fufu-cloud-cli 0.9.7__tar.gz → 0.9.8__tar.gz

{fufu_cloud_cli-0.9.7/src/fufu_cloud_cli.egg-info → fufu_cloud_cli-0.9.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fufu-cloud-cli
-Version: 0.9.7
+Version: 0.9.8
 Summary: FUFU Cloud CLI for tenant-scoped mock cloud development and deployment
 License-Expression: LicenseRef-Proprietary
 Requires-Python: >=3.10
@@ -27,6 +27,32 @@ Dynamic: license-file
 `gcloud-fufu`、`az-fufu`、`wrangler-fufu`、`bq-fufu`。這是 AWS、Google Cloud、Azure 與 Cloudflare 的**明確子集**，
 只供 FUFU mock 環境使用；不會把部署轉送到正式雲端。
 
+2026-09-10 後續原始碼與 Cloud Shell 新增 GKE、firewall、五類 global LB 與 Redis
+配置命令，typed configuration 合計 22 類；都有 `MOCK ONLY` 提示、引用存在性與
+相依刪除檢查，不建立 Kubernetes、VM、Redis 或網路資料面，也未增加 IaC 資源。
+這批包含在 0.9.8；需要配套的 FUFU Console 與運算服務。
+
+0.9.8 提供 Cloud Run／Functions 的原生形式日誌查詢、CloudWatch Logs
+tail／follow，以及 `fufu observability` 的日誌、請求指標與追蹤查詢。
+公開套件包含完整的日誌指令模組；重複建立 CloudWatch log group 的
+`ResourceAlreadyExistsException` 會保留至 CLI 與 boto3 例外處理。
+配套服務端持久化收集 Cloud Run、Functions Gen 1／Gen 2、Lambda 的
+stdout／stderr 與例外堆疊。支援租戶隔離、IAM、敏感值遮罩、查詢分頁、
+request ID／trace 關聯及重啟恢復。GCP log names 清單、dry run、欄位存在
+查詢，以及 AWS 10,000 筆／1 MiB 寫入批次均有契約驗收。
+
+```bash
+gcloud-fufu run services logs read hello --limit=100 --log-filter='severity>=ERROR'
+gcloud-fufu functions logs read hello --gen2 --limit=100
+aws-fufu logs tail /aws/lambda/hello --since 1h --follow --fufu-duration 300
+fufu observability status --provider gcp
+fufu observability logs --provider aws --request-id REQUEST_ID --since 1h
+```
+
+請求 metrics／traces 是明示的 FUFU 擴充，沒有實作完整 Cloud Monitoring、
+CloudWatch Metrics、Trace 或 X-Ray。Log Router sinks、Logs Insights、
+subscriptions、alerts 及完整 OpenTelemetry collector 尚未支援。
+
 0.9.7 補齊 Lambda 五種 `wait` 指令、設定／程式碼更新的 `--revision-id`，
 以及常用設定的 `--cli-input-json` 和 `Variables={KEY=value}` shorthand。
 過期 RevisionId 回 `PreconditionFailedException`，保留原部署；CLI 仍等待
@@ -62,8 +88,9 @@ fufu infrastructure catalog
 ```
 
 BigQuery 是 tenant emulator 的 GoogleSQL 子集，無 DML／DDL、load/export、
-外部表與效能／費用等價。Logging 保留每租戶最新 10,000 筆，不自動收集所有
-容器 stdout。Tasks 每 queue 每秒最多 1 次、每租戶 2 個同時投遞；耗盡 task
+外部表與效能／費用等價。配套新版 Logging 預設每租戶 2 GiB；GCP 保留
+30 天，AWS 依 log group retention 設定，未設定時不自動到期。只收集已
+驗證歸屬的 FUFU 工作負載容器。Tasks 每 queue 每秒最多 1 次、每租戶 2 個同時投遞；耗盡 task
 留待檢查，與官方刪除策略不同。新的 dependency flow 不代表完整應用都能遷移。
 
 0.9.4 新增 GCS generation／metageneration 條件、`storage objects describe/update/list`、8 KiB 自訂 metadata 與二進位 `cat`。競爭寫入、過期條件、CLI metadata 和官方 gcloud 輸出欄位已對照驗收；不相符條件回傳 `PRECONDITION_FAILED`／HTTP 412。新功能需要同步更新 FUFU Console、GCS 儲存映像和 Cloud Shell。儲存升級前須停寫並備份完整 volume；新 metadata 格式可讀舊資料，回滾須還原升級前備份。
@@ -80,7 +107,7 @@ Python 預設識別而遇到 Cloudflare HTTP 403／1010。識別標頭不取代
 ## Cloudflare 前端部署與 R2
 
 ```bash
-pip install 'fufu-cloud-cli==0.9.7'
+pip install 'fufu-cloud-cli==0.9.8'
 export FUFU_CLOUDFLARE_CREDENTIAL_FILE=/run/secrets/fufu-cloudflare.json
 wrangler-fufu capabilities
 wrangler-fufu pages project create frontend --production-branch main

{fufu_cloud_cli-0.9.7 → fufu_cloud_cli-0.9.8}/README.md

@@ -4,6 +4,32 @@
 `gcloud-fufu`、`az-fufu`、`wrangler-fufu`、`bq-fufu`。這是 AWS、Google Cloud、Azure 與 Cloudflare 的**明確子集**，
 只供 FUFU mock 環境使用；不會把部署轉送到正式雲端。
 
