@vibesdotdev/infra-deploy 0.0.1

package/README.md

@@ -0,0 +1,125 @@
+# `@vibesdotdev/infra-deploy`
+
+User-facing infra-deploy surface for the vibes CLI. Authors write a
+`deployment.config.ts` next to their app; this package loads it and dispatches
+to a provider adapter that wraps the real provider tooling. Used both by
+end-users deploying their own apps to their own clouds, and by vibes itself
+to dogfood internal deploys.
+
+See [`SPEC.md`](./SPEC.md) for the contract.
+
+> Commands are available under `vibes infra deploy …`.
+
+## What's in here
+
+- `src/infra-deploy.plugin.ts` — `runtime/plugin` registering the `infra-deploy` CLI
+  group plus `infra-deploy.run` and `infra-deploy.list` commands and their loaders.
+- `src/config-loader.ts` — `loadDeploymentConfig(appDir)` resolves
+  `deployment.config.{ts,js,mjs}`, validates the export, and returns the
+  loaded shape used by every provider.
+- `src/providers/cloudflare-workers.ts` — `deployCloudflareWorkers()` shells
+  out to `bunx wrangler deploy --cwd <appDir>` from the workspace root.
+- `src/providers/digitalocean-app.ts` — `deployDigitalOceanApp()` calls the
+  DigitalOcean App Platform REST API v2 directly (no `doctl` dependency).
+  Requires `DIGITALOCEAN_API_TOKEN`.
+- `src/cli/` — `cli/group` and `cli/command` descriptors + impls for the
+  user-facing CLI surface.
+
+## Common usage
+
+Authoring a per-app deployment config (in
+`apps/<app>/deployment.config.ts`):
+
+```ts
+import { createAppDeployment } from '@vibesdotdev/infra-core/deployment';
+
+export default createAppDeployment({
+  appId: 'my-app',
+  appName: 'My App',
+  provider: 'cloudflare-workers',
+  runtime: 'edge',
+  build: {
+    appDir: 'apps/my-app',
+    outputDir: 'apps/my-app/.svelte-kit/cloudflare',
+    buildCommand: 'bun run build:my-app',
+    workspaceRootDir: '.'
+  },
+  origins: [/* ... */],
+  env: [/* ... */]
+});
+```
+
+Deploying from the CLI:
+
+```bash
+# List every app under cwd that has a deployment.config.{ts,js,mjs}
+vibes infra deploy list
+
+# Deploy a specific app
+vibes infra deploy run apps/my-app
+
+# Show the resolved provider request without uploading
+vibes infra deploy run apps/my-app --dry-run
+```
+
+Publishing npm packages through the same infra/secrets path:
+
+```bash
+# Store the token in the configured vibes secrets backend
+vibes secrets set NPM_TOKEN --environment production
+
+# Check the exact publish operation without requiring a token
+vibes infra npm publish packages/cli-bin packages/vibesdev --dry-run
+
+# Publish with a token resolved from vibes secrets
+vibes infra npm publish packages/cli-bin packages/vibesdev --environment production --yes
+```
+
+`vibes infra npm publish` packs each package first, then publishes the packed
+tarball from a temporary directory with a one-time npm config. The npm token is
+resolved from `vibes secrets` and is not written to the repo or a persistent
+user-level npm config. For local operator publishes targeting production, the
+command can read a production-scoped token from the encrypted-local backend.
+
+If a publish token needs to be available to a remote runner, sync only that
+key and dry-run first:
+
+```bash
+vibes secrets push --environment production --from encrypted-local --to cloudflare-secrets-store --key NPM_TOKEN --dry-run
+vibes secrets push --environment production --from encrypted-local --to cloudflare-secrets-store --key NPM_TOKEN
+```
+
+Pulling back from remote only works with backends that expose secret values
+(for example Vault). Cloudflare secrets backends are write-only:
+
+```bash
+vibes secrets pull --environment production --from vault --to encrypted-local --key NPM_TOKEN --dry-run
+vibes secrets pull --environment production --from vault --to encrypted-local --key NPM_TOKEN
+```
+
+Calling a provider directly (rare — most consumers should go through the CLI
+or the plugin):
+
+```ts
+import { loadDeploymentConfig } from '@vibesdotdev/infra-deploy/config-loader';
+import { deployCloudflareWorkers } from '@vibesdotdev/infra-deploy/providers/cloudflare-workers';
+
+const loaded = await loadDeploymentConfig('apps/my-app');
+if (loaded.provider === 'cloudflare-workers') {
+  await deployCloudflareWorkers({
+    appDir: loaded.appDir,
+    deployment: loaded.deployment,
+    raw: loaded.raw
+  });
+}
+```
+
+## Required environment
+
+- **Cloudflare Workers** — `bunx wrangler` must resolve, and wrangler must be
+  authenticated (`wrangler login` or `CLOUDFLARE_API_TOKEN`).
+- **DigitalOcean App Platform** — `DIGITALOCEAN_API_TOKEN` must be set on
+  the process. Generate a token at
+  [cloud.digitalocean.com/account/api/tokens](https://cloud.digitalocean.com/account/api/tokens).
+- **npm publish** — `NPM_TOKEN` must be set in `vibes secrets` for the selected
+  environment, or present in the process environment for CI.

