@vibesdotdev/infra-deploy 0.0.2 → 1.0.0-rc.4

package/dist/cli/release/cli/latest-manifest.js

@@ -0,0 +1,152 @@
+/**
+ * `downloads/cli/latest.json` — the release artifact `vibes update --self`
+ * reads (plan §5.1, WU-12 row 12).
+ *
+ * ### One writer, one reader, and the reader is the schema that matters
+ *
+ * The SHIPPING READER is `parseLatestManifest` / `selectAsset` in
+ * `@vibesdotdev/plugins` `src/cli/self-update.ts`. It is deliberately
+ * hand-written and defensive because a release manifest fetched over the
+ * network is untrusted input, and it is NOT imported here: `@vibesdotdev/plugins`
+ * is the host that mounts this package's CLI group, so a dependency edge from
+ * `infra-deploy` back to it would invert the composition layering for the sake
+ * of a type.
+ *
+ * The two are therefore held together by an executable proof rather than by a
+ * shared symbol, and the proof lives in the one package that already depends on
+ * BOTH — the CLI binary that ships them together:
+ *
+ *   `apps/cli-bin/src/__tests__/release-latest-manifest.contract.test.ts`
+ *
+ * imports `buildLatestManifest` from here (via this package's
+ * `./release/latest-manifest` export) and `parseLatestManifest` / `selectAsset`
+ * from `@vibesdotdev/plugins/cli/self-update`, feeds the reader the exact bytes
+ * this module writes, and asserts the version, every selected asset URL, every
+ * sha256, and that both halves reject the same broken manifest. A schema drift
+ * this file's own zod check accepts but the shipping reader silently drops
+ * fails `bun test` in cli-bin — no network, no built matrix, no credential.
+ *
+ * WHAT THAT TEST DOES NOT COVER, stated so nobody mistakes it for coverage it
+ * has not got: the END-TO-END path — publish, serve, `vibes update --self`
+ * fetches the URL and names the digest it would verify — is NOT automated. It
+ * was measured by hand on 2026-08-31 against the real six-target `dist/` served
+ * over loopback (WU-12 receipt). The place to automate it is a
+ * `release.latest-manifest` case in `cli-bin/scripts/smoke-shipping.ts`, which
+ * runs the shipping binary; that case does not exist yet and cli-bin owns
+ * adding it.
+ *
+ * `LatestManifestSchema` below is the WRITER's contract: the release command
+ * validates its own output before writing, so a malformed `latest.json` is
+ * never published in the first place. It is intentionally a strict superset of
+ * nothing — every field the reader requires is required here, in the reader's
+ * spelling.
+ *
+ * ### Why `platform`/`arch` are Node spellings and not the release target id
+ *
+ * `selectAsset` matches on `process.platform` / `process.arch` of the running
+ * binary (`darwin|linux|win32` × `arm64|x64`). The release target ids in
+ * `build.ts` happen to be `<platform>-<arch>` in exactly those spellings, so
+ * the split is mechanical — but it is done ONCE, here, and asserted, rather
+ * than left as a coincidence two files rely on.
+ *
+ * ### Why the URL is absolute
+ *
+ * `--self` fetches `asset.url` directly. A relative key would make the reader
+ * re-derive the origin, which is how a mirror (`VIBES_MIRROR`) silently starts
+ * downloading from production. The manifest names the exact bytes it was
+ * generated for, origin included.
+ */
+import { z } from 'zod';
+/** Object key (and local filename) of the release manifest. */
+export const LATEST_MANIFEST_FILENAME = 'latest.json';
+const NODE_PLATFORMS = ['darwin', 'linux', 'win32'];
+const NODE_ARCHES = ['arm64', 'x64'];
+export const LatestManifestAssetSchema = z.object({
+    /** `process.platform` of the binary this asset runs on. */
+    platform: z.enum(NODE_PLATFORMS),
+    /** `process.arch` of the binary this asset runs on. */
+    arch: z.enum(NODE_ARCHES),
+    /** Absolute download URL. */
+    url: z.url(),
+    /** Lowercase hex sha256 — the same digest `SHA256SUMS.txt` carries. */
+    sha256: z.string().regex(/^[0-9a-f]{64}$/),
+    size: z.number().int().positive()
+});
+export const LatestManifestSchema = z.object({
+    version: z.string().min(1),
+    /** ISO-8601 instant the manifest was generated. */
+    generatedAt: z.string().min(1),
+    assets: z.array(LatestManifestAssetSchema).min(1)
+});
+/**
+ * Split a release target id (`darwin-arm64`, `win32-x64`) into the
+ * `process.platform` / `process.arch` pair `selectAsset` matches on.
+ * Returns `null` for an id this manifest cannot describe, so an unknown target
+ * is DROPPED with a named reason rather than published as an asset no reader
+ * can select.
+ */
+export function splitReleaseTargetId(id) {
+    const separator = id.lastIndexOf('-');
+    if (separator <= 0)
+        return null;
+    const platformRaw = id.slice(0, separator);
+    const archRaw = id.slice(separator + 1);
+    const parsedPlatform = LatestManifestAssetSchema.shape.platform.safeParse(platformRaw);
+    if (!parsedPlatform.success)
+        return null;
+    const parsedArch = LatestManifestAssetSchema.shape.arch.safeParse(archRaw);
+    if (!parsedArch.success)
+        return null;
+    return {
+        platform: parsedPlatform.data,
+        arch: parsedArch.data
+    };
+}
+/**
+ * Build (and validate) the release manifest.
+ *
+ * Throws when the result would not satisfy {@link LatestManifestSchema} —
+ * including the case where every target was skipped, because an assets-less
+ * manifest is one the shipping reader rejects with `lists no verifiable
+ * assets`, and publishing it would replace a working manifest with a broken
+ * one.
+ */
+export function buildLatestManifest(input) {
+    const assets = [];
+    const skipped = [];
+    const base = input.baseUrl.replace(/\/+$/, '');
+    for (const { targetId, record } of input.binaries) {
+        const split = splitReleaseTargetId(targetId);
+        if (!split) {
+            skipped.push({
+                targetId,
+                reason: `not a <process.platform>-<process.arch> pair (${NODE_PLATFORMS.join('|')} × ${NODE_ARCHES.join('|')})`
+            });
+            continue;
+        }
+        assets.push({
+            platform: split.platform,
+            arch: split.arch,
+            url: `${base}/${record.name}`,
+            sha256: record.sha256,
+            size: record.size
+        });
+    }
+    const candidate = {
+        version: input.version,
+        generatedAt: (input.now ?? new Date()).toISOString(),
+        assets
+    };
+    const parsed = LatestManifestSchema.safeParse(candidate);
+    if (!parsed.success) {
+        throw new Error(`latest.json would not validate against its own schema: ${parsed.error.issues
+            .map((issue) => `${issue.path.join('.') || '(root)'}: ${issue.message}`)
+            .join('; ')}`);
+    }
+    return {
+        manifest: parsed.data,
+        skipped,
+        json: `${JSON.stringify(parsed.data, null, 2)}\n`
+    };
+}
+//# sourceMappingURL=latest-manifest.js.map

