fufu-cloud-cli 0.9.7__tar.gz → 0.10.0__tar.gz

{fufu_cloud_cli-0.9.7/src/fufu_cloud_cli.egg-info → fufu_cloud_cli-0.10.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fufu-cloud-cli
-Version: 0.9.7
+Version: 0.10.0
 Summary: FUFU Cloud CLI for tenant-scoped mock cloud development and deployment
 License-Expression: LicenseRef-Proprietary
 Requires-Python: >=3.10
@@ -27,6 +27,55 @@ Dynamic: license-file
 `gcloud-fufu`、`az-fufu`、`wrangler-fufu`、`bq-fufu`。這是 AWS、Google Cloud、Azure 與 Cloudflare 的**明確子集**，
 只供 FUFU mock 環境使用；不會把部署轉送到正式雲端。
 
+0.10.0 新增 Compute Engine／EC2 VM 與 GKE／EKS 介面的實際運算命令。
+需要啟用相應 infrastructure backend 的 FUFU 服務端；VM 使用 KVM／KubeVirt，
+叢集使用獨立 Kubernetes API 與共用節點，均不是官方雲端資源。
+支援 VM 建立、SSH 指令、停止／啟動與刪除，以及叢集建立、查詢、
+get-credentials／update-kubeconfig、waiter 與刪除。
+取得憑證後可使用標準 kubectl 部署 Deployment、Service、Job 及受管 GPU 容器。
+工作站需另安裝 kubectl；配套 Cloud Shell 已提供。
+
+VM 尚無公開 IP、複寫儲存、live migration 或自助 GPU passthrough；
+叢集尚無 workload PVC、公開 LoadBalancer、互動式 exec／attach／port-forward。
+這批新 VM／cluster API 尚未支援官方 Terraform／OpenTofu／Pulumi provider。
+原有 firewall、global LB、Redis 等 typed configuration 仍明示 `MOCK ONLY`，
+不代表已建立相應網路或 Redis 資料面。
+
+```bash
+gcloud-fufu compute instances create demo-vm --image-family=debian-12
+gcloud-fufu compute ssh demo-vm --command='uname -s; nproc'
+gcloud-fufu container clusters create demo-gke
+gcloud-fufu container clusters get-credentials demo-gke
+kubectl get pods -A
+aws-fufu eks create-cluster --name demo-eks
+aws-fufu eks wait cluster-active --name demo-eks
+aws-fufu eks update-kubeconfig --name demo-eks
+```
+
+這些操作需要 FUFU credential；不使用官方雲端金鑰。資源以租戶隔離，配額不足
+會明確回覆 RESOURCE_EXHAUSTED。測試後請刪除所建 VM／cluster 以釋放資源。
+
+0.9.8 提供 Cloud Run／Functions 的原生形式日誌查詢、CloudWatch Logs
+tail／follow，以及 `fufu observability` 的日誌、請求指標與追蹤查詢。
+公開套件包含完整的日誌指令模組；重複建立 CloudWatch log group 的
+`ResourceAlreadyExistsException` 會保留至 CLI 與 boto3 例外處理。
+配套服務端持久化收集 Cloud Run、Functions Gen 1／Gen 2、Lambda 的
+stdout／stderr 與例外堆疊。支援租戶隔離、IAM、敏感值遮罩、查詢分頁、
+request ID／trace 關聯及重啟恢復。GCP log names 清單、dry run、欄位存在
+查詢，以及 AWS 10,000 筆／1 MiB 寫入批次均有契約驗收。
+
+```bash
+gcloud-fufu run services logs read hello --limit=100 --log-filter='severity>=ERROR'
+gcloud-fufu functions logs read hello --gen2 --limit=100
+aws-fufu logs tail /aws/lambda/hello --since 1h --follow --fufu-duration 300
+fufu observability status --provider gcp
+fufu observability logs --provider aws --request-id REQUEST_ID --since 1h
+```
+
+請求 metrics／traces 是明示的 FUFU 擴充，沒有實作完整 Cloud Monitoring、
+CloudWatch Metrics、Trace 或 X-Ray。Log Router sinks、Logs Insights、
+subscriptions、alerts 及完整 OpenTelemetry collector 尚未支援。
+
 0.9.7 補齊 Lambda 五種 `wait` 指令、設定／程式碼更新的 `--revision-id`，
 以及常用設定的 `--cli-input-json` 和 `Variables={KEY=value}` shorthand。
 過期 RevisionId 回 `PreconditionFailedException`，保留原部署；CLI 仍等待
@@ -47,9 +96,10 @@ insertAll／SELECT 與持久化日誌。`fufu_cloud_cli.gcp_sdk` 提供官方 Py
 BigQuery、Cloud Tasks、Logging SDK 的明確 REST factory；可用 `[gcp]` extra
 安裝已驗收相依。需要對應的新後端，並非透明 ADC 或所有 Google SDK 替換。
 