package/SPEC.md

@@ -0,0 +1,181 @@
+# `@vibesdotdev/infra-deploy`
+
+User-facing infra-deploy surface for the vibes CLI. Anyone running `vibes` can
+declare a `deployment.config.ts` for their own app and ship it to their own
+cloud account — the package loads the config, **resolves the right
+`runtime/client` for the declared provider**, and asks it to run the deploy.
+Registered as a `runtime/plugin` consumed by
+[`apps/cli-bin`](../../apps/cli-bin/SPEC.md). Vibes uses the same surface to
+dogfood its own deploys. Commands are available under `vibes infra deploy …`.
+npm publishing support is available under `vibes infra npm …`.
+
+## Owns
+
+- `runtime/plugin` (`infra-deploy`): registers `cli/group` `infra-deploy` and `cli/command`
+  descriptors `infra-deploy.run`, `infra-deploy.list`, `infra-deploy.regenerate`,
+  `infra-logs`, plus `cli/group` `infra-npm` and `cli/command`
+  `infra-npm.publish`
+- **Config loader** (`./config-loader`): resolves
+  `deployment.config.{ts,js,mjs}` from an app dir, validates the exported
+  `AppDeployment`, returns
+  `{ configPath, appDir, deployment, provider, raw, managed, wranglerJsoncString, workerName }`
+- **wrangler.jsonc regen orchestrator** (`./regenerate`): `regenerateApp`,
+  `regenerateAll`, `regenExitCode`. Used by the CLI's
+  `vibes infra deploy regenerate` command and as the pre-deploy drift gate
+  in the CLI run handler. Comparison is read-only by default; `--write`
+  rewrites the on-disk file.
+- **CLI dispatch** (`./cli/run`): translates an `AppDeployment` plus operator
+  flags into the right `runtime/client` call. The dispatch knows the
+  provider → client-id map and nothing about provider internals:
+  - `provider: 'cloudflare-workers'` →
+    `getCloudflareWorkersDeployClient()` (from
+    `@vibesdotdev/connector-cloudflare/client`, runtime-client id
+    `cloudflare-workers-deploy`)
+  - `provider: 'digitalocean-app'` →
+    `getDigitalOceanAppDeployClient()` (from
+    `@vibesdotdev/infra-doks/client`, runtime-client id
+    `digitalocean-app-deploy`)
+- **Deployment-run records** (`storage/manifest<DeploymentRun>` id `infra-deploy.deployment-runs`): both
+  provider dispatch arms write a `DeploymentRun` row on dispatch — `{ appId,
+  provider, status: 'started' | 'succeeded' | 'failed', startedAt, finishedAt,
+  actorScope, deploymentConfigHash, providerResourceId, logsRef }`. Reads via
+  `runtime.query('storage/manifest').withId('infra-deploy.deployment-runs')`.
+  The manifest is registered by this package's plugin so any consumer (admin
+  UI, `vibes infra deploy list`, MCP) resolves it through runtime.
+- **npm publish command** (`./cli/npm`): packs package directories, resolves an
+  npm token through `secrets/store`, writes a temporary npm config outside the
+  repo, publishes the tarball with npm, and deletes the temporary config.
+
+## Does not own
+
+- `AppDeployment` schema → [`infra-core`](../infra-core/SPEC.md)
+  (`@vibesdotdev/infra-core/deployment`)
+- Per-app `deployment.config.ts` files — each app (vibes-internal or
+  end-user) authors its own
+- **The actual wrangler invocation** —
+  [`@vibesdotdev/connector-cloudflare`](../connector-cloudflare) owns the
+  `CloudflareWorkersDeployClient` (`runtime/client` id
+  `cloudflare-workers-deploy`). `infra-deploy` resolves it via
