@vibesdotdev/infra-deploy 0.0.2 → 1.0.0-rc.4

package/dist/cli/dns/resolve-dns-provider.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Shared provider resolution for `vibes infra dns *`.
+ *
+ * Picks the `infra/dns` implementation, optionally scoped to a named
+ * provider and a credential environment.
+ */
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import type { CommandOptions } from '@vibesdotdev/cli';
+import type { DnsImplementation, InfraDnsDescriptor } from '@vibesdotdev/infra-core';
+import { readString } from '../shared/option-strings.ts';
+export { readString };
+export interface DnsScopeOptions {
+    environment?: string;
+    zone?: string;
+}
+export interface ResolvableDnsImplementation extends DnsImplementation {
+    create?: (opts: DnsScopeOptions) => Promise<DnsImplementation>;
+}
+export interface ResolvedDnsImplementation {
+    impl: DnsImplementation;
+    descriptor: InfraDnsDescriptor;
+}
+export declare function resolveDnsImplementation(runtime: VibesRuntime, opts: CommandOptions): Promise<ResolvedDnsImplementation>;
+//# sourceMappingURL=resolve-dns-provider.d.ts.map

package/dist/cli/dns/resolve-dns-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-dns-provider.d.ts","sourceRoot":"","sources":["../../../src/cli/dns/resolve-dns-provider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAGrF,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD,OAAO,EAAE,UAAU,EAAE,CAAC;AAEtB,MAAM,WAAW,eAAe;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,2BAA4B,SAAQ,iBAAiB;IACrE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,yBAAyB;IACzC,IAAI,EAAE,iBAAiB,CAAC;IACxB,UAAU,EAAE,kBAAkB,CAAC;CAC/B;AAED,wBAAsB,wBAAwB,CAC7C,OAAO,EAAE,YAAY,EACrB,IAAI,EAAE,cAAc,GAClB,OAAO,CAAC,yBAAyB,CAAC,CAsDpC"}

package/dist/cli/dns/resolve-dns-provider.js

@@ -0,0 +1,62 @@
+/**
+ * Shared provider resolution for `vibes infra dns *`.
+ *
+ * Picks the `infra/dns` implementation, optionally scoped to a named
+ * provider and a credential environment.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { inferApexZoneFromWorkspace } from "../shared/infer-apex-zone.js";
+import { readString } from "../shared/option-strings.js";
+export { readString };
+export async function resolveDnsImplementation(runtime, opts) {
+    if (!runtime.hasKind('infra/dns')) {
+        throw new CapabilityError('No infra/dns kind registered. Load infra-cloudflare or a sibling provider plugin.', 'NOT_FOUND');
+    }
+    const providerFilter = readString(opts.provider);
+    const descriptors = runtime.assets('infra/dns').descriptors();
+    const descriptor = providerFilter
+        ? descriptors.find((d) => d.adapter === providerFilter || d.id === providerFilter)
+        : descriptors[0];
+    if (!descriptor) {
+        throw new CapabilityError(`No matching DNS provider${providerFilter ? ` for --provider "${providerFilter}"` : ''}.`, 'NOT_FOUND');
+    }
+    const base = await runtime
+        .query('infra/dns')
+        .withId(descriptor.id)
+        .resolve();
+    const environment = readString(opts.environment);
+    let zone = readString(opts.zone);
+    if (!zone) {
+        const name = readString(opts.name) ?? readString(opts.hostname);
+        if (name) {
+            const parts = name.split('.');
+            if (parts.length >= 2)
+                zone = parts.slice(-2).join('.');
+        }
+    }
+    if (!zone) {
+        zone = await inferApexZoneFromWorkspace(runtime);
+    }
+    if (!environment && !zone)
+        return { impl: base, descriptor };
+    // Re-create the impl so the descriptor carries the caller's environment
+    // and zone; the memoized zone lookup belongs to the new instance.
+    if (!base.create)
+        return { impl: base, descriptor };
+    const createOpts = {};
+    if (environment)
+        createOpts.environment = environment;
+    if (zone)
+        createOpts.zone = zone;
+    const scoped = await base.create(createOpts);
+    const scopedDescriptor = { ...descriptor };
+    if (environment)
+        scopedDescriptor.environment = environment;
+    if (zone)
+        scopedDescriptor.zone = zone;
+    return {
+        impl: scoped,
+        descriptor: scopedDescriptor
+    };
+}
+//# sourceMappingURL=resolve-dns-provider.js.map