-`fufu infrastructure` 提供 14 類 typed configuration mock。Compute Engine、
-Cloud SQL、App Engine、DNS、VPC、Artifact Registry、Cloud Build、Gemini、
-VM Manager、Eventarc 等設定不會啟動 VM／SQL／registry／網路／推論。
+`fufu infrastructure` 另保留 typed configuration mock 目錄，包含 Cloud SQL、
+App Engine、DNS、VPC、Artifact Registry、Cloud Build、Gemini、VM Manager、
+Eventarc 等。這個目錄只保存配置，不啟動 SQL／registry／網路／推論；
+實際 VM／Kubernetes 請使用上述 compute／ec2／container／eks 指令。
 UI 顯示僅設定，CLI stderr 保留 MOCK ONLY，不因輸出投影而隱藏。
 新服務尚未接入 Terraform／OpenTofu／Pulumi；單機背景投遞不是雲端 HA。
 
@@ -62,8 +112,9 @@ fufu infrastructure catalog
 ```
 
 BigQuery 是 tenant emulator 的 GoogleSQL 子集，無 DML／DDL、load/export、
-外部表與效能／費用等價。Logging 保留每租戶最新 10,000 筆，不自動收集所有
-容器 stdout。Tasks 每 queue 每秒最多 1 次、每租戶 2 個同時投遞；耗盡 task
+外部表與效能／費用等價。配套新版 Logging 預設每租戶 2 GiB；GCP 保留
+30 天，AWS 依 log group retention 設定，未設定時不自動到期。只收集已
+驗證歸屬的 FUFU 工作負載容器。Tasks 每 queue 每秒最多 1 次、每租戶 2 個同時投遞；耗盡 task
 留待檢查，與官方刪除策略不同。新的 dependency flow 不代表完整應用都能遷移。
 
 0.9.4 新增 GCS generation／metageneration 條件、`storage objects describe/update/list`、8 KiB 自訂 metadata 與二進位 `cat`。競爭寫入、過期條件、CLI metadata 和官方 gcloud 輸出欄位已對照驗收；不相符條件回傳 `PRECONDITION_FAILED`／HTTP 412。新功能需要同步更新 FUFU Console、GCS 儲存映像和 Cloud Shell。儲存升級前須停寫並備份完整 volume；新 metadata 格式可讀舊資料，回滾須還原升級前備份。
@@ -80,7 +131,7 @@ Python 預設識別而遇到 Cloudflare HTTP 403／1010。識別標頭不取代
 ## Cloudflare 前端部署與 R2
 
 ```bash
-pip install 'fufu-cloud-cli==0.9.7'
+pip install 'fufu-cloud-cli==0.10.0'
 export FUFU_CLOUDFLARE_CREDENTIAL_FILE=/run/secrets/fufu-cloudflare.json
 wrangler-fufu capabilities
 wrangler-fufu pages project create frontend --production-branch main

{fufu_cloud_cli-0.9.7 → fufu_cloud_cli-0.10.0}/README.md

@@ -4,6 +4,55 @@
 `gcloud-fufu`、`az-fufu`、`wrangler-fufu`、`bq-fufu`。這是 AWS、Google Cloud、Azure 與 Cloudflare 的**明確子集**，
 只供 FUFU mock 環境使用；不會把部署轉送到正式雲端。
 
+0.10.0 新增 Compute Engine／EC2 VM 與 GKE／EKS 介面的實際運算命令。
+需要啟用相應 infrastructure backend 的 FUFU 服務端；VM 使用 KVM／KubeVirt，
+叢集使用獨立 Kubernetes API 與共用節點，均不是官方雲端資源。
+支援 VM 建立、SSH 指令、停止／啟動與刪除，以及叢集建立、查詢、
+get-credentials／update-kubeconfig、waiter 與刪除。
+取得憑證後可使用標準 kubectl 部署 Deployment、Service、Job 及受管 GPU 容器。
+工作站需另安裝 kubectl；配套 Cloud Shell 已提供。
+
+VM 尚無公開 IP、複寫儲存、live migration 或自助 GPU passthrough；
+叢集尚無 workload PVC、公開 LoadBalancer、互動式 exec／attach／port-forward。
+這批新 VM／cluster API 尚未支援官方 Terraform／OpenTofu／Pulumi provider。
+原有 firewall、global LB、Redis 等 typed configuration 仍明示 `MOCK ONLY`，
+不代表已建立相應網路或 Redis 資料面。
+
+```bash
+gcloud-fufu compute instances create demo-vm --image-family=debian-12
+gcloud-fufu compute ssh demo-vm --command='uname -s; nproc'
+gcloud-fufu container clusters create demo-gke
+gcloud-fufu container clusters get-credentials demo-gke
+kubectl get pods -A
+aws-fufu eks create-cluster --name demo-eks
+aws-fufu eks wait cluster-active --name demo-eks
+aws-fufu eks update-kubeconfig --name demo-eks
+```
+
+這些操作需要 FUFU credential；不使用官方雲端金鑰。資源以租戶隔離，配額不足
+會明確回覆 RESOURCE_EXHAUSTED。測試後請刪除所建 VM／cluster 以釋放資源。
+
+0.9.8 提供 Cloud Run／Functions 的原生形式日誌查詢、CloudWatch Logs
+tail／follow，以及 `fufu observability` 的日誌、請求指標與追蹤查詢。
+公開套件包含完整的日誌指令模組；重複建立 CloudWatch log group 的
+`ResourceAlreadyExistsException` 會保留至 CLI 與 boto3 例外處理。
+配套服務端持久化收集 Cloud Run、Functions Gen 1／Gen 2、Lambda 的
+stdout／stderr 與例外堆疊。支援租戶隔離、IAM、敏感值遮罩、查詢分頁、
+request ID／trace 關聯及重啟恢復。GCP log names 清單、dry run、欄位存在
+查詢，以及 AWS 10,000 筆／1 MiB 寫入批次均有契約驗收。
+
+```bash
+gcloud-fufu run services logs read hello --limit=100 --log-filter='severity>=ERROR'
+gcloud-fufu functions logs read hello --gen2 --limit=100
+aws-fufu logs tail /aws/lambda/hello --since 1h --follow --fufu-duration 300
+fufu observability status --provider gcp
+fufu observability logs --provider aws --request-id REQUEST_ID --since 1h
+```
+
+請求 metrics／traces 是明示的 FUFU 擴充，沒有實作完整 Cloud Monitoring、
+CloudWatch Metrics、Trace 或 X-Ray。Log Router sinks、Logs Insights、
+subscriptions、alerts 及完整 OpenTelemetry collector 尚未支援。
+
 0.9.7 補齊 Lambda 五種 `wait` 指令、設定／程式碼更新的 `--revision-id`，
 以及常用設定的 `--cli-input-json` 和 `Variables={KEY=value}` shorthand。
 過期 RevisionId 回 `PreconditionFailedException`，保留原部署；CLI 仍等待
@@ -24,9 +73,10 @@ insertAll／SELECT 與持久化日誌。`fufu_cloud_cli.gcp_sdk` 提供官方 Py
 BigQuery、Cloud Tasks、Logging SDK 的明確 REST factory；可用 `[gcp]` extra
 安裝已驗收相依。需要對應的新後端，並非透明 ADC 或所有 Google SDK 替換。
 