+  `getCloudflareWorkersDeployClient()`; it never imports
+  `node:child_process` or shells out to `wrangler` directly.
+- **The actual DigitalOcean App Platform API call** —
+  [`@vibesdotdev/infra-doks`](../infra-doks/SPEC.md) owns the
+  `DigitalOceanAppDeployClient` (`runtime/client` id
+  `digitalocean-app-deploy`). `infra-deploy` resolves it via
+  `getDigitalOceanAppDeployClient()`; it never calls
+  `https://api.digitalocean.com` directly.
+- Cloudflare runtime + tooling primitives →
+  [`infra-cloudflare`](../infra-cloudflare/SPEC.md)
+- DigitalOcean infrastructure primitives →
+  [`infra-doks`](../infra-doks/SPEC.md)
+- App build pipelines — the resolved deploy client runs each app's
+  `deployment.build.buildCommand` (or skips it when `skipBuild` is set)
+- Long-lived cloud-account credentials → end-state pulls from
+  [`packages/secrets`](../secrets/SPEC.md) (see migration debt)
+- CI/CD orchestration — this is a developer-local / ops-local CLI, not a
+  workflow runner
+- Long-lived npm token files. `vibes infra npm publish` may create an
+  ephemeral npm config in the OS temp directory for the duration of a publish,
+  but it must not write a token to the workspace or user-level npm config.
+
+## Hard rules
+
+- Provider dispatch is driven by `deployment.provider` from the loaded config.
+  The CLI never branches on `hardware` / `connectionMode` / `isCloud`.
+- Unsupported `provider` values are a hard failure: `ui.error` +
+  `process.exitCode = 1`. No silent default.
+- Provider work resolves via `runtime/client` lookups. The CLI does not
+  import provider adapter code directly. Adding a new provider means:
+  (1) the owning package registers a `runtime/client` descriptor + loader,
+  (2) the owning package exposes a typed `getXyzDeployClient()` helper, and
+  (3) the CLI dispatch case calls that helper. No new `./providers/<name>.ts`
+  in this package.
+- `loadDeploymentConfig` requires the resolved object to carry `appId` and a
+  string `provider`. Either missing is a hard failure.
+- Pre-deploy regen gate is mandatory for Cloudflare: the CLI run handler
+  calls `regenerateApp(appDir, { mode: 'check' })` and refuses to deploy on
+  `drift` or `error`. The gate is opt-in (`managed: true`) per app until
+  every app is migrated.
+- The package never redefines the `AppDeployment` schema. It imports the
+  type from `@vibesdotdev/infra-core/deployment`.
+- Both provider dispatch arms MUST write a `DeploymentRun` row through the
+  `infra-deploy.deployment-runs` manifest before invoking the resolved
+  client (status `started`) and on return (status `succeeded` or `failed`).
+  A dispatch arm that runs without recording a run is a hard violation —
+  there is no second history store, and downstream surfaces
+  (`/admin/deployments`, `vibes infra deploy list`) read from this
+  manifest only.
+- npm publish MUST pack first and publish the generated tarball from outside
+  the workspace so repo-level `.npmrc` settings cannot redirect public npm
+  packages to a private registry.
+- npm publish MUST require `--yes` for real publishes. `--dry-run` is allowed
+  without a token.
+- npm publish token remote sync, when needed, should use `vibes secrets push`
+  or `vibes secrets pull` with an explicit `--key NPM_TOKEN` filter and a