package/dist/cli/release/cli/latest-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"latest-manifest.js","sourceRoot":"","sources":["../../../../src/cli/release/cli/latest-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,+DAA+D;AAC/D,MAAM,CAAC,MAAM,wBAAwB,GAAG,aAAa,CAAC;AAEtD,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAU,CAAC;AAC7D,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,KAAK,CAAU,CAAC;AAE9C,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,2DAA2D;IAC3D,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IAChC,uDAAuD;IACvD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IACzB,6BAA6B;IAC7B,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE;IACZ,uEAAuE;IACvE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,mDAAmD;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACjD,CAAC,CAAC;AAKH;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CACnC,EAAU;IAEV,MAAM,SAAS,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,WAAW,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IACxC,MAAM,cAAc,GAAG,yBAAyB,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACvF,IAAI,CAAC,cAAc,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,UAAU,GAAG,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC3E,IAAI,CAAC,UAAU,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO;QACN,QAAQ,EAAE,cAAc,CAAC,IAAI;QAC7B,IAAI,EAAE,UAAU,CAAC,IAAI;KACrB,CAAC;AACH,CAAC;AAuBD;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAA+B;IAClE,MAAM,MAAM,GAA0B,EAAE,CAAC;IACzC,MAAM,OAAO,GAA2C,EAAE,CAAC;IAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAE/C,KAAK,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC;gBACZ,QAAQ;gBACR,MAAM,EAAE,iDAAiD,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;aAC/G,CAAC,CAAC;YACH,SAAS;QACV,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACX,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,EAAE,GAAG,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE;YAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI;SACjB,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG;QACjB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;QACpD,MAAM;KACN,CAAC;IACF,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACd,0DAA0D,MAAM,CAAC,KAAK,CAAC,MAAM;aAC3E,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;aACvE,IAAI,CAAC,IAAI,CAAC,EAAE,CACd,CAAC;IACH,CAAC;IACD,OAAO;QACN,QAAQ,EAAE,MAAM,CAAC,IAAI;QACrB,OAAO;QACP,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;KACjD,CAAC;AACH,CAAC"}