-`fufu infrastructure` 提供 14 類 typed configuration mock。Compute Engine、
-Cloud SQL、App Engine、DNS、VPC、Artifact Registry、Cloud Build、Gemini、
-VM Manager、Eventarc 等設定不會啟動 VM／SQL／registry／網路／推論。
+`fufu infrastructure` 另保留 typed configuration mock 目錄，包含 Cloud SQL、
+App Engine、DNS、VPC、Artifact Registry、Cloud Build、Gemini、VM Manager、
+Eventarc 等。這個目錄只保存配置，不啟動 SQL／registry／網路／推論；
+實際 VM／Kubernetes 請使用上述 compute／ec2／container／eks 指令。
 UI 顯示僅設定，CLI stderr 保留 MOCK ONLY，不因輸出投影而隱藏。
 新服務尚未接入 Terraform／OpenTofu／Pulumi；單機背景投遞不是雲端 HA。
 
@@ -39,8 +89,9 @@ fufu infrastructure catalog
 ```
 
 BigQuery 是 tenant emulator 的 GoogleSQL 子集，無 DML／DDL、load/export、
-外部表與效能／費用等價。Logging 保留每租戶最新 10,000 筆，不自動收集所有
-容器 stdout。Tasks 每 queue 每秒最多 1 次、每租戶 2 個同時投遞；耗盡 task
+外部表與效能／費用等價。配套新版 Logging 預設每租戶 2 GiB；GCP 保留
+30 天，AWS 依 log group retention 設定，未設定時不自動到期。只收集已
+驗證歸屬的 FUFU 工作負載容器。Tasks 每 queue 每秒最多 1 次、每租戶 2 個同時投遞；耗盡 task
 留待檢查，與官方刪除策略不同。新的 dependency flow 不代表完整應用都能遷移。
 
 0.9.4 新增 GCS generation／metageneration 條件、`storage objects describe/update/list`、8 KiB 自訂 metadata 與二進位 `cat`。競爭寫入、過期條件、CLI metadata 和官方 gcloud 輸出欄位已對照驗收；不相符條件回傳 `PRECONDITION_FAILED`／HTTP 412。新功能需要同步更新 FUFU Console、GCS 儲存映像和 Cloud Shell。儲存升級前須停寫並備份完整 volume；新 metadata 格式可讀舊資料，回滾須還原升級前備份。
@@ -57,7 +108,7 @@ Python 預設識別而遇到 Cloudflare HTTP 403／1010。識別標頭不取代
 ## Cloudflare 前端部署與 R2
 
 ```bash
-pip install 'fufu-cloud-cli==0.9.7'
+pip install 'fufu-cloud-cli==0.10.0'
 export FUFU_CLOUDFLARE_CREDENTIAL_FILE=/run/secrets/fufu-cloudflare.json
 wrangler-fufu capabilities
 wrangler-fufu pages project create frontend --production-branch main

{fufu_cloud_cli-0.9.7 → fufu_cloud_cli-0.10.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "fufu-cloud-cli"
-version = "0.9.7"
+version = "0.10.0"
 description = "FUFU Cloud CLI for tenant-scoped mock cloud development and deployment"
 readme = "README.md"
 requires-python = ">=3.10"

{fufu_cloud_cli-0.9.7 → fufu_cloud_cli-0.10.0}/src/fufu_cloud_cli/__init__.py

@@ -1,3 +1,3 @@
 """FUFU CLI 與本機部署工具；相容範圍見 capabilities.json。"""
 
-__version__ = "0.9.7"
+__version__ = "0.10.0"