+2026-09-10 後續原始碼與 Cloud Shell 新增 GKE、firewall、五類 global LB 與 Redis
+配置命令，typed configuration 合計 22 類；都有 `MOCK ONLY` 提示、引用存在性與
+相依刪除檢查，不建立 Kubernetes、VM、Redis 或網路資料面，也未增加 IaC 資源。
+這批包含在 0.9.8；需要配套的 FUFU Console 與運算服務。
+
+0.9.8 提供 Cloud Run／Functions 的原生形式日誌查詢、CloudWatch Logs
+tail／follow，以及 `fufu observability` 的日誌、請求指標與追蹤查詢。
+公開套件包含完整的日誌指令模組；重複建立 CloudWatch log group 的
+`ResourceAlreadyExistsException` 會保留至 CLI 與 boto3 例外處理。
+配套服務端持久化收集 Cloud Run、Functions Gen 1／Gen 2、Lambda 的
+stdout／stderr 與例外堆疊。支援租戶隔離、IAM、敏感值遮罩、查詢分頁、
+request ID／trace 關聯及重啟恢復。GCP log names 清單、dry run、欄位存在
+查詢，以及 AWS 10,000 筆／1 MiB 寫入批次均有契約驗收。
+
+```bash
+gcloud-fufu run services logs read hello --limit=100 --log-filter='severity>=ERROR'
+gcloud-fufu functions logs read hello --gen2 --limit=100
+aws-fufu logs tail /aws/lambda/hello --since 1h --follow --fufu-duration 300
+fufu observability status --provider gcp
+fufu observability logs --provider aws --request-id REQUEST_ID --since 1h
+```
+
+請求 metrics／traces 是明示的 FUFU 擴充，沒有實作完整 Cloud Monitoring、
+CloudWatch Metrics、Trace 或 X-Ray。Log Router sinks、Logs Insights、
+subscriptions、alerts 及完整 OpenTelemetry collector 尚未支援。
+
 0.9.7 補齊 Lambda 五種 `wait` 指令、設定／程式碼更新的 `--revision-id`，
 以及常用設定的 `--cli-input-json` 和 `Variables={KEY=value}` shorthand。
 過期 RevisionId 回 `PreconditionFailedException`，保留原部署；CLI 仍等待
@@ -39,8 +65,9 @@ fufu infrastructure catalog
 ```
 
 BigQuery 是 tenant emulator 的 GoogleSQL 子集，無 DML／DDL、load/export、
-外部表與效能／費用等價。Logging 保留每租戶最新 10,000 筆，不自動收集所有
-容器 stdout。Tasks 每 queue 每秒最多 1 次、每租戶 2 個同時投遞；耗盡 task
+外部表與效能／費用等價。配套新版 Logging 預設每租戶 2 GiB；GCP 保留
+30 天，AWS 依 log group retention 設定，未設定時不自動到期。只收集已
+驗證歸屬的 FUFU 工作負載容器。Tasks 每 queue 每秒最多 1 次、每租戶 2 個同時投遞；耗盡 task
 留待檢查，與官方刪除策略不同。新的 dependency flow 不代表完整應用都能遷移。
 
 0.9.4 新增 GCS generation／metageneration 條件、`storage objects describe/update/list`、8 KiB 自訂 metadata 與二進位 `cat`。競爭寫入、過期條件、CLI metadata 和官方 gcloud 輸出欄位已對照驗收；不相符條件回傳 `PRECONDITION_FAILED`／HTTP 412。新功能需要同步更新 FUFU Console、GCS 儲存映像和 Cloud Shell。儲存升級前須停寫並備份完整 volume；新 metadata 格式可讀舊資料，回滾須還原升級前備份。
@@ -57,7 +84,7 @@ Python 預設識別而遇到 Cloudflare HTTP 403／1010。識別標頭不取代
 ## Cloudflare 前端部署與 R2
 
 ```bash
-pip install 'fufu-cloud-cli==0.9.7'
+pip install 'fufu-cloud-cli==0.9.8'
 export FUFU_CLOUDFLARE_CREDENTIAL_FILE=/run/secrets/fufu-cloudflare.json
 wrangler-fufu capabilities
 wrangler-fufu pages project create frontend --production-branch main

{fufu_cloud_cli-0.9.7 → fufu_cloud_cli-0.9.8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "fufu-cloud-cli"
-version = "0.9.7"
+version = "0.9.8"
 description = "FUFU Cloud CLI for tenant-scoped mock cloud development and deployment"
 readme = "README.md"
 requires-python = ">=3.10"

{fufu_cloud_cli-0.9.7 → fufu_cloud_cli-0.9.8}/src/fufu_cloud_cli/__init__.py

@@ -1,3 +1,3 @@
 """FUFU CLI 與本機部署工具；相容範圍見 capabilities.json。"""
 
-__version__ = "0.9.7"
+__version__ = "0.9.8"

{fufu_cloud_cli-0.9.7 → fufu_cloud_cli-0.9.8}/src/fufu_cloud_cli/aws_errors.py

@@ -1,5 +1,5 @@
 """Only documented provider error codes may cross the public transport boundary."""
-AWS_ERRORS = frozenset('''ConditionalCheckFailedException ResourceNotFoundException ResourceInUseException ValidationException
+AWS_ERRORS = frozenset('''ConditionalCheckFailedException ResourceNotFoundException ResourceInUseException ResourceAlreadyExistsException ValidationException
 NoSuchKey NoSuchBucket NotFound NotModified ParameterNotFound ParameterAlreadyExists ParameterVersionNotFound QueueDoesNotExist
 PreconditionFailed InvalidRange InvalidParameterException InvalidParameterValue InvalidAttributeName InvalidAttributeValue QueueNameExists
 PurgeQueueInProgress ReceiptHandleIsInvalid BatchEntryIdsNotDistinct EmptyBatchRequest BatchRequestTooLong InvalidBatchEntryId

{fufu_cloud_cli-0.9.7 → fufu_cloud_cli-0.9.8}/src/fufu_cloud_cli/capabilities.json