package/dist/cli/rollback/infra-deploy.rollback.cli-command.descriptor.d.ts

@@ -0,0 +1,41 @@
+declare const _default: {
+    readonly id: "infra-deploy.rollback";
+    readonly kind: "cli/command";
+    readonly name: "rollback";
+    readonly description: string;
+    readonly group: "infra-deploy";
+    readonly arguments: [{
+        readonly name: "path";
+        readonly description: "App directory that declares the deployment (defaults to cwd)";
+        readonly required: false;
+        readonly variadic: false;
+    }];
+    readonly options: [{
+        readonly flags: "--to <version-id>";
+        readonly description: "Version to serve at 100% (must appear in the version list)";
+    }, {
+        readonly flags: "--message <text>";
+        readonly description: "Deployment message recorded with the rollback";
+    }, {
+        readonly flags: "--environment <name>";
+        readonly description: "Vibes environment: selects the deployed unit (as deploy does) and its provider credentials";
+    }, {
+        readonly flags: "--accept-current-container-image";
+        readonly description: "Required when the deployed unit declares containers: their image does not roll back";
+    }, {
+        readonly flags: "--dry-run";
+        readonly description: "List versions and print the provider command without changing traffic";
+    }, {
+        readonly flags: "-y, --yes";
+        readonly description: "Required to change traffic (non-interactive write gate)";
+    }, {
+        readonly flags: "-o, --output <format>";
+        readonly description: "Output format (text|json)";
+        readonly default: "text";
+    }];
+    readonly surfaces: ["cli"];
+    readonly hardware: ["consumer", "cloud"];
+    readonly enabled: true;
+};
+export default _default;
+//# sourceMappingURL=infra-deploy.rollback.cli-command.descriptor.d.ts.map

package/dist/cli/rollback/infra-deploy.rollback.cli-command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-deploy.rollback.cli-command.descriptor.d.ts","sourceRoot":"","sources":["../../../src/cli/rollback/infra-deploy.rollback.cli-command.descriptor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,wBAiDG"}

package/dist/cli/rollback/infra-deploy.rollback.cli-command.descriptor.js

@@ -0,0 +1,49 @@
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+export default createRuntimeAsset({
+    id: 'infra-deploy.rollback',
+    kind: 'cli/command',
+    name: 'rollback',
+    description: "Return an app to a previously deployed version through its deployment provider. Lists " +
+        'recent versions and deployments; --dry-run prints the exact provider command; ' +
+        'executing requires --to <version-id> and --yes.',
+    group: 'infra-deploy',
+    arguments: [
+        {
+            name: 'path',
+            description: 'App directory that declares the deployment (defaults to cwd)',
+            required: false,
+            variadic: false
+        }
+    ],
+    options: [
+        {
+            flags: '--to <version-id>',
+            description: 'Version to serve at 100% (must appear in the version list)'
+        },
+        {
+            flags: '--message <text>',
+            description: 'Deployment message recorded with the rollback'
+        },
+        {
+            flags: '--environment <name>',
+            description: 'Vibes environment: selects the deployed unit (as deploy does) and its provider credentials'
+        },
+        {
+            flags: '--accept-current-container-image',
+            description: 'Required when the deployed unit declares containers: their image does not roll back'
+        },
+        {
+            flags: '--dry-run',
+            description: 'List versions and print the provider command without changing traffic'
+        },
+        {
+            flags: '-y, --yes',
+            description: 'Required to change traffic (non-interactive write gate)'
+        },
+        { flags: '-o, --output <format>', description: 'Output format (text|json)', default: 'text' }
+    ],
+    surfaces: ['cli'],
+    hardware: ['consumer', 'cloud'],
+    enabled: true
+});
+//# sourceMappingURL=infra-deploy.rollback.cli-command.descriptor.js.map

package/dist/cli/rollback/infra-deploy.rollback.cli-command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-deploy.rollback.cli-command.descriptor.js","sourceRoot":"","sources":["../../../src/cli/rollback/infra-deploy.rollback.cli-command.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,eAAe,kBAAkB,CAAC;IACjC,EAAE,EAAE,uBAAuB;IAC3B,IAAI,EAAE,aAAa;IACnB,IAAI,EAAE,UAAU;IAChB,WAAW,EACV,wFAAwF;QACxF,gFAAgF;QAChF,iDAAiD;IAClD,KAAK,EAAE,cAAc;IACrB,SAAS,EAAE;QACV;YACC,IAAI,EAAE,MAAM;YACZ,WAAW,EAAE,8DAA8D;YAC3E,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,KAAK;SACf;KACD;IACD,OAAO,EAAE;QACR;YACC,KAAK,EAAE,mBAAmB;YAC1B,WAAW,EAAE,4DAA4D;SACzE;QACD;YACC,KAAK,EAAE,kBAAkB;YACzB,WAAW,EAAE,+CAA+C;SAC5D;QACD;YACC,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EACV,4FAA4F;SAC7F;QACD;YACC,KAAK,EAAE,kCAAkC;YACzC,WAAW,EACV,qFAAqF;SACtF;QACD;YACC,KAAK,EAAE,WAAW;YAClB,WAAW,EAAE,uEAAuE;SACpF;QACD;YACC,KAAK,EAAE,WAAW;YAClB,WAAW,EAAE,yDAAyD;SACtE;QACD,EAAE,KAAK,EAAE,uBAAuB,EAAE,WAAW,EAAE,2BAA2B,EAAE,OAAO,EAAE,MAAM,EAAE;KAC7F;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,IAAI;CACb,CAAC,CAAC"}