{fufu_cloud_cli-0.9.7 → fufu_cloud_cli-0.10.0}/src/fufu_cloud_cli/api_backend.py

@@ -184,6 +184,13 @@ class ApiClient:
                 return json.loads(raw)
         except HTTPError as exc:
             status = exc.code
+            if '/infrastructure/' in path and status == 429:
+                try:
+                    value = json.loads(exc.read(4096))
+                    if isinstance(value, dict) and value.get('code') == 'RESOURCE_EXHAUSTED':
+                        raise FufuError('RESOURCE_EXHAUSTED', 'FUFU 租戶資源配額或主機容量已滿；請刪除不需要的資源，或調整平台資源配額後再重試。') from None
+                except (ValueError, OSError): pass
+                finally: exc.close()
             if self.provider == 'aws' and '/compute/' in path and status in {400, 412}:
                 try:
                     value = json.loads(exc.read(4096))

{fufu_cloud_cli-0.9.7 → fufu_cloud_cli-0.10.0}/src/fufu_cloud_cli/aws_errors.py

@@ -1,5 +1,5 @@
 """Only documented provider error codes may cross the public transport boundary."""
-AWS_ERRORS = frozenset('''ConditionalCheckFailedException ResourceNotFoundException ResourceInUseException ValidationException
+AWS_ERRORS = frozenset('''ConditionalCheckFailedException ResourceNotFoundException ResourceInUseException ResourceAlreadyExistsException ValidationException
 NoSuchKey NoSuchBucket NotFound NotModified ParameterNotFound ParameterAlreadyExists ParameterVersionNotFound QueueDoesNotExist
 PreconditionFailed InvalidRange InvalidParameterException InvalidParameterValue InvalidAttributeName InvalidAttributeValue QueueNameExists
 PurgeQueueInProgress ReceiptHandleIsInvalid BatchEntryIdsNotDistinct EmptyBatchRequest BatchRequestTooLong InvalidBatchEntryId

{fufu_cloud_cli-0.9.7 → fufu_cloud_cli-0.10.0}/src/fufu_cloud_cli/capabilities.json