@@ -226,7 +226,8 @@
         "no-Entra-STS"
       ]
     },
-    "aws-cloudwatch-logs": {"status": "implemented", "backend": "api", "mode": "simplified", "operations": ["log-group-crud", "log-stream-crud", "put-get-filter-events", "retention-policy", "CLI-UI-boto3"], "limitations": ["no-automatic-stdout-collection", "simple-text-filters-only", "no-Insights-subscriptions-or-KMS", "no-guaranteed-retention-deletion", "service-page-tokens-no-CLI-auto-pagination"]},
+    "aws-cloudwatch-logs": {"status": "implemented", "backend": "api", "mode": "simplified", "operations": ["log-group-crud", "log-stream-crud", "put-get-filter-events", "retention-policy-expiry", "CLI-UI-boto3", "owned-Lambda-stdout-stderr", "logs-tail-follow", "SQLite-persistence", "signed-pagination", "credential-redaction"], "limitations": ["single-host-configurable-storage-capacity", "simple-text-filters-only", "no-Insights-subscriptions-or-KMS", "follow-default-300s-max-3600s", "service-page-tokens-except-tail-auto-pagination"]},
+    "fufu-observability": {"status": "implemented", "backend": "api", "mode": "simplified", "operations": ["logs", "request-metrics", "request-traces", "collector-status", "GCP-AWS-IAM", "structured-trace-links"], "limitations": ["explicit-FUFU-extension-not-native-Monitoring-CloudWatch-Trace-XRay-API", "gateway-request-duration-not-handler-or-billing-metrics", "no-automatic-SDK-spans-alerts-or-cross-service-trace-assembly", "plain-stdout-correlates-by-service-revision", "async-Lambda-logs-without-request-metrics", "single-host-no-HA"]},
     "aws-lambda-async": {"status": "implemented", "backend": "api", "mode": "simplified", "operations": ["invoke-Event", "invoke-DryRun", "CLI-UI-boto3-Invoke"], "limitations": ["1MiB-payload", "single-host-SQLite-two-dispatchers", "at-least-once", "two-handler-retries-60s-120s", "system-retries-up-to-6h", "no-destinations-or-DLQ", "no-AWS-scaling-or-managed-timeout-equivalence", "10000-events-or-512MiB-encoded-queue-per-tenant"]},
     "aws-cli-output": {"status": "implemented", "mode": "simplified", "operations": ["JMESPath-query", "json", "text", "yaml"], "limitations": ["no-table-or-yaml-stream", "no-full-CLI-auto-pagination", "Lambda-response-subset-no-Code-download"]},
     "aws-data-services": {
@@ -345,17 +346,21 @@
       "mode": "simplified",
       "operations": [
         "write-read",
-        "filter-AND-severity-timestamp-logName-resourceType",
+        "filter-AND-OR-NOT-structured-fields-severity-timestamp-trace-text",
         "logs-list-delete",
         "partialSuccess",
         "explicit-official-Python-REST-SDK",
-        "setup-logging"
+        "setup-logging",
+        "owned-CloudRun-Functions-stdout-stderr",
+        "run-services-logs-read",
+        "functions-logs-read-gen1-gen2",
+        "SQLite-persistence-retention-redaction"
       ],
       "limitations": [
-        "last-10000-entries-per-tenant",
-        "single-writer-128MiB-state-capacity",
-        "no-automatic-container-stdout",
-        "no-sinks-retention-metrics-alerts",
+        "single-host-configurable-storage-capacity-default-2GiB-per-tenant",
+        "default-30-day-log-retention",
+        "bounded-durable-spool-and-Docker-log-rotation",
+        "no-sinks-alerts-or-native-Monitoring-Trace-API",
         "no-new-IaC-resources"
       ]
     },
@@ -378,16 +383,30 @@
         "builds",
         "gemini-models",
         "vm-policies",
-        "eventarc-triggers"
+        "eventarc-triggers",
+        "gke-clusters",
+        "firewall-rules",
+        "health-checks",
+        "backend-services",
+        "url-maps",
+        "target-http-proxies",
+        "forwarding-rules",
+        "redis-instances"
       ],
       "operations": [
         "typed-crud",
         "three-locale-mobile-console",
-        "fufu-infrastructure-cli"
+        "fufu-infrastructure-cli",
+        "native-gcloud-command-subsets",
+        "same-tenant-reference-validation",
+        "referenced-resource-delete-conflict"
       ],
       "limitations": [
         "configuration-only",
-        "no-VM-SQL-network-DNS-build-registry-inference-runtime",
+        "no-VM-SQL-network-DNS-build-registry-inference-Kubernetes-Redis-LB-runtime",
+        "configuration-envelope-not-official-resource-JSON",
+        "LB-global-subset-regional-flags-rejected",
+        "no-complete-reference-use-permission-model",
         "no-new-IaC-resources"
       ]
     },
@@ -492,8 +511,11 @@
     },
     "gcp-memorystore": {
       "name": "Memorystore",
-      "status": "partial",
-      "reason": "工作區有 Redis 引擎；不提供 Memorystore 控制面。"
+      "status": "mock-only",
+      "backend": "api",
+      "mode": "mock-only",
+      "operations": ["typed-redis-configuration-crud", "network-reference-validation"],
+      "reason": "僅保存 Memorystore 配置；不建立 Redis process、endpoint、replication 或 persistence。工作區既有 Redis 引擎是獨立服務。"
     },
     "aws-elasticache": {
       "name": "ElastiCache",
@@ -522,8 +544,19 @@
     },
     "gcp-gke": {
       "name": "GKE",
-      "status": "unsupported",
-      "reason": "尚未實作可供 CLI 自動部署與驗證的服務契約。"
+      "status": "mock-only",
+      "backend": "api",
+      "mode": "mock-only",
+      "operations": ["typed-cluster-configuration-crud", "network-reference-validation"],
+      "reason": "僅保存叢集配置；無 Kubernetes API、nodes、kubectl、scheduler 或 workloads。"
+    },
+    "gcp-vpc": {
+      "name": "VPC / Firewall",
+      "status": "mock-only",
+      "backend": "api",
+      "mode": "mock-only",
+      "operations": ["network-subnet-connector-firewall-configuration-crud"],
+      "reason": "僅保存配置；規則不會過濾封包，沒有路由、位址配置或真實 VPC。"
     },
     "gcp-cloud-run-jobs": {
       "name": "Cloud Run Jobs",
@@ -592,12 +625,15 @@
     "gcp-cloud-logging-monitoring": {
       "name": "Cloud Logging / Monitoring",
       "status": "partial",
-      "reason": "gcp-logging 已提供可執行日誌子集；Monitoring、alerts、sinks 與完整 stdout 收集未支援。"
+      "reason": "Cloud Logging 已接持久化、工作負載 stdout／stderr、CLI 與 UI；請求 metrics／traces 為明示 FUFU 擴充。未實作官方 Monitoring／Cloud Trace API、alerts 或 sinks。"
     },
     "gcp-load-balancing-nat": {
       "name": "Cloud Load Balancing / NAT",
-      "status": "unsupported",
-      "reason": "尚未實作可供 CLI 自動部署與驗證的服務契約。"
+      "status": "mock-only",
+      "backend": "api",
+      "mode": "mock-only",
+      "operations": ["global-health-check-backend-url-map-http-proxy-forwarding-rule-configuration-crud"],
+      "reason": "LB 僅保存 global 配置相依鏈；沒有探測、IP、listener、TLS 或轉送。NAT 尚未支援。"
     },
     "aws-ec2": {
       "name": "EC2",
@@ -664,8 +700,8 @@
     },
     "aws-cloudwatch": {
       "name": "CloudWatch",
-      "status": "unsupported",
-      "reason": "尚未實作可供 CLI 自動部署與驗證的服務契約。"
+      "status": "partial",
+      "reason": "CloudWatch Logs 明列 API 子集、Lambda stdout／stderr、CLI tail、持久化與 retention 已接入；請求 metrics／traces 使用 FUFU 擴充，未實作官方 Metrics／X-Ray API 或 alarms。"
     },
     "aws-cloudfront": {
       "name": "CloudFront",