package/dist/cli/rollback/infra-deploy.rollback.cli-command.impl.d.ts

@@ -0,0 +1,16 @@
+/**
+ * `vibes infra deploy rollback` — return an app to a known deployed version.
+ *
+ * A failed deploy must be recoverable through the same owner that deployed it.
+ * Before this command the only lever was a direct provider call, which is how
+ * the 2026-09-25 Forge CI worker restore had to be done. The app's
+ * `infra/deployment-provider` owns its versions and the command that serves
+ * one; credentials resolve exactly as deploy resolves them and never enter
+ * process.env. A provider that keeps no versions refuses.
+ */
+import type { CommandContext, CommandOptions } from '@vibesdotdev/cli';
+declare const _default: {
+    execute(args: CommandOptions, opts: CommandOptions, context: CommandContext): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=infra-deploy.rollback.cli-command.impl.d.ts.map

package/dist/cli/rollback/infra-deploy.rollback.cli-command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-deploy.rollback.cli-command.impl.d.ts","sourceRoot":"","sources":["../../../src/cli/rollback/infra-deploy.rollback.cli-command.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;;kBAW/D,cAAc,QACd,cAAc,WACX,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC;;AALjB,wBAsCE"}

package/dist/cli/rollback/infra-deploy.rollback.cli-command.impl.js

@@ -0,0 +1,52 @@
+/**
+ * `vibes infra deploy rollback` — return an app to a known deployed version.
+ *
+ * A failed deploy must be recoverable through the same owner that deployed it.
+ * Before this command the only lever was a direct provider call, which is how
+ * the 2026-09-25 Forge CI worker restore had to be done. The app's
+ * `infra/deployment-provider` owns its versions and the command that serves
+ * one; credentials resolve exactly as deploy resolves them and never enter
+ * process.env. A provider that keeps no versions refuses.
+ */
+import { getRuntimePath } from '@vibesdotdev/paths';
+import { requireRuntimeCwd } from '@vibesdotdev/kernel';
+import { DeploymentRollbackOutcomeSchema } from '@vibesdotdev/infra-core/kinds';
+import { loadDeploymentConfig } from "../../config-loader.js";
+import { normalizeDeploymentEnvironment } from '@vibesdotdev/infra-core/deployment-environment';
+import { deploymentModuleEvaluation, providerOptions, resolveDeploymentProvider } from "../run/deployment-provider.js";
+import { readCredentialSource } from "../shared/credential-source.js";
+import { readString } from "../shared/option-strings.js";
+export default {
+    async execute(args, opts, context) {
+        const { runtime } = context;
+        const ui = await runtime.context('cli/ui');
+        const paths = await getRuntimePath(runtime);
+        const appDir = paths.resolve(requireRuntimeCwd(runtime), readString(args.path) ?? '.');
+        const loaded = await loadDeploymentConfig(appDir, { runtime, projectionEnvironment: {} });
+        const { implementation } = await resolveDeploymentProvider(runtime, loaded.provider);
+        const outcome = DeploymentRollbackOutcomeSchema.parse(await implementation.rollback({
+            appDir: loaded.appDir,
+            deployment: loaded.deployment,
+            module: deploymentModuleEvaluation(loaded),
+            environment: normalizeDeploymentEnvironment(readString(opts.environment)),
+            credentialSource: readCredentialSource(opts),
+            to: readString(opts.to),
+            message: readString(opts.message),
+            dryRun: opts.dryRun === true,
+            yes: opts.yes === true,
+            options: providerOptions(opts),
+            log: ui
+        }));
+        if (readString(opts.output) === 'json') {
+            ui.json(outcome);
+            return;
+        }
+        ui.info(`${outcome.unit}: serving ${outcome.serving
+            .map((entry) => `${entry.versionId}@${entry.percentage}%`)
+            .join(', ') || 'unknown'}`);
+        for (const version of outcome.versions.slice(-10)) {
+            ui.log(`  ${version.id}  ${version.createdOn ?? ''}  ${version.message ?? ''}`);
+        }
+    }
+};
+//# sourceMappingURL=infra-deploy.rollback.cli-command.impl.js.map

package/dist/cli/rollback/infra-deploy.rollback.cli-command.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-deploy.rollback.cli-command.impl.js","sourceRoot":"","sources":["../../../src/cli/rollback/infra-deploy.rollback.cli-command.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAGxD,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,8BAA8B,EAAE,MAAM,gDAAgD,CAAC;AAChG,OAAO,EAAE,0BAA0B,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AACvH,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD,eAAe;IACd,KAAK,CAAC,OAAO,CACZ,IAAoB,EACpB,IAAoB,EACpB,OAAuB;QAEvB,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAC5B,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,CAAY,QAAQ,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QACvF,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1F,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,yBAAyB,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrF,MAAM,OAAO,GAAG,+BAA+B,CAAC,KAAK,CAAC,MAAM,cAAc,CAAC,QAAQ,CAAC;YACnF,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,0BAA0B,CAAC,MAAM,CAAC;YAC1C,WAAW,EAAE,8BAA8B,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACzE,gBAAgB,EAAE,oBAAoB,CAAC,IAAI,CAAC;YAC5C,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;YACjC,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI;YAC5B,GAAG,EAAE,IAAI,CAAC,GAAG,KAAK,IAAI;YACtB,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC;YAC9B,GAAG,EAAE,EAAE;SACP,CAAC,CAAC,CAAC;QACJ,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;YACxC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjB,OAAO;QACR,CAAC;QACD,EAAE,CAAC,IAAI,CACN,GAAG,OAAO,CAAC,IAAI,aAAa,OAAO,CAAC,OAAO;aACzC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC;aACzD,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,EAAE,CAC3B,CAAC;QACF,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACnD,EAAE,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,SAAS,IAAI,EAAE,KAAK,OAAO,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;IACF,CAAC;CACD,CAAC"}