@@ -226,7 +226,8 @@
         "no-Entra-STS"
       ]
     },
-    "aws-cloudwatch-logs": {"status": "implemented", "backend": "api", "mode": "simplified", "operations": ["log-group-crud", "log-stream-crud", "put-get-filter-events", "retention-policy", "CLI-UI-boto3"], "limitations": ["no-automatic-stdout-collection", "simple-text-filters-only", "no-Insights-subscriptions-or-KMS", "no-guaranteed-retention-deletion", "service-page-tokens-no-CLI-auto-pagination"]},
+    "aws-cloudwatch-logs": {"status": "implemented", "backend": "api", "mode": "simplified", "operations": ["log-group-crud", "log-stream-crud", "put-get-filter-events", "retention-policy-expiry", "CLI-UI-boto3", "owned-Lambda-stdout-stderr", "logs-tail-follow", "SQLite-persistence", "signed-pagination", "credential-redaction"], "limitations": ["single-host-configurable-storage-capacity", "simple-text-filters-only", "no-Insights-subscriptions-or-KMS", "follow-default-300s-max-3600s", "service-page-tokens-except-tail-auto-pagination"]},
+    "fufu-observability": {"status": "implemented", "backend": "api", "mode": "simplified", "operations": ["logs", "request-metrics", "request-traces", "collector-status", "GCP-AWS-IAM", "structured-trace-links"], "limitations": ["explicit-FUFU-extension-not-native-Monitoring-CloudWatch-Trace-XRay-API", "gateway-request-duration-not-handler-or-billing-metrics", "no-automatic-SDK-spans-alerts-or-cross-service-trace-assembly", "plain-stdout-correlates-by-service-revision", "async-Lambda-logs-without-request-metrics", "single-host-no-HA"]},
     "aws-lambda-async": {"status": "implemented", "backend": "api", "mode": "simplified", "operations": ["invoke-Event", "invoke-DryRun", "CLI-UI-boto3-Invoke"], "limitations": ["1MiB-payload", "single-host-SQLite-two-dispatchers", "at-least-once", "two-handler-retries-60s-120s", "system-retries-up-to-6h", "no-destinations-or-DLQ", "no-AWS-scaling-or-managed-timeout-equivalence", "10000-events-or-512MiB-encoded-queue-per-tenant"]},
     "aws-cli-output": {"status": "implemented", "mode": "simplified", "operations": ["JMESPath-query", "json", "text", "yaml"], "limitations": ["no-table-or-yaml-stream", "no-full-CLI-auto-pagination", "Lambda-response-subset-no-Code-download"]},
     "aws-data-services": {
@@ -345,17 +346,21 @@
       "mode": "simplified",
       "operations": [
         "write-read",
-        "filter-AND-severity-timestamp-logName-resourceType",
+        "filter-AND-OR-NOT-structured-fields-severity-timestamp-trace-text",
         "logs-list-delete",
         "partialSuccess",
         "explicit-official-Python-REST-SDK",
-        "setup-logging"
+        "setup-logging",
+        "owned-CloudRun-Functions-stdout-stderr",
+        "run-services-logs-read",
+        "functions-logs-read-gen1-gen2",
+        "SQLite-persistence-retention-redaction"
       ],
       "limitations": [
-        "last-10000-entries-per-tenant",
-        "single-writer-128MiB-state-capacity",
-        "no-automatic-container-stdout",
-        "no-sinks-retention-metrics-alerts",
+        "single-host-configurable-storage-capacity-default-2GiB-per-tenant",
+        "default-30-day-log-retention",
+        "bounded-durable-spool-and-Docker-log-rotation",
+        "no-sinks-alerts-or-native-Monitoring-Trace-API",
         "no-new-IaC-resources"
       ]
     },
@@ -378,16 +383,30 @@
         "builds",
         "gemini-models",
         "vm-policies",
-        "eventarc-triggers"
+        "eventarc-triggers",
+        "gke-clusters",
+        "firewall-rules",
+        "health-checks",
+        "backend-services",
+        "url-maps",
+        "target-http-proxies",
+        "forwarding-rules",
+        "redis-instances"
       ],
       "operations": [
         "typed-crud",
         "three-locale-mobile-console",
-        "fufu-infrastructure-cli"
+        "fufu-infrastructure-cli",
+        "native-gcloud-command-subsets",
+        "same-tenant-reference-validation",
+        "referenced-resource-delete-conflict"
       ],
       "limitations": [
         "configuration-only",
-        "no-VM-SQL-network-DNS-build-registry-inference-runtime",
+        "no-VM-SQL-network-DNS-build-registry-inference-Kubernetes-Redis-LB-runtime",
+        "configuration-envelope-not-official-resource-JSON",
+        "LB-global-subset-regional-flags-rejected",
+        "no-complete-reference-use-permission-model",
         "no-new-IaC-resources"
       ]
     },
@@ -492,8 +511,11 @@
     },
     "gcp-memorystore": {
       "name": "Memorystore",
-      "status": "partial",
-      "reason": "工作區有 Redis 引擎；不提供 Memorystore 控制面。"