{fufu_cloud_cli-0.9.7 → fufu_cloud_cli-0.9.8}/src/fufu_cloud_cli/cli.py

@@ -104,6 +104,7 @@ def fufu_parser():
     p = Parser(prog="fufu", description="FUFU 租戶認證、遠端部署與本機 Docker；所有輸出均為 FUFU 子集契約。")
     p.add_argument("--version", action="version", version=__version__)
     sub = p.add_subparsers(dest="action", required=True)
+    sub.add_parser('observability', help='FUFU 擴充：日誌、請求指標、trace 與收集狀態；使用 observability --help')
     auth = sub.add_parser("auth", help="驗證 CLI credential，顯示目前租戶與 scope").add_subparsers(dest="auth_action", required=True)
     identity = auth.add_parser("whoami")
     identity.add_argument("--provider", choices=["aws", "gcp", "azure", "cloudflare"])
@@ -495,7 +496,7 @@ def entry(provider, argv=None):
             p.add_argument('--quiet', '-q', action='store_true', help='非互動執行')
             p.add_argument('--version', action='store_true', help='CLI 版本')
             groups = p.add_subparsers(title='服務')
-            for group in ['run', 'functions', 'iam', 'projects', 'pubsub', 'secrets', 'storage', 'auth', 'scheduler', 'tasks', 'logging', 'compute', 'sql', 'artifacts', 'dns', 'eventarc']: groups.add_parser(group)
+            for group in ['run', 'functions', 'iam', 'projects', 'pubsub', 'secrets', 'storage', 'auth', 'scheduler', 'tasks', 'logging', 'compute', 'sql', 'artifacts', 'dns', 'eventarc', 'container', 'redis']: groups.add_parser(group)
             p.print_help(); return
         if provider == 'bq-fufu':
             from .bigquery import command
@@ -519,10 +520,15 @@ def entry(provider, argv=None):
             emit(configuration_command(argv[1:], Parser)); return
         # Native global selectors are checked against the authenticated tenant scope.
         if provider in {'aws-fufu', 'gcloud-fufu'}:
-            rest = []; i = 0
+            rest = []; i = 0; explicit_region = False
+            native_tail=provider=='aws-fufu' and any(argv[j:j+2]==['logs','tail'] for j in range(len(argv)))
+            native_s3=provider=='aws-fufu' and 's3' in argv
+            native_storage_ls=provider=='gcloud-fufu' and any(argv[j:j+2]==['storage','ls'] for j in range(len(argv)))
+            native_function_logs=provider=='gcloud-fufu' and any(argv[j:j+3]==['functions','logs','read'] for j in range(len(argv)))
             while i < len(argv):
                 flag, _, inline = argv[i].partition('=')
-                if flag in {'--region', '--project', '--output', '--format', '--impersonate-service-account', '--filter', '--sort-by', '--query'} or flag == '--limit' and provider == 'gcloud-fufu' and 'list' in argv:
+                native_option=flag=='--format' and (native_tail or native_storage_ls) or flag=='--filter' and native_function_logs
+                if not native_option and (flag in {'--region', '--project', '--output', '--format', '--impersonate-service-account', '--filter', '--sort-by', '--query'} or flag == '--limit' and provider == 'gcloud-fufu' and 'list' in argv):
                     value = inline if '=' in argv[i] else (argv[i + 1] if i + 1 < len(argv) else '')
                     i += 1 if '=' in argv[i] else 2
                     require(bool(value) and not value.startswith('--'), 'UNSUPPORTED_ARGUMENT', '全域旗標缺少值。')
@@ -531,7 +537,7 @@ def entry(provider, argv=None):
                         from .aws_output import expression
                         aws_query = expression(value)
                     elif flag == '--output' and provider == 'aws-fufu':
-                        require(value in {'json', 'text', 'yaml', 'off'}, 'UNSUPPORTED_FORMAT', 'AWS 輸出支援 json、text、yaml、off。')
+                        require(value in ({'json', 'text', 'yaml', 'table', 'yaml-stream', 'off'} if native_s3 else {'json', 'text', 'yaml', 'off'}), 'UNSUPPORTED_FORMAT', 'AWS 輸出支援 json、text、yaml、off。')
                         aws_format = value
                     elif flag == '--impersonate-service-account':
                         require(provider == 'gcloud-fufu', 'UNSUPPORTED_ARGUMENT', '此旗標只適用於 gcloud-fufu。')
@@ -550,12 +556,16 @@ def entry(provider, argv=None):
                         if flag == '--limit':
                             require(value.isdigit(), 'UNSUPPORTED_ARGUMENT', 'limit 必須為非負整數。'); output_limit = int(value)
                     elif flag in {'--output', '--format'}: require(value == 'json', 'UNSUPPORTED_ARGUMENT', '此入口目前輸出格式支援 json。')
-                    else: os.environ['FUFU_SELECTED_REGION' if flag == '--region' else 'FUFU_SELECTED_PROJECT'] = value