package/dist/cli/rum/infra-rum-status.cli-command.descriptor.d.ts

@@ -1,21 +1,23 @@
 declare const _default: {
-    id: string;
-    kind: "cli/command";
-    name: string;
-    description: string;
-    group: string;
-    options: ({
-        flags: string;
-        description: string;
-        default?: undefined;
-    } | {
-        flags: string;
-        description: string;
-        default: string;
-    })[];
-    surfaces: string[];
-    hardware: string[];
-    enabled: true;
+    readonly id: "infra-rum.status";
+    readonly kind: "cli/command";
+    readonly name: "status";
+    readonly description: "List configured RUM sites + injection mode across providers";
+    readonly group: "infra-rum";
+    readonly options: [{
+        readonly flags: "--provider <id>";
+        readonly description: "Provider impl id (default: cloudflare-web-analytics)";
+    }, {
+        readonly flags: "--environment <name>";
+        readonly description: "Vibes environment for secret resolution (local|dev|staging|production)";
+    }, {
+        readonly flags: "-o, --output <format>";
+        readonly description: "Output format (text|json)";
+        readonly default: "text";
+    }];
+    readonly surfaces: ["cli"];
+    readonly hardware: ["consumer", "cloud"];
+    readonly enabled: true;
 };
 export default _default;
 //# sourceMappingURL=infra-rum-status.cli-command.descriptor.d.ts.map

package/dist/cli/rum/infra-rum-status.cli-command.descriptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"infra-rum-status.cli-command.descriptor.d.ts","sourceRoot":"","sources":["../../../src/cli/rum/infra-rum-status.cli-command.descriptor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAEA,wBAwBG"}
+{"version":3,"file":"infra-rum-status.cli-command.descriptor.d.ts","sourceRoot":"","sources":["../../../src/cli/rum/infra-rum-status.cli-command.descriptor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAEA,wBAwBG"}

package/dist/cli/rum/infra-rum-status.cli-command.descriptor.js

@@ -1,4 +1,4 @@
-import { createRuntimeAsset } from '@vibesdotdev/runtime';
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
 export default createRuntimeAsset({
     id: 'infra-rum.status',
     kind: 'cli/command',

package/dist/cli/rum/infra-rum-status.cli-command.descriptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"infra-rum-status.cli-command.descriptor.js","sourceRoot":"","sources":["../../../src/cli/rum/infra-rum-status.cli-command.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,eAAe,kBAAkB,CAAC;IACjC,EAAE,EAAE,kBAAkB;IACtB,IAAI,EAAE,aAAa;IACnB,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,6DAA6D;IAC1E,KAAK,EAAE,WAAW;IAClB,OAAO,EAAE;QACR;YACC,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,sDAAsD;SACnE;QACD;YACC,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,wEAAwE;SACrF;QACD;YACC,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,2BAA2B;YACxC,OAAO,EAAE,MAAM;SACf;KACD;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,IAAI;CACb,CAAC,CAAC"}
+{"version":3,"file":"infra-rum-status.cli-command.descriptor.js","sourceRoot":"","sources":["../../../src/cli/rum/infra-rum-status.cli-command.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,eAAe,kBAAkB,CAAC;IACjC,EAAE,EAAE,kBAAkB;IACtB,IAAI,EAAE,aAAa;IACnB,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,6DAA6D;IAC1E,KAAK,EAAE,WAAW;IAClB,OAAO,EAAE;QACR;YACC,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,sDAAsD;SACnE;QACD;YACC,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,wEAAwE;SACrF;QACD;YACC,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,2BAA2B;YACxC,OAAO,EAAE,MAAM;SACf;KACD;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,IAAI;CACb,CAAC,CAAC"}

package/dist/cli/rum/infra-rum-status.cli-command.impl.d.ts

@@ -5,8 +5,9 @@
  * declared injection mode + privacy posture from the descriptor.
  * Flags the "auto-injection but SSR Workers" gap that bit us earlier.
  */
+import type { CommandContext, CommandOptions } from '@vibesdotdev/cli';
 declare const _default: {
-    execute(_args: Record<string, unknown>, opts: Record<string, unknown>): Promise<void>;
+    execute(_args: CommandOptions, opts: CommandOptions, context: CommandContext): Promise<void>;
 };
 export default _default;
 //# sourceMappingURL=infra-rum-status.cli-command.impl.d.ts.map