+      "status": "mock-only",
+      "backend": "api",
+      "mode": "mock-only",
+      "operations": ["typed-redis-configuration-crud", "network-reference-validation"],
+      "reason": "僅保存 Memorystore 配置；不建立 Redis process、endpoint、replication 或 persistence。工作區既有 Redis 引擎是獨立服務。"
     },
     "aws-elasticache": {
       "name": "ElastiCache",
@@ -512,18 +534,31 @@
     },
     "gcp-compute-engine": {
       "name": "Compute Engine",
-      "status": "mock-only",
+      "status": "implemented",
       "backend": "api",
-      "mode": "mock-only",
+      "mode": "simplified",
       "operations": [
-        "typed-instance-configuration-crud"
+        "create-list-describe-delete", "stop-start", "guest-ssh-command"
       ],
-      "reason": "僅保存設定；無 VM、disk、SSH、guest OS 或 hypervisor。"
+      "limitations": ["requires-FUFU-infrastructure-backend", "Debian-12-only", "private-network", "single-node-disk", "no-self-service-GPU-passthrough", "no-official-IaC-provider"],
+      "reason": "實際 KVM／KubeVirt VM、持久磁碟與 SSH 指令；原生風格指令子集，無官方雲端資源。"
     },
     "gcp-gke": {
       "name": "GKE",
-      "status": "unsupported",
-      "reason": "尚未實作可供 CLI 自動部署與驗證的服務契約。"
+      "status": "implemented",
+      "backend": "api",
+      "mode": "simplified",
+      "operations": ["create-list-describe-delete", "get-credentials", "kubectl-workloads", "GPU-container-jobs"],
+      "limitations": ["requires-FUFU-infrastructure-backend", "shared-workers", "single-control-plane-replica", "no-workload-PVC", "no-public-LoadBalancer", "no-interactive-exec-or-portforward", "no-official-IaC-provider"],
+      "reason": "獨立 vCluster Kubernetes API 與控制面資料；共用受管節點，支援標準 kubectl 工作負載子集。"
+    },
+    "gcp-vpc": {
+      "name": "VPC / Firewall",
+      "status": "mock-only",
+      "backend": "api",
+      "mode": "mock-only",
+      "operations": ["network-subnet-connector-firewall-configuration-crud"],
+      "reason": "僅保存配置；規則不會過濾封包，沒有路由、位址配置或真實 VPC。"
     },
     "gcp-cloud-run-jobs": {
       "name": "Cloud Run Jobs",
@@ -592,17 +627,24 @@
     "gcp-cloud-logging-monitoring": {
       "name": "Cloud Logging / Monitoring",
       "status": "partial",
-      "reason": "gcp-logging 已提供可執行日誌子集；Monitoring、alerts、sinks 與完整 stdout 收集未支援。"
+      "reason": "Cloud Logging 已接持久化、工作負載 stdout／stderr、CLI 與 UI；請求 metrics／traces 為明示 FUFU 擴充。未實作官方 Monitoring／Cloud Trace API、alerts 或 sinks。"
     },
     "gcp-load-balancing-nat": {
       "name": "Cloud Load Balancing / NAT",
-      "status": "unsupported",
-      "reason": "尚未實作可供 CLI 自動部署與驗證的服務契約。"
+      "status": "mock-only",
+      "backend": "api",
+      "mode": "mock-only",
+      "operations": ["global-health-check-backend-url-map-http-proxy-forwarding-rule-configuration-crud"],
+      "reason": "LB 僅保存 global 配置相依鏈；沒有探測、IP、listener、TLS 或轉送。NAT 尚未支援。"
     },
     "aws-ec2": {
       "name": "EC2",
-      "status": "mock-only",
-      "reason": "明示 mock 目錄；VM 未執行，不能列為成功部署。"
+      "status": "implemented",
+      "backend": "api",
+      "mode": "simplified",
+      "operations": ["run-describe-terminate-instances", "stop-start", "instance-waiters"],
+      "limitations": ["requires-FUFU-infrastructure-backend", "Debian-12-only", "private-network", "single-node-disk", "no-self-service-GPU-passthrough", "no-official-IaC-provider"],
+      "reason": "實際 KVM／KubeVirt VM；支援生命週期與 scoped instance ID，無官方 EC2 網路或完整 API。"
     },
     "aws-ecs": {
       "name": "ECS / Fargate",
@@ -611,8 +653,12 @@
     },
     "aws-eks": {
       "name": "EKS",
-      "status": "unsupported",
-      "reason": "尚未實作可供 CLI 自動部署與驗證的服務契約。"
+      "status": "implemented",
+      "backend": "api",
+      "mode": "simplified",
+      "operations": ["create-list-describe-delete", "update-kubeconfig", "cluster-waiters", "kubectl-workloads", "GPU-container-jobs"],
+      "limitations": ["requires-FUFU-infrastructure-backend", "shared-workers", "single-control-plane-replica", "no-workload-PVC", "no-public-LoadBalancer", "no-interactive-exec-or-portforward", "no-official-IaC-provider"],
+      "reason": "獨立 vCluster Kubernetes API 與控制面資料；FUFU 短效認證，不是 AWS 原生 IAM 或託管控制面。"
     },
     "aws-app-runner": {
       "name": "App Runner",
@@ -664,8 +710,8 @@
     },
     "aws-cloudwatch": {
       "name": "CloudWatch",
-      "status": "unsupported",
-      "reason": "尚未實作可供 CLI 自動部署與驗證的服務契約。"
+      "status": "partial",
+      "reason": "CloudWatch Logs 明列 API 子集、Lambda stdout／stderr、CLI tail、持久化與 retention 已接入；請求 metrics／traces 使用 FUFU 擴充，未實作官方 Metrics／X-Ray API 或 alarms。"
     },
     "aws-cloudfront": {
       "name": "CloudFront",