+  dry-run first. Cloudflare secrets backends are write-only and cannot be used
+  as pull sources for secret values.
+
+## Migration debt (not yet executed)
+
+- [x] **Rename.** `packages/deploy` → `packages/infra-deploy`;
+  `@vibesdotdev/deploy` → `@vibesdotdev/infra-deploy`.
+- [x] **CLI re-parent.** Commands now live under
+  `vibes infra deploy run` / `vibes infra deploy list` /
+  `vibes infra deploy regenerate`.
+- [x] **Dead flag.** `--commit-dirty` removed (was Pages-only; Pages provider
+  was removed).
+- [x] **Wildcard subpath.** `./providers/*` removed from `package.json#exports`.
+- [x] **Provider relocation.** `src/providers/*` deleted. Wrangler-invocation
+  logic moved to
+  `@vibesdotdev/connector-cloudflare/client/CloudflareWorkersDeployClient`;
+  DO App Platform logic moved to
+  `@vibesdotdev/infra-doks/client/DigitalOceanAppDeployClient`. Each is a
+  `runtime/client` descriptor registered by its owning plugin. The CLI run
+  handler resolves both via published helpers.
+- **MCP / agent tool surface.** Provider operations (deploy, list, plus future
+  `link-cloud-account`) should also register as `tools/tool` descriptors with
+  `purpose: ['direct', 'mcp', 'agent']` per the pattern in
+  [`packages/tools`](../tools/SPEC.md)
+  (`tool-help.descriptor.ts:11-17`), so end-users and agents can invoke
+  deploys via MCP. Zero `tools/tool` descriptors exist in this package today.
+- **Secrets integration.** `deployment.env` items marked `secret: true` are
+  forwarded as inline string values today by the DO client and ignored
+  entirely by the Cloudflare client. End-state: pull values via
+  [`packages/secrets`](../secrets/SPEC.md) and push them to provider secret
+  stores (`wrangler secret put` for Workers, `SECRET`-typed env on DO Apps).
+  Inline `value` should be the dev-only fallback, not the default. Lives
+  in the runtime-client implementations now.
+- **Cloud-account credential brokerage.** `DigitalOceanAppDeployClient`
+  reads `process.env.DIGITALOCEAN_API_TOKEN` directly
+  (`packages/infra-doks/src/client/digitalocean-app-deploy.client.ts`).
+  The `digitalocean-droplet` impl in
+  [`infra-doks`](../infra-doks/SPEC.md) faces the identical problem (same
+  env fallback). End-state: end-users connect their own Cloudflare /
+  DigitalOcean accounts through vibes auth +
+  [`packages/secrets`](../secrets/SPEC.md); both `DigitalOceanAppDeployClient`
+  and `do-droplet` resolve a shared
+  `cloud-credentials.digitalocean.token` secret key per actor scope. The
+  Cloudflare path inherits whatever `wrangler` finds — same shape, same
+  problem.
+
+## Public entrypoints
+
+`.`, `./plugin`, `./config-loader`, `./regenerate`.
+
+## Verification
+
+`bun --bun tsc -p tsconfig.json --noEmit` (the package's `check` script).
+Type-check only — no automated tests on disk; see
+PROD-CHECKLIST.md for the gap list.
+
+## Links
+
+- [infra-core/SPEC.md](../infra-core/SPEC.md)
+- [infra-cloudflare/SPEC.md](../infra-cloudflare/SPEC.md)
+- [infra-doks/SPEC.md](../infra-doks/SPEC.md)
+- [connector-cloudflare](../connector-cloudflare)
+- [secrets/SPEC.md](../secrets/SPEC.md)
+- [tools/SPEC.md](../tools/SPEC.md)
+- [runtime/SPEC.md](../runtime/SPEC.md)
+- [cli/SPEC.md](../cli/SPEC.md)
+- [cli-bin/SPEC.md](../../apps/cli-bin/SPEC.md)