package/dist/cli/dns/resolve-dns-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-dns-provider.js","sourceRoot":"","sources":["../../../src/cli/dns/resolve-dns-provider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAqB,MAAM,qBAAqB,CAAC;AAIzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD,OAAO,EAAE,UAAU,EAAE,CAAC;AAgBtB,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,OAAqB,EACrB,IAAoB;IAEpB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,eAAe,CACxB,mFAAmF,EACnF,WAAW,CACX,CAAC;IACH,CAAC;IACD,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAA8B,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3F,MAAM,UAAU,GAAG,cAAc;QAChC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,cAAc,IAAI,CAAC,CAAC,EAAE,KAAK,cAAc,CAAC;QAClF,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAClB,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,MAAM,IAAI,eAAe,CACxB,2BAA2B,cAAc,CAAC,CAAC,CAAC,oBAAoB,cAAc,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EACzF,WAAW,CACX,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,OAAO;SACxB,KAAK,CAAkD,WAAW,CAAC;SACnE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;SACrB,OAAO,EAAE,CAAC;IAEZ,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChE,IAAI,IAAI,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;gBAAE,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzD,CAAC;IACF,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,IAAI,GAAG,MAAM,0BAA0B,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAE7D,wEAAwE;IACxE,kEAAkE;IAClE,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACpD,MAAM,UAAU,GAAoB,EAAE,CAAC;IACvC,IAAI,WAAW;QAAE,UAAU,CAAC,WAAW,GAAG,WAAW,CAAC;IACtD,IAAI,IAAI;QAAE,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAE7C,MAAM,gBAAgB,GAAuB,EAAE,GAAG,UAAU,EAAE,CAAC;IAC/D,IAAI,WAAW;QAAE,gBAAgB,CAAC,WAAW,GAAG,WAAW,CAAC;IAC5D,IAAI,IAAI;QAAE,gBAAgB,CAAC,IAAI,GAAG,IAAI,CAAC;IAEvC,OAAO;QACN,IAAI,EAAE,MAAM;QACZ,UAAU,EAAE,gBAAgB;KAC5B,CAAC;AACH,CAAC"}

package/dist/cli/edge-tls/infra-edge-tls-delete.cli-command.descriptor.d.ts

@@ -0,0 +1,37 @@
+declare const _default: {
+    readonly id: "infra-edge-tls.delete";
+    readonly kind: "cli/command";
+    readonly name: "delete";
+    readonly description: "Remove one hostname from its edge-to-origin TLS policy";
+    readonly group: "infra-edge-tls";
+    readonly options: [{
+        readonly flags: "--hostname <name>";
+        readonly description: "Hostname to drop. A policy covering other hostnames is narrowed, not deleted. The hostname falls back to the zone default";
+    }, {
+        readonly flags: "--zone <zone>";
+        readonly description: "Apex zone override; inferred from --hostname when omitted";
+    }, {
+        readonly flags: "--provider <id>";
+        readonly description: "Provider impl id (default: cloudflare-edge-tls)";
+    }, {
+        readonly flags: "--environment <name>";
+        readonly description: "Vibes environment for secret resolution (local|dev|staging|production)";
+    }, {
+        readonly flags: "--dry-run";
+        readonly description: "Show what would be removed; do not write";
+        readonly default: false;
+    }, {
+        readonly flags: "-y, --yes";
+        readonly description: "Skip the confirmation prompt";
+        readonly default: false;
+    }, {
+        readonly flags: "-o, --output <format>";
+        readonly description: "Output format (text|json)";
+        readonly default: "text";
+    }];
+    readonly surfaces: ["cli"];
+    readonly hardware: ["consumer", "cloud"];
+    readonly enabled: true;
+};
+export default _default;
+//# sourceMappingURL=infra-edge-tls-delete.cli-command.descriptor.d.ts.map