{fufu_cloud_cli-0.9.7 → fufu_cloud_cli-0.10.0}/src/fufu_cloud_cli/cli.py

@@ -104,6 +104,7 @@ def fufu_parser():
     p = Parser(prog="fufu", description="FUFU 租戶認證、遠端部署與本機 Docker；所有輸出均為 FUFU 子集契約。")
     p.add_argument("--version", action="version", version=__version__)
     sub = p.add_subparsers(dest="action", required=True)
+    sub.add_parser('observability', help='FUFU 擴充：日誌、請求指標、trace 與收集狀態；使用 observability --help')
     auth = sub.add_parser("auth", help="驗證 CLI credential，顯示目前租戶與 scope").add_subparsers(dest="auth_action", required=True)
     identity = auth.add_parser("whoami")
     identity.add_argument("--provider", choices=["aws", "gcp", "azure", "cloudflare"])
@@ -495,7 +496,7 @@ def entry(provider, argv=None):
             p.add_argument('--quiet', '-q', action='store_true', help='非互動執行')
             p.add_argument('--version', action='store_true', help='CLI 版本')
             groups = p.add_subparsers(title='服務')
-            for group in ['run', 'functions', 'iam', 'projects', 'pubsub', 'secrets', 'storage', 'auth', 'scheduler', 'tasks', 'logging', 'compute', 'sql', 'artifacts', 'dns', 'eventarc']: groups.add_parser(group)
+            for group in ['run', 'functions', 'iam', 'projects', 'pubsub', 'secrets', 'storage', 'auth', 'scheduler', 'tasks', 'logging', 'compute', 'sql', 'artifacts', 'dns', 'eventarc', 'container', 'redis']: groups.add_parser(group)
             p.print_help(); return
         if provider == 'bq-fufu':
             from .bigquery import command
@@ -517,12 +518,20 @@ def entry(provider, argv=None):
         if provider == 'fufu' and argv[:1] == ['infrastructure']:
             from .gcp_infra import configuration_command
             emit(configuration_command(argv[1:], Parser)); return
+        if provider == 'fufu' and argv[:1] == ['kubernetes-token']:
+            from .infrastructure import token_command
+            emit(token_command(argv[1:], Parser)); return
         # Native global selectors are checked against the authenticated tenant scope.
         if provider in {'aws-fufu', 'gcloud-fufu'}:
-            rest = []; i = 0
+            rest = []; i = 0; explicit_region = False
+            native_tail=provider=='aws-fufu' and any(argv[j:j+2]==['logs','tail'] for j in range(len(argv)))
+            native_s3=provider=='aws-fufu' and 's3' in argv
+            native_storage_ls=provider=='gcloud-fufu' and any(argv[j:j+2]==['storage','ls'] for j in range(len(argv)))
+            native_function_logs=provider=='gcloud-fufu' and any(argv[j:j+3]==['functions','logs','read'] for j in range(len(argv)))
             while i < len(argv):
                 flag, _, inline = argv[i].partition('=')
-                if flag in {'--region', '--project', '--output', '--format', '--impersonate-service-account', '--filter', '--sort-by', '--query'} or flag == '--limit' and provider == 'gcloud-fufu' and 'list' in argv:
+                native_option=flag=='--format' and (native_tail or native_storage_ls) or flag=='--filter' and native_function_logs
+                if not native_option and (flag in {'--region', '--project', '--output', '--format', '--impersonate-service-account', '--filter', '--sort-by', '--query'} or flag == '--limit' and provider == 'gcloud-fufu' and 'list' in argv):
                     value = inline if '=' in argv[i] else (argv[i + 1] if i + 1 < len(argv) else '')
                     i += 1 if '=' in argv[i] else 2
                     require(bool(value) and not value.startswith('--'), 'UNSUPPORTED_ARGUMENT', '全域旗標缺少值。')
@@ -531,7 +540,7 @@ def entry(provider, argv=None):
                         from .aws_output import expression
                         aws_query = expression(value)
                     elif flag == '--output' and provider == 'aws-fufu':
-                        require(value in {'json', 'text', 'yaml', 'off'}, 'UNSUPPORTED_FORMAT', 'AWS 輸出支援 json、text、yaml、off。')
+                        require(value in ({'json', 'text', 'yaml', 'table', 'yaml-stream', 'off'} if native_s3 else {'json', 'text', 'yaml', 'off'}), 'UNSUPPORTED_FORMAT', 'AWS 輸出支援 json、text、yaml、off。')
                         aws_format = value
                     elif flag == '--impersonate-service-account':
                         require(provider == 'gcloud-fufu', 'UNSUPPORTED_ARGUMENT', '此旗標只適用於 gcloud-fufu。')
@@ -550,12 +559,16 @@ def entry(provider, argv=None):
                         if flag == '--limit':
                             require(value.isdigit(), 'UNSUPPORTED_ARGUMENT', 'limit 必須為非負整數。'); output_limit = int(value)
                     elif flag in {'--output', '--format'}: require(value == 'json', 'UNSUPPORTED_ARGUMENT', '此入口目前輸出格式支援 json。')
-                    else: os.environ['FUFU_SELECTED_REGION' if flag == '--region' else 'FUFU_SELECTED_PROJECT'] = value
-                elif flag in {'--quiet', '-q', '--no-cli-pager'}:
+                    else:
+                        if flag == '--region': explicit_region = True
+                        os.environ['FUFU_SELECTED_REGION' if flag == '--region' else 'FUFU_SELECTED_PROJECT'] = value
+                elif flag in {'--quiet', '-q', '--no-cli-pager'} and not (native_s3 and flag == '--quiet'):
                     require('=' not in argv[i], 'UNSUPPORTED_ARGUMENT', '布林旗標不接受額外值。'); i += 1
                 else: rest.append(argv[i]); i += 1
             argv = rest
             if provider == 'gcloud-fufu':
+                if explicit_region and argv[:2] in [['compute', name] for name in ['health-checks', 'backend-services', 'url-maps', 'target-http-proxies', 'forwarding-rules']]:
+                    require(False, 'CAPABILITY_NOT_SUPPORTED', '目前 LB 配置僅支援 global 子集；不能以 --region 建立或查詢區域資源。')
                 if output_filter or output_sort or output_limit is not None:
                     list_commands = [('run', 'services', 'list'), ('functions', 'list'), ('iam', 'service-accounts', 'list'),
                                      ('pubsub', 'topics', 'list'), ('pubsub', 'subscriptions', 'list'), ('secrets', 'list'),
@@ -564,11 +577,19 @@ def entry(provider, argv=None):
                                      ('compute', 'instances', 'list'), ('sql', 'instances', 'list'), ('sql', 'databases', 'list'),
                                      ('artifacts', 'repositories', 'list'), ('dns', 'managed-zones', 'list'), ('eventarc', 'triggers', 'list'),
                                      ('compute', 'networks', 'list'), ('compute', 'networks', 'subnets', 'list'), ('compute', 'networks', 'vpc-access', 'connectors', 'list')]
+                    from .gcp_infra import MOCK_GROUPS
+                    list_commands.extend((*command, 'list') for command in MOCK_GROUPS)
                     require(any(tuple(argv[:len(command)]) == command for command in list_commands), 'UNSUPPORTED_ARGUMENT', '清單選取旗標只適用於資源 list；未執行操作。')
                 if output_format and argv[:2] == ['functions', 'call']:
                     require(output_format == 'json', 'UNSUPPORTED_FORMAT', 'Functions call 目前只支援 JSON 回應。')
         from . import public_access
-        if provider == 'gcloud-fufu' and argv and argv[0] in {'scheduler', 'tasks', 'logging', 'compute', 'sql', 'artifacts', 'dns', 'eventarc'}:
+        if provider == 'gcloud-fufu' and argv[:2] in [['compute', 'instances'], ['compute', 'ssh'], ['container', 'clusters']]:
+            from .infrastructure import gcp_command
+            emit(gcp_command(argv, Parser)); return
+        if provider == 'aws-fufu' and argv[:1] in [['ec2'], ['eks']]:
+            from .infrastructure import aws_command as infrastructure_aws_command
+            emit(infrastructure_aws_command(argv, Parser)); return
+        if provider == 'gcloud-fufu' and argv and argv[0] in {'scheduler', 'tasks', 'logging', 'compute', 'sql', 'artifacts', 'dns', 'eventarc', 'container', 'redis'}:
             from .gcp_infra import command
             emit(command(argv, Parser)); return
         if provider == 'aws-fufu' and argv[:1] == ['secretsmanager'] or provider == 'gcloud-fufu' and argv[:1] == ['secrets']:
@@ -588,6 +609,15 @@ def entry(provider, argv=None):
         if provider == 'aws-fufu' and argv and argv[0] == 'serverless':
             from .serverless import command
             emit(command(argv[1:], Parser)); return
+        if provider=='fufu' and argv and argv[0]=='observability':
+            from .observability import command
+            emit(command(argv[1:],Parser));return
+        if provider=='aws-fufu' and argv[:2]==['logs','tail']:
+            from .observability import aws_tail
+            aws_tail(argv[2:],Parser);return
+        if provider=='gcloud-fufu' and (argv[:4]==['run','services','logs','read'] or argv[:3]==['functions','logs','read']):
+            from .observability import service_logs
+            emit(service_logs(argv,Parser));return
         if provider == 'fufu' and argv and argv[0] in {'gateway', 'events', 'mock'}:
             from .control import fufu_control
             emit(fufu_control(argv, Parser)); return
@@ -609,7 +639,10 @@ def entry(provider, argv=None):
         if provider == 'az-fufu' and argv and argv[0] == 'functionapp':
             raise FufuError('CAPABILITY_NOT_SUPPORTED', 'Azure Functions runtime 尚未實作。', 2)
         remote = {"aws-fufu": "aws", "gcloud-fufu": "gcp", "az-fufu": "azure"}
-        if provider == 'aws-fufu' and argv and argv[0] in {'s3', 'sqs', 'ssm'}:
+        if provider == 'aws-fufu' and argv[:1] == ['s3']:
+            from .s3_highlevel import command
+            command(argv[1:], Parser); return
+        if provider == 'aws-fufu' and argv and argv[0] in {'sqs', 'ssm'}:
             from .cloud_data import aws_data_command
             emit(aws_data_command(argv, Parser))
             return