package/dist/cli/alerts/infra-alerts-create.cli-command.descriptor.d.ts

@@ -0,0 +1,39 @@
+declare const _default: {
+    id: string;
+    kind: "cli/command";
+    name: string;
+    description: string;
+    group: string;
+    arguments: {
+        name: string;
+        description: string;
+        required: boolean;
+        variadic: boolean;
+    }[];
+    options: ({
+        flags: string;
+        description: string;
+        default?: undefined;
+        variadic?: undefined;
+    } | {
+        flags: string;
+        description: string;
+        default: string;
+        variadic?: undefined;
+    } | {
+        flags: string;
+        description: string;
+        variadic: boolean;
+        default?: undefined;
+    } | {
+        flags: string;
+        description: string;
+        default: boolean;
+        variadic?: undefined;
+    })[];
+    surfaces: string[];
+    hardware: string[];
+    enabled: true;
+};
+export default _default;
+//# sourceMappingURL=infra-alerts-create.cli-command.descriptor.d.ts.map

package/dist/cli/alerts/infra-alerts-create.cli-command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-alerts-create.cli-command.descriptor.d.ts","sourceRoot":"","sources":["../../../src/cli/alerts/infra-alerts-create.cli-command.descriptor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,wBA0DG"}

package/dist/cli/alerts/infra-alerts-create.cli-command.descriptor.js

@@ -0,0 +1,61 @@
+import { createRuntimeAsset } from '@vibesdotdev/runtime';
+export default createRuntimeAsset({
+    id: 'infra-alerts.create',
+    kind: 'cli/command',
+    name: 'create',
+    description: 'Create a new alert policy on the active provider',
+    group: 'infra-alerts',
+    arguments: [
+        {
+            name: 'type',
+            description: 'Alert type: budget | usage | error-rate | latency | custom',
+            required: true,
+            variadic: false
+        }
+    ],
+    options: [
+        { flags: '--name <name>', description: 'Policy name (defaults to "<type> alert: <threshold>")' },
+        {
+            flags: '--threshold <n>',
+            description: 'Threshold value (USD for budget; events/req/% per usage/error-rate)',
+            default: '50'
+        },
+        {
+            flags: '--window <window>',
+            description: 'Rolling window for usage/error-rate/latency (5m, 15m, 1h, 6h, 24h, 7d, 30d)'
+        },
+        {
+            flags: '--filter <k=v>',
+            description: 'Adapter-specific filter (repeatable, e.g. --filter product=workers_observability_paid_events)',
+            variadic: true
+        },
+        {
+            flags: '--email <addr>',
+            description: 'Email destination (repeatable)',
+            variadic: true
+        },
+        {
+            flags: '--webhook <url>',
+            description: 'Webhook destination (repeatable)',
+            variadic: true
+        },
+        {
+            flags: '--provider <id>',
+            description: 'Provider impl id (default: cloudflare-alerts when available)'
+        },
+        {
+            flags: '--disabled',
+            description: 'Create the policy in disabled state',
+            default: false
+        },
+        {
+            flags: '-o, --output <format>',
+            description: 'Output format (text|json)',
+            default: 'text'
+        }
+    ],
+    surfaces: ['cli'],
+    hardware: ['consumer', 'cloud'],
+    enabled: true
+});
+//# sourceMappingURL=infra-alerts-create.cli-command.descriptor.js.map

package/dist/cli/alerts/infra-alerts-create.cli-command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-alerts-create.cli-command.descriptor.js","sourceRoot":"","sources":["../../../src/cli/alerts/infra-alerts-create.cli-command.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,eAAe,kBAAkB,CAAC;IACjC,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,aAAa;IACnB,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,kDAAkD;IAC/D,KAAK,EAAE,cAAc;IACrB,SAAS,EAAE;QACV;YACC,IAAI,EAAE,MAAM;YACZ,WAAW,EAAE,4DAA4D;YACzE,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;SACf;KACD;IACD,OAAO,EAAE;QACR,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,uDAAuD,EAAE;QAChG;YACC,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,qEAAqE;YAClF,OAAO,EAAE,IAAI;SACb;QACD;YACC,KAAK,EAAE,mBAAmB;YAC1B,WAAW,EAAE,6EAA6E;SAC1F;QACD;YACC,KAAK,EAAE,gBAAgB;YACvB,WAAW,EAAE,+FAA+F;YAC5G,QAAQ,EAAE,IAAI;SACd;QACD;YACC,KAAK,EAAE,gBAAgB;YACvB,WAAW,EAAE,gCAAgC;YAC7C,QAAQ,EAAE,IAAI;SACd;QACD;YACC,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,kCAAkC;YAC/C,QAAQ,EAAE,IAAI;SACd;QACD;YACC,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,8DAA8D;SAC3E;QACD;YACC,KAAK,EAAE,YAAY;YACnB,WAAW,EAAE,qCAAqC;YAClD,OAAO,EAAE,KAAK;SACd;QACD;YACC,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,2BAA2B;YACxC,OAAO,EAAE,MAAM;SACf;KACD;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,IAAI;CACb,CAAC,CAAC"}