package/dist/cli/edge-tls/infra-edge-tls-delete.cli-command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-edge-tls-delete.cli-command.descriptor.d.ts","sourceRoot":"","sources":["../../../src/cli/edge-tls/infra-edge-tls-delete.cli-command.descriptor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,wBA2CG"}

package/dist/cli/edge-tls/infra-edge-tls-delete.cli-command.descriptor.js

@@ -0,0 +1,45 @@
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+export default createRuntimeAsset({
+    id: 'infra-edge-tls.delete',
+    kind: 'cli/command',
+    name: 'delete',
+    description: 'Remove one hostname from its edge-to-origin TLS policy',
+    group: 'infra-edge-tls',
+    options: [
+        {
+            flags: '--hostname <name>',
+            description: 'Hostname to drop. A policy covering other hostnames is narrowed, not deleted. The hostname falls back to the zone default',
+        },
+        {
+            flags: '--zone <zone>',
+            description: 'Apex zone override; inferred from --hostname when omitted'
+        },
+        {
+            flags: '--provider <id>',
+            description: 'Provider impl id (default: cloudflare-edge-tls)'
+        },
+        {
+            flags: '--environment <name>',
+            description: 'Vibes environment for secret resolution (local|dev|staging|production)'
+        },
+        {
+            flags: '--dry-run',
+            description: 'Show what would be removed; do not write',
+            default: false
+        },
+        {
+            flags: '-y, --yes',
+            description: 'Skip the confirmation prompt',
+            default: false
+        },
+        {
+            flags: '-o, --output <format>',
+            description: 'Output format (text|json)',
+            default: 'text'
+        }
+    ],
+    surfaces: ['cli'],
+    hardware: ['consumer', 'cloud'],
+    enabled: true
+});
+//# sourceMappingURL=infra-edge-tls-delete.cli-command.descriptor.js.map

package/dist/cli/edge-tls/infra-edge-tls-delete.cli-command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-edge-tls-delete.cli-command.descriptor.js","sourceRoot":"","sources":["../../../src/cli/edge-tls/infra-edge-tls-delete.cli-command.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,eAAe,kBAAkB,CAAC;IACjC,EAAE,EAAE,uBAAuB;IAC3B,IAAI,EAAE,aAAa;IACnB,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,wDAAwD;IACrE,KAAK,EAAE,gBAAgB;IACvB,OAAO,EAAE;QACR;YACC,KAAK,EAAE,mBAAmB;YAC1B,WAAW,EACV,2HAA2H;SAC5H;QACD;YACC,KAAK,EAAE,eAAe;YACtB,WAAW,EAAE,2DAA2D;SACxE;QACD;YACC,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,iDAAiD;SAC9D;QACD;YACC,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,wEAAwE;SACrF;QACD;YACC,KAAK,EAAE,WAAW;YAClB,WAAW,EAAE,0CAA0C;YACvD,OAAO,EAAE,KAAK;SACd;QACD;YACC,KAAK,EAAE,WAAW;YAClB,WAAW,EAAE,8BAA8B;YAC3C,OAAO,EAAE,KAAK;SACd;QACD;YACC,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,2BAA2B;YACxC,OAAO,EAAE,MAAM;SACf;KACD;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,IAAI;CACb,CAAC,CAAC"}

package/dist/cli/edge-tls/infra-edge-tls-delete.cli-command.impl.d.ts

@@ -0,0 +1,15 @@
+/**
+ * `vibes infra edge-tls delete --hostname H [--dry-run] [--yes]`
+ *
+ * Resolves the live policies covering the hostname before writing, so an
+ * operator never passes a raw provider id. Absence is reported, not raised.
+ * The hostname falls back to the zone default afterwards, which is the part
+ * worth stating out loud: dropping a `verified` policy can leave the hostname
+ * on a weaker default.
+ */
+import type { CommandContext, CommandOptions } from '@vibesdotdev/cli';
+declare const _default: {
+    execute(_args: CommandOptions, opts: CommandOptions, context: CommandContext): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=infra-edge-tls-delete.cli-command.impl.d.ts.map