{fufu_cloud_cli-0.9.7 → fufu_cloud_cli-0.10.0}/src/fufu_cloud_cli/cloud_data.py

@@ -28,7 +28,7 @@ def s3_path(value):
     p = urlsplit(value)
     require(p.scheme == 's3' and p.netloc and not p.query and not p.fragment and not p.username and not p.password,
             'INVALID_RESOURCE', '請使用 s3://bucket 或 s3://bucket/key。')
-    return '/s3/buckets/' + segment(p.netloc), p.path.lstrip('/')
+    return '/s3/buckets/' + segment(p.netloc), p.path.removeprefix('/')
 
 
 def aws_data_command(argv, Parser):

{fufu_cloud_cli-0.9.7 → fufu_cloud_cli-0.10.0}/src/fufu_cloud_cli/control.py

@@ -27,7 +27,7 @@ AWS_OPERATIONS = {
   'BatchGetItem': 'RequestItems', 'BatchWriteItem': 'RequestItems',
  },
  's3api': {
-  'CreateBucket': 'Bucket CreateBucketConfiguration', 'DeleteBucket': 'Bucket', 'ListBuckets': '', 'HeadBucket': 'Bucket',
+  'CreateBucket': 'Bucket CreateBucketConfiguration', 'DeleteBucket': 'Bucket', 'ListBuckets': '', 'HeadBucket': 'Bucket', 'GetBucketLocation': 'Bucket',
   'ListObjectsV2': 'Bucket Prefix MaxKeys ContinuationToken Delimiter StartAfter EncodingType', 'PutObject': 'Bucket Key Body ContentType Metadata',
   'GetObject': 'Bucket Key ChecksumMode Range IfMatch IfNoneMatch', 'HeadObject': 'Bucket Key ChecksumMode IfMatch IfNoneMatch', 'DeleteObject': 'Bucket Key',
  },
@@ -134,7 +134,7 @@ def command(argv, Parser):
         params.setdefault('Type', 'String')
     if a.service == 'sqs' and 'QueueUrl' in params:
         require(isinstance(params['QueueUrl'], str) and re.fullmatch(r'(?:fufu://sqs/|https://sqs\.[a-z0-9-]+\.fufu\.invalid/[0-9]{12}/)[A-Za-z0-9_-]+(?:\.fifo)?', params['QueueUrl']) and len(params['QueueUrl'].rsplit('/', 1)[-1]) <= 80, 'INVALID_RESOURCE', 'QueueUrl 必須是 FUFU 租戶資源識別。')
-    with ApiClient('aws', read_only=bool(re.match(r'^(Get|List|Describe|Query|Scan|BatchGet|Simulate|Head)', a.native_operation))) as api:
+    with ApiClient('aws', read_only=bool(re.match(r'^(Get|List|Describe|Query|Scan|BatchGet|Simulate|Head|FilterLogEvents)', a.native_operation))) as api:
         if a.service == 's3api' and a.native_operation == 'PutObject' and isinstance(params.get('Body'), Path):
             from .object_transfer import upload_file
             return upload_file(api, params['Body'], params.get('Bucket'), params.get('Key'), content_type=params.get('ContentType'), metadata=params.get('Metadata'))