package/dist/cli/alerts/infra-alerts-create.cli-command.impl.d.ts

@@ -0,0 +1,13 @@
+/**
+ * `vibes infra alerts create <type> --threshold ... --email ...`
+ *
+ * Creates one policy on the chosen provider. Resolves the impl via the
+ * runtime, builds an `AlertPolicy` from CLI flags, and calls
+ * `impl.createPolicy(policy)`. Reports the provider-assigned id on
+ * success.
+ */
+declare const _default: {
+    execute(args: Record<string, unknown>, opts: Record<string, unknown>): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=infra-alerts-create.cli-command.impl.d.ts.map

package/dist/cli/alerts/infra-alerts-create.cli-command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-alerts-create.cli-command.impl.d.ts","sourceRoot":"","sources":["../../../src/cli/alerts/infra-alerts-create.cli-command.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;;kBAmCkB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;;AAD3F,wBAyFE"}

package/dist/cli/alerts/infra-alerts-create.cli-command.impl.js

@@ -0,0 +1,109 @@
+/**
+ * `vibes infra alerts create <type> --threshold ... --email ...`
+ *
+ * Creates one policy on the chosen provider. Resolves the impl via the
+ * runtime, builds an `AlertPolicy` from CLI flags, and calls
+ * `impl.createPolicy(policy)`. Reports the provider-assigned id on
+ * success.
+ */
+import { getVibesRuntime } from '@vibesdotdev/runtime';
+import { requestCLIExit } from '@vibesdotdev/cli/providers';
+function readString(v) {
+    return typeof v === 'string' && v.length > 0 ? v : undefined;
+}
+function readStringArray(v) {
+    if (Array.isArray(v))
+        return v.filter((x) => typeof x === 'string');
+    if (typeof v === 'string')
+        return [v];
+    return [];
+}
+const VALID_TYPES = new Set(['budget', 'usage', 'error-rate', 'latency', 'custom']);
+function parseFilters(raw) {
+    const out = {};
+    for (const entry of raw) {
+        const idx = entry.indexOf('=');
+        if (idx <= 0)
+            continue;
+        out[entry.slice(0, idx)] = entry.slice(idx + 1);
+    }
+    return out;
+}
+export default {
+    async execute(args, opts) {
+        const runtime = await getVibesRuntime();
+        const ui = (await runtime.context('cli/ui'));
+        const typeArg = readString(args.type);
+        if (!typeArg || !VALID_TYPES.has(typeArg)) {
+            ui.error(`Invalid alert type. Got "${typeArg ?? '(missing)'}". Expected one of: ${Array.from(VALID_TYPES).join(', ')}`);
+            requestCLIExit(1);
+            return;
+        }
+        const type = typeArg;
+        const thresholdRaw = readString(opts.threshold) ?? '50';
+        const threshold = Number(thresholdRaw);
+        if (!Number.isFinite(threshold) || threshold < 0) {
+            ui.error(`Invalid --threshold "${thresholdRaw}"; must be a non-negative number.`);
+            requestCLIExit(1);
+            return;
+        }
+        const emails = readStringArray(opts.email);
+        const webhooks = readStringArray(opts.webhook);
+        const mechanisms = [
+            ...emails.map((target) => ({ kind: 'email', target })),
+            ...webhooks.map((target) => ({ kind: 'webhook', target }))
+        ];
+        if (mechanisms.length === 0) {
+            ui.error('At least one --email or --webhook destination is required.');
+            requestCLIExit(1);
+            return;
+        }
+        const filters = parseFilters(readStringArray(opts.filter));
+        const name = readString(opts.name) ?? `${type} alert: ${threshold}`;
+        const window = readString(opts.window);
+        const enabled = !(opts.disabled === true || opts.disabled === 'true');
+        const output = readString(opts.output) ?? 'text';
+        const providerFilter = readString(opts.provider);
+        const policy = {
+            name,
+            type,
+            threshold,
+            window,
+            filters,
+            mechanisms,
+            enabled
+        };
+        if (!runtime.hasKind('infra/alerts')) {
+            ui.error('infra/alerts kind not registered. Load a provider plugin (e.g. infra-cloudflare).');
+            requestCLIExit(1);
+            return;
+        }
+        const descriptors = runtime.assets('infra/alerts').descriptors();
+        const target = providerFilter
+            ? descriptors.find((d) => d.adapter === providerFilter || d.id === providerFilter)
+            : descriptors[0];
+        if (!target) {
+            ui.error(`No matching alerts provider${providerFilter ? ` for --provider "${providerFilter}"` : ''}.`);
+            requestCLIExit(1);
+            return;
+        }
+        try {
+            const impl = (await runtime
+                .query('infra/alerts')
+                .withId(target.id)
+                .resolve());
+            const { providerId } = await impl.createPolicy(policy);
+            if (output === 'json') {
+                ui.json({ provider: target.adapter, providerId, policy });
+            }
+            else {
+                ui.success(`Created ${type} policy "${name}" on ${target.adapter} → providerId=${providerId}`);
+            }
+        }
+        catch (err) {
+            ui.error(`Failed to create policy: ${err instanceof Error ? err.message : String(err)}`);
+            requestCLIExit(1);
+        }
+    }
+};
+//# sourceMappingURL=infra-alerts-create.cli-command.impl.js.map