-                elif flag in {'--quiet', '-q', '--no-cli-pager'}:
+                    else:
+                        if flag == '--region': explicit_region = True
+                        os.environ['FUFU_SELECTED_REGION' if flag == '--region' else 'FUFU_SELECTED_PROJECT'] = value
+                elif flag in {'--quiet', '-q', '--no-cli-pager'} and not (native_s3 and flag == '--quiet'):
                     require('=' not in argv[i], 'UNSUPPORTED_ARGUMENT', '布林旗標不接受額外值。'); i += 1
                 else: rest.append(argv[i]); i += 1
             argv = rest
             if provider == 'gcloud-fufu':
+                if explicit_region and argv[:2] in [['compute', name] for name in ['health-checks', 'backend-services', 'url-maps', 'target-http-proxies', 'forwarding-rules']]:
+                    require(False, 'CAPABILITY_NOT_SUPPORTED', '目前 LB 配置僅支援 global 子集；不能以 --region 建立或查詢區域資源。')
                 if output_filter or output_sort or output_limit is not None:
                     list_commands = [('run', 'services', 'list'), ('functions', 'list'), ('iam', 'service-accounts', 'list'),
                                      ('pubsub', 'topics', 'list'), ('pubsub', 'subscriptions', 'list'), ('secrets', 'list'),
@@ -564,11 +574,13 @@ def entry(provider, argv=None):
                                      ('compute', 'instances', 'list'), ('sql', 'instances', 'list'), ('sql', 'databases', 'list'),
                                      ('artifacts', 'repositories', 'list'), ('dns', 'managed-zones', 'list'), ('eventarc', 'triggers', 'list'),
                                      ('compute', 'networks', 'list'), ('compute', 'networks', 'subnets', 'list'), ('compute', 'networks', 'vpc-access', 'connectors', 'list')]
+                    from .gcp_infra import MOCK_GROUPS
+                    list_commands.extend((*command, 'list') for command in MOCK_GROUPS)
                     require(any(tuple(argv[:len(command)]) == command for command in list_commands), 'UNSUPPORTED_ARGUMENT', '清單選取旗標只適用於資源 list；未執行操作。')
                 if output_format and argv[:2] == ['functions', 'call']:
                     require(output_format == 'json', 'UNSUPPORTED_FORMAT', 'Functions call 目前只支援 JSON 回應。')
         from . import public_access
-        if provider == 'gcloud-fufu' and argv and argv[0] in {'scheduler', 'tasks', 'logging', 'compute', 'sql', 'artifacts', 'dns', 'eventarc'}:
+        if provider == 'gcloud-fufu' and argv and argv[0] in {'scheduler', 'tasks', 'logging', 'compute', 'sql', 'artifacts', 'dns', 'eventarc', 'container', 'redis'}:
             from .gcp_infra import command
             emit(command(argv, Parser)); return
         if provider == 'aws-fufu' and argv[:1] == ['secretsmanager'] or provider == 'gcloud-fufu' and argv[:1] == ['secrets']:
@@ -588,6 +600,15 @@ def entry(provider, argv=None):
         if provider == 'aws-fufu' and argv and argv[0] == 'serverless':
             from .serverless import command
             emit(command(argv[1:], Parser)); return
+        if provider=='fufu' and argv and argv[0]=='observability':
+            from .observability import command
+            emit(command(argv[1:],Parser));return
+        if provider=='aws-fufu' and argv[:2]==['logs','tail']:
+            from .observability import aws_tail
+            aws_tail(argv[2:],Parser);return
+        if provider=='gcloud-fufu' and (argv[:4]==['run','services','logs','read'] or argv[:3]==['functions','logs','read']):
+            from .observability import service_logs
+            emit(service_logs(argv,Parser));return
         if provider == 'fufu' and argv and argv[0] in {'gateway', 'events', 'mock'}:
             from .control import fufu_control
             emit(fufu_control(argv, Parser)); return
@@ -609,7 +630,10 @@ def entry(provider, argv=None):
         if provider == 'az-fufu' and argv and argv[0] == 'functionapp':
             raise FufuError('CAPABILITY_NOT_SUPPORTED', 'Azure Functions runtime 尚未實作。', 2)
         remote = {"aws-fufu": "aws", "gcloud-fufu": "gcp", "az-fufu": "azure"}
-        if provider == 'aws-fufu' and argv and argv[0] in {'s3', 'sqs', 'ssm'}:
+        if provider == 'aws-fufu' and argv[:1] == ['s3']:
+            from .s3_highlevel import command
+            command(argv[1:], Parser); return
+        if provider == 'aws-fufu' and argv and argv[0] in {'sqs', 'ssm'}:
             from .cloud_data import aws_data_command
             emit(aws_data_command(argv, Parser))
             return