package/dist/cli/rum/infra-rum-status.cli-command.impl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"infra-rum-status.cli-command.impl.d.ts","sourceRoot":"","sources":["../../../src/cli/rum/infra-rum-status.cli-command.impl.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;;mBAemB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;;AAD5F,wBA2FE"}
+{"version":3,"file":"infra-rum-status.cli-command.impl.d.ts","sourceRoot":"","sources":["../../../src/cli/rum/infra-rum-status.cli-command.impl.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;;mBAmBjD,cAAc,QAAQ,cAAc,WAAW,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;;AADnG,wBA2FE"}

package/dist/cli/rum/infra-rum-status.cli-command.impl.js

@@ -5,15 +5,13 @@
  * declared injection mode + privacy posture from the descriptor.
  * Flags the "auto-injection but SSR Workers" gap that bit us earlier.
  */
-import { getVibesRuntime } from '@vibesdotdev/runtime';
-import {} from '@vibesdotdev/cli/providers';
-function readString(v) {
-    return typeof v === 'string' && v.length > 0 ? v : undefined;
-}
+import { requestCLIExit } from '@vibesdotdev/cli/providers';
+import { settle } from '@vibesdotdev/kernel';
+import { readString } from "../shared/option-strings.js";
 export default {
-    async execute(_args, opts) {
-        const runtime = await getVibesRuntime();
-        const ui = (await runtime.context('cli/ui'));
+    async execute(_args, opts, context) {
+        const runtime = context.runtime;
+        const ui = await runtime.context('cli/ui');
         const providerFilter = readString(opts.provider);
         const output = readString(opts.output) ?? 'text';
         if (!runtime.hasKind('infra/rum')) {
@@ -30,28 +28,31 @@ export default {
         }
         const reports = [];
         for (const d of candidates) {
-            try {
-                const impl = (await runtime
+            const outcome = await settle(async () => {
+                const impl = await runtime
                     .query('infra/rum')
                     .withId(d.id)
-                    .resolve());
-                const sites = await impl.listSites();
+                    .resolve();
+                return await impl.listSites();
+            });
+            if (outcome.ok) {
                 reports.push({
                     descriptorId: d.id,
                     adapter: d.adapter,
                     declaredInjection: d.injection,
                     declaredHostnames: d.hostnames,
-                    sites
+                    sites: outcome.value
                 });
             }
-            catch (err) {
+            else {
+                const cause = outcome.cause;
                 reports.push({
                     descriptorId: d.id,
                     adapter: d.adapter,
                     declaredInjection: d.injection,
                     declaredHostnames: d.hostnames,
                     sites: [],
-                    error: err instanceof Error ? err.message : String(err)
+                    error: cause instanceof Error ? cause.message : cause.description
                 });
             }
         }
@@ -83,6 +84,11 @@ export default {
                     'SvelteKit handle).');
             }
         }
+        const failed = reports.filter((r) => r.error);
+        if (failed.length > 0) {
+            ui.error(`\n${failed.length} RUM provider(s) failed to enumerate. If the error mentions \`Account Analytics:Read\`, grant that scope to the listed token in the Cloudflare dashboard (My Profile → API Tokens → edit the token → add Account · Account Analytics · Read), then re-run \`vibes infra rum status\`.`);
+            requestCLIExit(1);
+        }
     }
 };
 //# sourceMappingURL=infra-rum-status.cli-command.impl.js.map