package/dist/cli/alerts/infra-alerts-create.cli-command.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-alerts-create.cli-command.impl.js","sourceRoot":"","sources":["../../../src/cli/alerts/infra-alerts-create.cli-command.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAkB,MAAM,4BAA4B,CAAC;AAS5E,SAAS,UAAU,CAAC,CAAU;IAC7B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC;AAED,SAAS,eAAe,CAAC,CAAU;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACjF,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACtC,OAAO,EAAE,CAAC;AACX,CAAC;AAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE/F,SAAS,YAAY,CAAC,GAAa;IAClC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,GAAG,IAAI,CAAC;YAAE,SAAS;QACvB,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,eAAe;IACd,KAAK,CAAC,OAAO,CAAC,IAA6B,EAAE,IAA6B;QACzE,MAAM,OAAO,GAAG,MAAM,eAAe,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAc,CAAC;QAE1D,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAoB,CAAC,EAAE,CAAC;YACxD,EAAE,CAAC,KAAK,CACP,4BAA4B,OAAO,IAAI,WAAW,uBAAuB,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7G,CAAC;YACF,cAAc,CAAC,CAAC,CAAC,CAAC;YAClB,OAAO;QACR,CAAC;QACD,MAAM,IAAI,GAAG,OAAoB,CAAC;QAElC,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;QACxD,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAClD,EAAE,CAAC,KAAK,CAAC,wBAAwB,YAAY,mCAAmC,CAAC,CAAC;YAClF,cAAc,CAAC,CAAC,CAAC,CAAC;YAClB,OAAO;QACR,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAqB;YACpC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAkB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YACtE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAkB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;SAC1E,CAAC;QACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,EAAE,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;YACvE,cAAc,CAAC,CAAC,CAAC,CAAC;YAClB,OAAO;QACR,CAAC;QAED,MAAM,OAAO,GAAG,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,WAAW,SAAS,EAAE,CAAC;QACpE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAsC,CAAC;QAC5E,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;QACjD,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEjD,MAAM,MAAM,GAAgB;YAC3B,IAAI;YACJ,IAAI;YACJ,SAAS;YACT,MAAM;YACN,OAAO;YACP,UAAU;YACV,OAAO;SACP,CAAC;QAEF,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YACtC,EAAE,CAAC,KAAK,CAAC,mFAAmF,CAAC,CAAC;YAC9F,cAAc,CAAC,CAAC,CAAC,CAAC;YAClB,OAAO;QACR,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,WAAW,EAA6B,CAAC;QAC5F,MAAM,MAAM,GAAG,cAAc;YAC5B,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,cAAc,IAAI,CAAC,CAAC,EAAE,KAAK,cAAc,CAAC;YAClF,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAElB,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,EAAE,CAAC,KAAK,CACP,8BAA8B,cAAc,CAAC,CAAC,CAAC,oBAAoB,cAAc,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAC5F,CAAC;YACF,cAAc,CAAC,CAAC,CAAC,CAAC;YAClB,OAAO;QACR,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO;iBACzB,KAAK,CAAC,cAAc,CAAC;iBACrB,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;iBACjB,OAAO,EAAE,CAAyB,CAAC;YACrC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAEvD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACvB,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3D,CAAC;iBAAM,CAAC;gBACP,EAAE,CAAC,OAAO,CACT,WAAW,IAAI,YAAY,IAAI,QAAQ,MAAM,CAAC,OAAO,iBAAiB,UAAU,EAAE,CAClF,CAAC;YACH,CAAC;QACF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,EAAE,CAAC,KAAK,CAAC,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzF,cAAc,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;IACF,CAAC;CACD,CAAC"}