{fufu_cloud_cli-0.9.7 → fufu_cloud_cli-0.9.8}/src/fufu_cloud_cli/cloud_data.py

@@ -28,7 +28,7 @@ def s3_path(value):
     p = urlsplit(value)
     require(p.scheme == 's3' and p.netloc and not p.query and not p.fragment and not p.username and not p.password,
             'INVALID_RESOURCE', '請使用 s3://bucket 或 s3://bucket/key。')
-    return '/s3/buckets/' + segment(p.netloc), p.path.lstrip('/')
+    return '/s3/buckets/' + segment(p.netloc), p.path.removeprefix('/')
 
 
 def aws_data_command(argv, Parser):

{fufu_cloud_cli-0.9.7 → fufu_cloud_cli-0.9.8}/src/fufu_cloud_cli/control.py

@@ -27,7 +27,7 @@ AWS_OPERATIONS = {
   'BatchGetItem': 'RequestItems', 'BatchWriteItem': 'RequestItems',
  },
  's3api': {
-  'CreateBucket': 'Bucket CreateBucketConfiguration', 'DeleteBucket': 'Bucket', 'ListBuckets': '', 'HeadBucket': 'Bucket',
+  'CreateBucket': 'Bucket CreateBucketConfiguration', 'DeleteBucket': 'Bucket', 'ListBuckets': '', 'HeadBucket': 'Bucket', 'GetBucketLocation': 'Bucket',
   'ListObjectsV2': 'Bucket Prefix MaxKeys ContinuationToken Delimiter StartAfter EncodingType', 'PutObject': 'Bucket Key Body ContentType Metadata',
   'GetObject': 'Bucket Key ChecksumMode Range IfMatch IfNoneMatch', 'HeadObject': 'Bucket Key ChecksumMode IfMatch IfNoneMatch', 'DeleteObject': 'Bucket Key',
  },
@@ -134,7 +134,7 @@ def command(argv, Parser):
         params.setdefault('Type', 'String')
     if a.service == 'sqs' and 'QueueUrl' in params:
         require(isinstance(params['QueueUrl'], str) and re.fullmatch(r'(?:fufu://sqs/|https://sqs\.[a-z0-9-]+\.fufu\.invalid/[0-9]{12}/)[A-Za-z0-9_-]+(?:\.fifo)?', params['QueueUrl']) and len(params['QueueUrl'].rsplit('/', 1)[-1]) <= 80, 'INVALID_RESOURCE', 'QueueUrl 必須是 FUFU 租戶資源識別。')
-    with ApiClient('aws', read_only=bool(re.match(r'^(Get|List|Describe|Query|Scan|BatchGet|Simulate|Head)', a.native_operation))) as api:
+    with ApiClient('aws', read_only=bool(re.match(r'^(Get|List|Describe|Query|Scan|BatchGet|Simulate|Head|FilterLogEvents)', a.native_operation))) as api:
         if a.service == 's3api' and a.native_operation == 'PutObject' and isinstance(params.get('Body'), Path):
             from .object_transfer import upload_file
             return upload_file(api, params['Body'], params.get('Bucket'), params.get('Key'), content_type=params.get('ContentType'), metadata=params.get('Metadata'))

{fufu_cloud_cli-0.9.7 → fufu_cloud_cli-0.9.8}/src/fufu_cloud_cli/docker_backend.py

@@ -147,6 +147,7 @@ class Backend:
         self.network = f"fufu-cli-{self.scope}"
         self.ingress_network = f"{self.network}-ingress"
         self.state_file = self.path / "state.json"
+        self.before_remove = None
 
     @contextlib.contextmanager
     def locked(self):
@@ -294,6 +295,7 @@ class Backend:
             supplied.update(secrets)
             supplied.update(runtime_env or {})
             supplied["AWS_EC2_METADATA_DISABLED"] = "true"
+            supplied['PYTHONUNBUFFERED'] = '1'
             if kind == "aws-lambda-sync":
                 supplied.update(AWS_LAMBDA_FUNCTION_NAME=service, AWS_REGION=(runtime_env or {}).get('AWS_REGION', 'us-east-1'),
                                 AWS_DEFAULT_REGION=(runtime_env or {}).get('AWS_REGION', 'us-east-1'))
@@ -306,12 +308,13 @@ class Backend:
                     "--cap-drop", "ALL", "--security-opt", "no-new-privileges:true",
                     "--pids-limit", "1024", "--ulimit", "nofile=4096:4096", "--memory", str(allocation['memoryMiB'])+'m',
                     "--memory-swap", str(allocation['memoryMiB'])+'m', "--cpus", str(allocation['cpu']),
-                    "--log-opt", "max-size=5m", "--log-opt", "max-file=1"]
+                    "--log-driver", "json-file", "--log-opt", "max-size=50m", "--log-opt", "max-file=3"]
             for k in sorted(supplied):
                 args.extend(["--env", k])
             args.append(image_id)
             args.extend(command or [])
             candidate = None
+            record = None
             ingress_candidate = None
             committed = False
             try:
@@ -376,6 +379,7 @@ class Backend:
                     try:
                         self.owned(old["container_id"])
                         self.owned(old["ingress_id"])
+                        if self.before_remove: self.before_remove(old)
                         docker("container", "rm", "--force", old["ingress_id"], old["container_id"])
                         self.cleanup_workload_network(old)
                     except FufuError:
@@ -392,6 +396,9 @@ class Backend:
                         self.owned(ingress_candidate)
                         docker("container", "rm", "--force", ingress_candidate)
                     self.owned(candidate)
+                    # Startup failures must retain their final output for debugging.
+                    # If the spool is full, the owned candidate remains available for retry.
+                    if self.before_remove and record: self.before_remove(record)
                     docker("container", "rm", "--force", candidate)
                     if gateway: self.cleanup_workload_network({'network': network, 'gateway_id': gateway['id']})
 