package/dist/cli/rum/infra-rum-status.cli-command.impl.js.map

@@ -1 +1 @@
-{"version":3,"file":"infra-rum-status.cli-command.impl.js","sourceRoot":"","sources":["../../../src/cli/rum/infra-rum-status.cli-command.impl.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAkB,MAAM,4BAA4B,CAAC;AAO5D,SAAS,UAAU,CAAC,CAAU;IAC7B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC;AAED,eAAe;IACd,KAAK,CAAC,OAAO,CAAC,KAA8B,EAAE,IAA6B;QAC1E,MAAM,OAAO,GAAG,MAAM,eAAe,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAc,CAAC;QAE1D,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;QAEjD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACnC,EAAE,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YACzC,OAAO;QACR,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,WAAW,EAA0B,CAAC;QACtF,MAAM,UAAU,GAAG,cAAc;YAChC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,cAAc,IAAI,CAAC,CAAC,EAAE,KAAK,cAAc,CAAC;YACpF,CAAC,CAAC,WAAW,CAAC;QACf,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,EAAE,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YAC9C,OAAO;QACR,CAAC;QAWD,MAAM,OAAO,GAAqB,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACJ,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO;qBACzB,KAAK,CAAC,WAAW,CAAC;qBAClB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;qBACZ,OAAO,EAAE,CAAsB,CAAC;gBAClC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC;oBACZ,YAAY,EAAE,CAAC,CAAC,EAAE;oBAClB,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,iBAAiB,EAAE,CAAC,CAAC,SAAS;oBAC9B,iBAAiB,EAAE,CAAC,CAAC,SAAS;oBAC9B,KAAK;iBACL,CAAC,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,OAAO,CAAC,IAAI,CAAC;oBACZ,YAAY,EAAE,CAAC,CAAC,EAAE;oBAClB,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,iBAAiB,EAAE,CAAC,CAAC,SAAS;oBAC9B,iBAAiB,EAAE,CAAC,CAAC,SAAS;oBAC9B,KAAK,EAAE,EAAE;oBACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACvD,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;QAED,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACvB,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjB,OAAO;QACR,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACzB,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC;YAChD,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC;YAC/C,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;gBACb,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;gBACzB,SAAS;YACV,CAAC;YACD,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,EAAE,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;gBAC/C,SAAS;YACV,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;gBACzB,EAAE,CAAC,IAAI,CACN,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,OAAO,WAAW,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI;oBACnF,aAAa,CAAC,CAAC,SAAS,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,SAAS,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAChF,CAAC;YACH,CAAC;YACD,sCAAsC;YACtC,IAAI,CAAC,CAAC,iBAAiB,KAAK,eAAe,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,eAAe,CAAC,EAAE,CAAC;gBACrG,EAAE,CAAC,IAAI,CACN,gFAAgF;oBAC/E,6EAA6E;oBAC7E,8EAA8E;oBAC9E,oBAAoB,CACrB,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;CACD,CAAC"}
+{"version":3,"file":"infra-rum-status.cli-command.impl.js","sourceRoot":"","sources":["../../../src/cli/rum/infra-rum-status.cli-command.impl.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAkB,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5E,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAM7C,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAWzD,eAAe;IACd,KAAK,CAAC,OAAO,CAAC,KAAqB,EAAE,IAAoB,EAAE,OAAuB;QACjF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,CAAY,QAAQ,CAAC,CAAC;QAEtD,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;QAEjD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACnC,EAAE,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YACzC,OAAO;QACR,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAA8B,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3F,MAAM,UAAU,GAAG,cAAc;YAChC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,cAAc,IAAI,CAAC,CAAC,EAAE,KAAK,cAAc,CAAC;YACpF,CAAC,CAAC,WAAW,CAAC;QACf,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,EAAE,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YAC9C,OAAO;QACR,CAAC;QAED,MAAM,OAAO,GAAqB,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,IAAI,EAAE;gBACvC,MAAM,IAAI,GAAG,MAAM,OAAO;qBACxB,KAAK,CAAwC,WAAW,CAAC;qBACzD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;qBACZ,OAAO,EAAE,CAAC;gBACZ,OAAO,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/B,CAAC,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;gBAChB,OAAO,CAAC,IAAI,CAAC;oBACZ,YAAY,EAAE,CAAC,CAAC,EAAE;oBAClB,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,iBAAiB,EAAE,CAAC,CAAC,SAAS;oBAC9B,iBAAiB,EAAE,CAAC,CAAC,SAAS;oBAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;iBACpB,CAAC,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACP,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;gBAC5B,OAAO,CAAC,IAAI,CAAC;oBACZ,YAAY,EAAE,CAAC,CAAC,EAAE;oBAClB,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,iBAAiB,EAAE,CAAC,CAAC,SAAS;oBAC9B,iBAAiB,EAAE,CAAC,CAAC,SAAS;oBAC9B,KAAK,EAAE,EAAE;oBACT,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW;iBACjE,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;QAED,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACvB,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjB,OAAO;QACR,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACzB,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC;YAChD,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC;YAC/C,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;gBACb,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;gBACzB,SAAS;YACV,CAAC;YACD,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,EAAE,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;gBAC/C,SAAS;YACV,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;gBACzB,EAAE,CAAC,IAAI,CACN,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,OAAO,WAAW,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI;oBACnF,aAAa,CAAC,CAAC,SAAS,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,SAAS,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAChF,CAAC;YACH,CAAC;YACD,sCAAsC;YACtC,IAAI,CAAC,CAAC,iBAAiB,KAAK,eAAe,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,eAAe,CAAC,EAAE,CAAC;gBACrG,EAAE,CAAC,IAAI,CACN,gFAAgF;oBAC/E,6EAA6E;oBAC7E,8EAA8E;oBAC9E,oBAAoB,CACrB,CAAC;YACH,CAAC;QACF,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,EAAE,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,MAAM,uRAAuR,CAAC,CAAC;YACpT,cAAc,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;IACF,CAAC;CACD,CAAC"}

package/dist/cli/rum/infra-rum.cli-group.descriptor.d.ts

@@ -1,12 +1,12 @@
 declare const _default: {
-    id: string;
-    kind: "cli/group";
-    name: string;
-    description: string;
-    parent: string;
-    surfaces: string[];
-    hardware: string[];
-    enabled: true;
+    readonly id: "infra-rum";
+    readonly kind: "cli/group";
+    readonly name: "rum";
+    readonly description: "Real User Monitoring (beacon-based front-end telemetry) — CF Web Analytics, Sentry, …";
+    readonly parent: "infra";
+    readonly surfaces: ["cli"];
+    readonly hardware: ["consumer", "cloud"];
+    readonly enabled: true;
 };
 export default _default;
 //# sourceMappingURL=infra-rum.cli-group.descriptor.d.ts.map

package/dist/cli/rum/infra-rum.cli-group.descriptor.js

@@ -1,4 +1,4 @@
-import { createRuntimeAsset } from '@vibesdotdev/runtime';
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
 export default createRuntimeAsset({
     id: 'infra-rum',
     kind: 'cli/group',