package/dist/cli/alerts/infra-alerts-delete.cli-command.descriptor.d.ts

@@ -0,0 +1,31 @@
+declare const _default: {
+    id: string;
+    kind: "cli/command";
+    name: string;
+    description: string;
+    group: string;
+    arguments: {
+        name: string;
+        description: string;
+        required: boolean;
+        variadic: boolean;
+    }[];
+    options: ({
+        flags: string;
+        description: string;
+        default?: undefined;
+    } | {
+        flags: string;
+        description: string;
+        default: boolean;
+    } | {
+        flags: string;
+        description: string;
+        default: string;
+    })[];
+    surfaces: string[];
+    hardware: string[];
+    enabled: true;
+};
+export default _default;
+//# sourceMappingURL=infra-alerts-delete.cli-command.descriptor.d.ts.map

package/dist/cli/alerts/infra-alerts-delete.cli-command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-alerts-delete.cli-command.descriptor.d.ts","sourceRoot":"","sources":["../../../src/cli/alerts/infra-alerts-delete.cli-command.descriptor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,wBAiCG"}

package/dist/cli/alerts/infra-alerts-delete.cli-command.descriptor.js

@@ -0,0 +1,36 @@
+import { createRuntimeAsset } from '@vibesdotdev/runtime';
+export default createRuntimeAsset({
+    id: 'infra-alerts.delete',
+    kind: 'cli/command',
+    name: 'delete',
+    description: 'Delete an alert policy by provider id',
+    group: 'infra-alerts',
+    arguments: [
+        {
+            name: 'providerId',
+            description: 'Policy id on the provider (from `vibes infra alerts list`)',
+            required: true,
+            variadic: false
+        }
+    ],
+    options: [
+        {
+            flags: '--provider <id>',
+            description: 'Provider impl id (default: cloudflare-alerts when available)'
+        },
+        {
+            flags: '-y, --yes',
+            description: 'Skip confirmation prompt',
+            default: false
+        },
+        {
+            flags: '-o, --output <format>',
+            description: 'Output format (text|json)',
+            default: 'text'
+        }
+    ],
+    surfaces: ['cli'],
+    hardware: ['consumer', 'cloud'],
+    enabled: true
+});
+//# sourceMappingURL=infra-alerts-delete.cli-command.descriptor.js.map

package/dist/cli/alerts/infra-alerts-delete.cli-command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-alerts-delete.cli-command.descriptor.js","sourceRoot":"","sources":["../../../src/cli/alerts/infra-alerts-delete.cli-command.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,eAAe,kBAAkB,CAAC;IACjC,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,aAAa;IACnB,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,uCAAuC;IACpD,KAAK,EAAE,cAAc;IACrB,SAAS,EAAE;QACV;YACC,IAAI,EAAE,YAAY;YAClB,WAAW,EAAE,4DAA4D;YACzE,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;SACf;KACD;IACD,OAAO,EAAE;QACR;YACC,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,8DAA8D;SAC3E;QACD;YACC,KAAK,EAAE,WAAW;YAClB,WAAW,EAAE,0BAA0B;YACvC,OAAO,EAAE,KAAK;SACd;QACD;YACC,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,2BAA2B;YACxC,OAAO,EAAE,MAAM;SACf;KACD;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,IAAI;CACb,CAAC,CAAC"}

package/dist/cli/alerts/infra-alerts-delete.cli-command.impl.d.ts

@@ -0,0 +1,11 @@
+/**
+ * `vibes infra alerts delete <providerId>`
+ *
+ * Deletes a policy on the chosen provider. Requires explicit
+ * confirmation unless `--yes` is passed.
+ */
+declare const _default: {
+    execute(args: Record<string, unknown>, opts: Record<string, unknown>): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=infra-alerts-delete.cli-command.impl.d.ts.map

package/dist/cli/alerts/infra-alerts-delete.cli-command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-alerts-delete.cli-command.impl.d.ts","sourceRoot":"","sources":["../../../src/cli/alerts/infra-alerts-delete.cli-command.impl.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;;kBAekB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;;AAD3F,wBAuDE"}