@@ -458,6 +465,7 @@ class Backend:
             require(r is not None, "NOT_FOUND", "此 workspace 沒有該服務。")
             self.owned(r["container_id"])
             self.owned(r["ingress_id"])
+            if self.before_remove: self.before_remove(r)
             docker("container", "rm", "--force", r["ingress_id"], r["container_id"])
             del state["services"][key]
             self.save_state(state)
@@ -481,7 +489,7 @@ class Backend:
                     docker("network", "rm", network)
             return {"workspace": self.workspace, "removed_containers": len(ids)}
 
-    def invoke(self, kind, service, payload, *, path="/", timeout=None, expected_service_id=None):
+    def invoke(self, kind, service, payload, *, path="/", timeout=None, expected_service_id=None, trace_headers=None):
         limits = compute_limits(kind)
         if timeout is None: timeout = limits['timeoutSeconds']
         require(1 <= timeout <= limits["timeoutSeconds"], "INVALID_TIMEOUT", "請求期限超過此服務上限。")
@@ -499,7 +507,11 @@ class Backend:
                 return None
 
         opener = request.build_opener(request.ProxyHandler({}), NoRedirect())
-        req = request.Request(data["url"] + route, data=payload, headers={"Content-Type": "application/json"})
+        telemetry = dict(trace_headers or {})
+        require(set(telemetry) <= {'traceparent','x-cloud-trace-context','x-amzn-trace-id','x-request-id'}
+                and all(isinstance(v,str) and len(v)<256 and not re.search(r'[\r\n\x00]',v) for v in telemetry.values()),
+                'INVALID_INPUT','Invalid trace context.')
+        req = request.Request(data["url"] + route, data=payload, headers={"Content-Type": "application/json", **telemetry})
         try:
             try:
                 response = opener.open(req, timeout=timeout)

{fufu_cloud_cli-0.9.7 → fufu_cloud_cli-0.9.8}/src/fufu_cloud_cli/gcp_infra.py

@@ -135,7 +135,7 @@ def jobs_command(argv, Parser):
 
 
 def logging_command(argv, Parser):
-    p = Parser(prog='gcloud-fufu logging', description='持久化本機日誌；保留最近 10,000 筆，不含正式 Log Router、retention 或全容器 stdout。')
+    p = Parser(prog='gcloud-fufu logging', description='持久化日誌、容器 stdout／stderr、查詢及保留政策；Log Router sinks 與 alerts 尚未支援。')
     actions = p.add_subparsers(dest='action', required=True)
     q = actions.add_parser('write'); q.add_argument('log'); q.add_argument('message'); q.add_argument('--payload-type', choices=['text', 'json'], default='text'); q.add_argument('--severity', default='DEFAULT')
     q = actions.add_parser('read'); q.add_argument('filter', nargs='?', default=''); q.add_argument('--limit', type=int, default=50); q.add_argument('--order', choices=['asc', 'desc'], default='desc')
@@ -146,8 +146,8 @@ def logging_command(argv, Parser):
         project = 'projects/' + api.whoami()['projectId']
         if a.action == 'logs' and a.logs_action == 'list': return all_pages(api, 'logging', 'logs-list', {'parent': project}, 'logNames')
         if a.action == 'read':
-            require(1 <= a.limit <= 10000, 'INVALID_LIMIT', '日誌 limit 必須介於 1–10000。')
-            return all_pages(api, 'logging', 'read', {'resourceNames': [project], 'filter': a.filter, 'orderBy': 'timestamp ' + a.order, 'pageSize': min(a.limit, 1000)}, 'entries')[:a.limit]
+            from .observability import read_gcp_logs
+            return read_gcp_logs(api, {'resourceNames': [project], 'filter': a.filter, 'orderBy': 'timestamp ' + a.order}, a.limit)
         name = a.log if a.log.startswith('projects/') else project + '/logs/' + a.log
         if a.action == 'logs': return call(api, 'logging', 'logs-delete', {'logName': name})
         entry = {'severity': a.severity, 'jsonPayload' if a.payload_type == 'json' else 'textPayload': json.loads(a.message) if a.payload_type == 'json' else a.message}
@@ -166,6 +166,14 @@ MOCK_GROUPS = {
     ('compute', 'os-config', 'os-policy-assignments'): ('vm-policies', {'zone': 'zone', 'description': 'description'}),
     ('compute', 'networks', 'vpc-access', 'connectors'): ('vpc-connectors', {'network': 'network', 'range': 'range', 'min-instances': 'minInstances', 'max-instances': 'maxInstances'}),
     ('eventarc', 'triggers'): ('eventarc-triggers', {'location': 'location', 'destination-run-service': 'destination', 'event-filters': 'eventType', 'service-account': 'serviceAccount'}),
+    ('container', 'clusters'): ('gke-clusters', {'location': 'location', 'network': 'network', 'subnetwork': 'subnetwork', 'machine-type': 'machineType', 'num-nodes': 'numNodes', 'release-channel': 'releaseChannel', 'enable-private-nodes': 'enablePrivateNodes'}),
+    ('compute', 'firewall-rules'): ('firewall-rules', {'network': 'network', 'direction': 'direction', 'priority': 'priority', 'allow': 'allow', 'deny': 'deny', 'source-ranges': 'sourceRanges', 'destination-ranges': 'destinationRanges', 'target-tags': 'targetTags', 'disabled': 'disabled', 'description': 'description'}),
+    ('compute', 'health-checks'): ('health-checks', {'port': 'port', 'request-path': 'requestPath', 'check-interval': 'checkIntervalSec', 'timeout': 'timeoutSec', 'healthy-threshold': 'healthyThreshold', 'unhealthy-threshold': 'unhealthyThreshold', 'description': 'description'}),
+    ('compute', 'backend-services'): ('backend-services', {'protocol': 'protocol', 'health-checks': 'healthChecks', 'port-name': 'portName', 'timeout': 'timeoutSec', 'load-balancing-scheme': 'loadBalancingScheme', 'description': 'description'}),
+    ('compute', 'url-maps'): ('url-maps', {'default-service': 'defaultService', 'description': 'description'}),
+    ('compute', 'target-http-proxies'): ('target-http-proxies', {'url-map': 'urlMap', 'description': 'description'}),
+    ('compute', 'forwarding-rules'): ('forwarding-rules', {'target-http-proxy': 'targetHttpProxy', 'ports': 'ports', 'address': 'address', 'ip-protocol': 'ipProtocol', 'load-balancing-scheme': 'loadBalancingScheme', 'description': 'description'}),
+    ('redis', 'instances'): ('redis-instances', {'network': 'network', 'size': 'sizeGb', 'tier': 'tier', 'redis-version': 'redisVersion', 'display-name': 'displayName'}),
 }
 