package/dist/cli/rum/infra-rum.cli-group.descriptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"infra-rum.cli-group.descriptor.js","sourceRoot":"","sources":["../../../src/cli/rum/infra-rum.cli-group.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,eAAe,kBAAkB,CAAC;IACjC,EAAE,EAAE,WAAW;IACf,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,KAAK;IACX,WAAW,EAAE,uFAAuF;IACpG,MAAM,EAAE,OAAO;IACf,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,IAAI;CACb,CAAC,CAAC"}
+{"version":3,"file":"infra-rum.cli-group.descriptor.js","sourceRoot":"","sources":["../../../src/cli/rum/infra-rum.cli-group.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,eAAe,kBAAkB,CAAC;IACjC,EAAE,EAAE,WAAW;IACf,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,KAAK;IACX,WAAW,EAAE,uFAAuF;IACpG,MAAM,EAAE,OAAO;IACf,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,IAAI;CACb,CAAC,CAAC"}

package/dist/cli/run/deploy-smoke.d.ts

@@ -0,0 +1,57 @@
+import type { DeploymentEnvironmentResolution } from '../../deployment-environment.ts';
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import type { AppDeployment } from '@vibesdotdev/infra-core';
+export type DeploySmokeResult = {
+    ok: boolean;
+    url?: string;
+    detail: string;
+    skipped?: boolean;
+};
+export type RunDeploySmokeProbeOptions = {
+    /** The runtime whose lifecycle owns the pauses between probe attempts, and whose logger reports an unreadable build identity. */
+    runtime: RuntimeRef;
+    /**
+     * The commit SHA this deploy just shipped. When supplied, the probe reads the
+     * live origin's `/_app/version.json` and requires it to MATCH — turning
+     * "Cloudflare answered" into "the build I just shipped is the one serving".
+     *
+     * A stale worker (rate-limited push, an isolate still running the previous
+     * bundle) answers 200 with cf-ray exactly like a fresh one, so liveness alone
+     * can never catch a deploy that silently no-opped. `/_app/version.json` is
+     * SvelteKit's own build identity, served publicly BEFORE auth, which is what
+     * makes it usable on apps that only ever 302 to a login — and it needs no
+     * Cloudflare API permissions (`wrangler deployments list` requires
+     * `User->Memberships->Read`, which the deploy token does not carry).
+     *
+     * Omitted (or when the app publishes no version.json) the probe keeps its old
+     * liveness-only behaviour rather than failing a deploy over a missing file.
+     */
+    expectedVersion?: string | null;
+    deployment: AppDeployment;
+    environmentResolution?: DeploymentEnvironmentResolution;
+    deployedUrl?: string | null;
+    retryWindowMs?: number;
+    pollIntervalMs?: number;
+    /** Separate, longer patience for build-identity propagation. */
+    freshnessWindowMs?: number;
+    fetchImpl?: typeof fetch;
+    onLine?: (stream: 'stdout' | 'stderr', line: string) => void;
+};
+export declare function isComparableBuildIdentity(value: string | null | undefined): boolean;
+/**
+ * Post-deploy live probe: THE DEPLOYED ORIGIN ITSELF must answer below 500
+ * through Cloudflare (cf-ray present) within the retry window. This is the
+ * in-process home of scripts/cf-smoke-test.ts, which was only reachable from a
+ * dispatch-only workflow while the marker could report a false DEPLOY FAILED
+ * on rate-limited runs — the live probe is the counter-signal.
+ *
+ * What this probe does NOT establish, so nobody reads more into a green than it
+ * carries: `cf-ray` proves a Cloudflare edge answered, not that YOUR newly
+ * deployed worker answered. A stale worker, a route bound to the wrong script,
+ * or a Cloudflare error page all carry one. Proving provenance needs a
+ * deploy-stamped response header compared against the SHA just deployed, or a
+ * probe of an app-declared health path — `AppDeployment` carries neither today.
+ * Until it does, this reports liveness of the origin, not identity of the build.
+ */
+export declare function runDeploySmokeProbe(options: RunDeploySmokeProbeOptions): Promise<DeploySmokeResult>;
+//# sourceMappingURL=deploy-smoke.d.ts.map

package/dist/cli/run/deploy-smoke.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-smoke.d.ts","sourceRoot":"","sources":["../../../src/cli/run/deploy-smoke.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,iCAAiC,CAAC;AACvF,OAAO,EAAU,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAG9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAE7D,MAAM,MAAM,iBAAiB,GAAG;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACxC,iIAAiI;IACjI,OAAO,EAAE,UAAU,CAAC;IACpB;;;;;;;;;;;;;;;OAeG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,UAAU,EAAE,aAAa,CAAC;IAC1B,qBAAqB,CAAC,EAAE,+BAA+B,CAAC;IACxD,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gEAAgE;IAChE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7D,CAAC;AAoEF,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAWnF;AAmED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,0BAA0B,GACjC,OAAO,CAAC,iBAAiB,CAAC,CAuG5B"}