package/dist/cli/edge-tls/infra-edge-tls-delete.cli-command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-edge-tls-delete.cli-command.impl.d.ts","sourceRoot":"","sources":["../../../src/cli/edge-tls/infra-edge-tls-delete.cli-command.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;;mBAO9D,cAAc,QACf,cAAc,WACX,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC;;AALjB,wBAwFE"}

package/dist/cli/edge-tls/infra-edge-tls-delete.cli-command.impl.js

@@ -0,0 +1,78 @@
+/**
+ * `vibes infra edge-tls delete --hostname H [--dry-run] [--yes]`
+ *
+ * Resolves the live policies covering the hostname before writing, so an
+ * operator never passes a raw provider id. Absence is reported, not raised.
+ * The hostname falls back to the zone default afterwards, which is the part
+ * worth stating out loud: dropping a `verified` policy can leave the hostname
+ * on a weaker default.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import {} from '@vibesdotdev/cli/providers';
+import { readString, resolveEdgeTlsImplementation } from "./resolve-edge-tls-provider.js";
+export default {
+    async execute(_args, opts, context) {
+        const { runtime } = context;
+        const ui = await runtime.context('cli/ui');
+        const output = readString(opts.output) ?? 'text';
+        const dryRun = opts['dry-run'] === true || opts.dryRun === true;
+        const assumeYes = opts.yes === true;
+        const hostname = readString(opts.hostname);
+        if (!hostname)
+            throw new CapabilityError('--hostname is required.', 'INVALID_INPUT');
+        const { impl, descriptor } = await resolveEdgeTlsImplementation(runtime, opts);
+        const snapshot = await impl.read({ hostname });
+        const matches = snapshot.policies.filter((policy) => policy.managed);
+        if (matches.length === 0) {
+            if (output === 'json') {
+                ui.json({ provider: descriptor.id, hostname, removed: [], narrowed: [] });
+            }
+            else {
+                ui.info(`No edge TLS policy shaped by this kind covers ${hostname}; nothing to remove.`);
+                if (snapshot.policies.length > 0) {
+                    ui.info(`${snapshot.policies.length} policy/policies match ${hostname} but are not shaped by this kind; resolve those at the provider.`);
+                }
+            }
+            return;
+        }
+        if (dryRun) {
+            if (output === 'json') {
+                ui.json({ dryRun: true, provider: descriptor.id, remove: matches });
+                return;
+            }
+            for (const match of matches) {
+                const remaining = match.hostnames.filter((host) => host !== hostname.toLowerCase());
+                ui.info(remaining.length === 0
+                    ? `delete  ${match.hostnames.join(', ')} (${match.policy ?? match.providerValue}, id=${match.providerId})`
+                    : `narrow  ${match.hostnames.join(', ')} -> ${remaining.join(', ')} (id=${match.providerId})`);
+            }
+            ui.info(`${hostname} then follows the zone default: ${snapshot.default.policy ?? snapshot.default.providerValue}.`);
+            return;
+        }
+        if (!assumeYes) {
+            const confirmed = await ui.confirm(`Remove ${hostname} from ${matches.length} edge TLS policy/policies? ` +
+                `It then follows the zone default (${snapshot.default.policy ?? snapshot.default.providerValue}).`, false);
+            if (!confirmed) {
+                ui.info('Aborted.');
+                return;
+            }
+        }
+        let result;
+        try {
+            result = await impl.deletePolicy({ hostname });
+        }
+        catch (err) {
+            if (err instanceof CapabilityError)
+                throw err;
+            throw new CapabilityError(`Failed to remove edge TLS policy for ${hostname}.`, 'INTERNAL', { cause: err });
+        }
+        if (output === 'json') {
+            ui.json({ provider: descriptor.id, hostname, ...result });
+            return;
+        }
+        ui.info(`Removed ${result.removed.length} policy/policies and narrowed ${result.narrowed.length}; ` +
+            `preserved ${result.preservedRules} co-tenant rule(s).`);
+        ui.info(`${hostname} now follows the zone default: ${snapshot.default.policy ?? snapshot.default.providerValue}.`);
+    }
+};
+//# sourceMappingURL=infra-edge-tls-delete.cli-command.impl.js.map