 
@@ -176,18 +184,43 @@ def mock_command(argv, Parser):
     p = Parser(prog='gcloud-fufu ' + ' '.join(match), description='MOCK ONLY：只儲存配置，不建立或啟動真正資源。')
     actions = p.add_subparsers(dest='action', required=True)
     for action in ['create', 'update', 'describe', 'list', 'delete']:
+        if action == 'update' and service in {'url-maps', 'forwarding-rules'}: continue
         q = actions.add_parser(action)
-        if action != 'list': q.add_argument('name')
-        if action in {'create', 'update'}:
-            for flag, field in flags.items(): q.add_argument('--' + flag, dest=field, type=int if field in {'bootDiskSizeGb', 'storageSizeGb', 'mtu', 'minInstances', 'maxInstances'} else str)
+        if service == 'health-checks' and action in {'create', 'update'}:
+            protocols = q.add_subparsers(dest='protocol', required=True)
+            targets = [protocols.add_parser(protocol) for protocol in ['http', 'https', 'tcp']]
+        else: targets = [q]
+        for q in targets:
+            if service in {'health-checks', 'backend-services', 'url-maps', 'target-http-proxies', 'forwarding-rules'}:
+                q.add_argument('--global', dest='global_scope', action='store_true')
+            if action != 'list': q.add_argument('name')
+            if action in {'create', 'update'}:
+                for flag, field in flags.items():
+                    if service == 'health-checks' and field == 'requestPath' and q.prog.endswith(' tcp'): continue
+                    if field in {'disabled', 'enablePrivateNodes'}:
+                        group = q.add_mutually_exclusive_group()
+                        group.add_argument('--' + flag, dest=field, action='store_true', default=None)
+                        group.add_argument('--no-' + flag, dest=field, action='store_false')
+                    else: q.add_argument('--' + flag, dest=field, type=int if field in {'bootDiskSizeGb', 'storageSizeGb', 'mtu', 'minInstances', 'maxInstances', 'numNodes', 'priority', 'port', 'healthyThreshold', 'unhealthyThreshold', 'sizeGb'} else str)
     a = p.parse_args(argv[len(match):])
-    sys.stderr.write('FUFU MOCK ONLY: configuration is persisted; no VM, database, registry, DNS or network is provisioned.\n')
+    sys.stderr.write('FUFU MOCK ONLY: configuration is persisted; no infrastructure is provisioned or executed.\n')
     with ApiClient('gcp', read_only=a.action in {'list', 'describe'}) as api:
         if a.action == 'list': return all_pages(api, service, 'list', {}, 'items')
         params = {'name': a.name}
         if a.action in {'create', 'update'}:
-            config = {field: getattr(a, field) for field in flags.values() if getattr(a, field) is not None}
-            if service in {'sql-instances', 'subnets', 'vpc-connectors'}: config['region'] = os.environ.get('FUFU_SELECTED_REGION') or api.whoami()['region']
+            config = {field: getattr(a, field) for field in flags.values() if getattr(a, field, None) is not None}
+            for field in ['timeoutSec', 'checkIntervalSec']:
+                if field in config:
+                    import re
+                    value = str(config[field])
+                    require(re.fullmatch(r'[1-9][0-9]*(?:s)?', value), 'UNSUPPORTED_ARGUMENT', '配置子集的期限使用整數秒或 s。')
+                    config[field] = int(value.removesuffix('s'))
+            if service == 'health-checks': config['protocol'] = a.protocol.upper()
+            if service == 'redis-instances' and 'tier' in config:
+                require(config['tier'].lower() in {'basic', 'standard'}, 'UNSUPPORTED_ARGUMENT', 'Redis tier 使用 basic 或 standard。')
+                config['tier'] = 'BASIC' if config['tier'].lower() == 'basic' else 'STANDARD_HA'
+            if service in {'sql-instances', 'subnets', 'vpc-connectors', 'redis-instances'}: config['region'] = os.environ.get('FUFU_SELECTED_REGION') or api.whoami()['region']
+            if service == 'gke-clusters' and a.action == 'create': config.setdefault('location', os.environ.get('FUFU_SELECTED_REGION') or api.whoami()['region'])
             params['config'] = config
         return call(api, service, 'get' if a.action == 'describe' else a.action, params)