trace-text",
         "logs-list-delete",
         "partialSuccess",
         "explicit-official-Python-REST-SDK",
-        "setup-logging"
+        "setup-logging",
+        "owned-CloudRun-Functions-stdout-stderr",
+        "run-services-logs-read",
+        "functions-logs-read-gen1-gen2",
+        "SQLite-persistence-retention-redaction"
       ],
       "limitations": [
-        "last-10000-entries-per-tenant",
-        "single-writer-128MiB-state-capacity",
-        "no-automatic-container-stdout",
-        "no-sinks-retention-metrics-alerts",
+        "single-host-configurable-storage-capacity-default-2GiB-per-tenant",
+        "default-30-day-log-retention",
+        "bounded-durable-spool-and-Docker-log-rotation",
+        "no-sinks-alerts-or-native-Monitoring-Trace-API",
         "no-new-IaC-resources"
       ]
     },
@@ -378,16 +383,30 @@
         "builds",
         "gemini-models",
         "vm-policies",
-        "eventarc-triggers"
+        "eventarc-triggers",
+        "gke-clusters",
+        "firewall-rules",
+        "health-checks",
+        "backend-services",
+        "url-maps",
+        "target-http-proxies",
+        "forwarding-rules",
+        "redis-instances"
       ],
       "operations": [
         "typed-crud",
         "three-locale-mobile-console",
-        "fufu-infrastructure-cli"
+        "fufu-infrastructure-cli",
+        "native-gcloud-command-subsets",
+        "same-tenant-reference-validation",
+        "referenced-resource-delete-conflict"
       ],
       "limitations": [
         "configuration-only",
-        "no-VM-SQL-network-DNS-build-registry-inference-runtime",
+        "no-VM-SQL-network-DNS-build-registry-inference-Kubernetes-Redis-LB-runtime",
+        "configuration-envelope-not-official-resource-JSON",
+        "LB-global-subset-regional-flags-rejected",
+        "no-complete-reference-use-permission-model",
         "no-new-IaC-resources"
       ]
     },
@@ -492,8 +511,11 @@
     },
     "gcp-memorystore": {
       "name": "Memorystore",
-      "status": "partial",
-      "reason": "工作區有 Redis 引擎；不提供 Memorystore 控制面。"
+      "status": "mock-only",
+      "backend": "api",
+      "mode": "mock-only",
+      "operations": ["typed-redis-configuration-crud", "network-reference-validation"],
+      "reason": "僅保存 Memorystore 配置；不建立 Redis process、endpoint、replication 或 persistence。工作區既有 Redis 引擎是獨立服務。"
     },
     "aws-elasticache": {
       "name": "ElastiCache",
@@ -522,8 +544,19 @@
     },
     "gcp-gke": {
       "name": "GKE",
-      "status": "unsupported",
-      "reason": "尚未實作可供 CLI 自動部署與驗證的服務契約。"
+      "status": "mock-only",
+      "backend": "api",
+      "mode": "mock-only",
+      "operations": ["typed-cluster-configuration-crud", "network-reference-validation"],
+      "reason": "僅保存叢集配置；無 Kubernetes API、nodes、kubectl、scheduler 或 workloads。"
+    },
+    "gcp-vpc": {
+      "name": "VPC / Firewall",
+      "status": "mock-only",
+      "backend": "api",
+      "mode": "mock-only",
+      "operations": ["network-subnet-connector-firewall-configuration-crud"],
+      "reason": "僅保存配置；規則不會過濾封包，沒有路由、位址配置或真實 VPC。"
     },
     "gcp-cloud-run-jobs": {
       "name": "Cloud Run Jobs",
@@ -592,12 +625,15 @@
     "gcp-cloud-logging-monitoring": {
       "name": "Cloud Logging / Monitoring",
       "status": "partial",
-      "reason": "gcp-logging 已提供可執行日誌子集；Monitoring、alerts、sinks 與完整 stdout 收集未支援。"
+      "reason": "Cloud Logging 已接持久化、工作負載 stdout／stderr、CLI 與 UI；請求 metrics／traces 為明示 FUFU 擴充。未實作官方 Monitoring／Cloud Trace API、alerts 或 sinks。"
     },
     "gcp-load-balancing-nat": {
       "name": "Cloud Load Balancing / NAT",
-      "status": "unsupported",
-      "reason": "尚未實作可供 CLI 自動部署與驗證的服務契約。"
+      "status": "mock-only",
+      "backend": "api",
+      "mode": "mock-only",
+      "operations": ["global-health-check-backend-url-map-http-proxy-forwarding-rule-configuration-crud"],
+      "reason": "LB 僅保存 global 配置相依鏈；沒有探測、IP、listener、TLS 或轉送。NAT 尚未支援。"
     },
     "aws-ec2": {
       "name": "EC2",
@@ -664,8 +700,8 @@
     },
     "aws-cloudwatch": {
       "name": "CloudWatch",
-      "status": "unsupported",
-      "reason": "尚未實作可供 CLI 自動部署與驗證的服務契約。"
+      "status": "partial",
+      "reason": "CloudWatch Logs 明列 API 子集、Lambda stdout／stderr、CLI tail、持久化與 retention 已接入；請求 metrics／traces 使用 FUFU 擴充，未實作官方 Metrics／X-Ray API 或 alarms。"
     },
     "aws-cloudfront": {
       "name": "CloudFront",