package/dist/cli/edge-tls/infra-edge-tls-delete.cli-command.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-edge-tls-delete.cli-command.impl.js","sourceRoot":"","sources":["../../../src/cli/edge-tls/infra-edge-tls-delete.cli-command.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAkB,MAAM,4BAA4B,CAAC;AAE5D,OAAO,EAAE,UAAU,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAE1F,eAAe;IACd,KAAK,CAAC,OAAO,CACZ,KAAqB,EACrB,IAAoB,EACpB,OAAuB;QAEvB,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAC5B,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,CAAY,QAAQ,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;QAChE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC;QAEpC,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,eAAe,CAAC,yBAAyB,EAAE,eAAe,CAAC,CAAC;QAErF,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC/E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAErE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACvB,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3E,CAAC;iBAAM,CAAC;gBACP,EAAE,CAAC,IAAI,CAAC,iDAAiD,QAAQ,sBAAsB,CAAC,CAAC;gBACzF,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAClC,EAAE,CAAC,IAAI,CACN,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,0BAA0B,QAAQ,kEAAkE,CAC/H,CAAC;gBACH,CAAC;YACF,CAAC;YACD,OAAO;QACR,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACZ,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACvB,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;gBACpE,OAAO;YACR,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;gBACpF,EAAE,CAAC,IAAI,CACN,SAAS,CAAC,MAAM,KAAK,CAAC;oBACrB,CAAC,CAAC,WAAW,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,aAAa,QAAQ,KAAK,CAAC,UAAU,GAAG;oBAC1G,CAAC,CAAC,WAAW,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,UAAU,GAAG,CAC9F,CAAC;YACH,CAAC;YACD,EAAE,CAAC,IAAI,CACN,GAAG,QAAQ,mCAAmC,QAAQ,CAAC,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,OAAO,CAAC,aAAa,GAAG,CAC1G,CAAC;YACF,OAAO;QACR,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CACjC,UAAU,QAAQ,SAAS,OAAO,CAAC,MAAM,6BAA6B;gBACrE,qCAAqC,QAAQ,CAAC,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,OAAO,CAAC,aAAa,IAAI,EACnG,KAAK,CACL,CAAC;YACF,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChB,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACpB,OAAO;YACR,CAAC;QACF,CAAC;QAED,IAAI,MAA2B,CAAC;QAChC,IAAI,CAAC;YACJ,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,eAAe;gBAAE,MAAM,GAAG,CAAC;YAC9C,MAAM,IAAI,eAAe,CACxB,wCAAwC,QAAQ,GAAG,EACnD,UAAU,EACV,EAAE,KAAK,EAAE,GAAG,EAAE,CACd,CAAC;QACH,CAAC;QAED,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACvB,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;YAC1D,OAAO;QACR,CAAC;QACD,EAAE,CAAC,IAAI,CACN,WAAW,MAAM,CAAC,OAAO,CAAC,MAAM,iCAAiC,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI;YAC1F,aAAa,MAAM,CAAC,cAAc,qBAAqB,CACxD,CAAC;QACF,EAAE,CAAC,IAAI,CACN,GAAG,QAAQ,kCAAkC,QAAQ,CAAC,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,OAAO,CAAC,aAAa,GAAG,CACzG,CAAC;IACH,CAAC;CACD,CAAC"}

package/dist/cli/edge-tls/infra-edge-tls-list.cli-command.descriptor.d.ts

@@ -0,0 +1,29 @@
+declare const _default: {
+    readonly id: "infra-edge-tls.list";
+    readonly kind: "cli/command";
+    readonly name: "list";
+    readonly description: "List per-hostname edge-to-origin TLS policies and the zone default";
+    readonly group: "infra-edge-tls";
+    readonly options: [{
+        readonly flags: "--zone <zone>";
+        readonly description: "Apex zone to read (e.g. example.com); inferred from --hostname or repo config when omitted";
+    }, {
+        readonly flags: "--hostname <name>";
+        readonly description: "Narrow to policies covering one hostname";
+    }, {
+        readonly flags: "--provider <id>";
+        readonly description: "Provider impl id (default: cloudflare-edge-tls)";
+    }, {
+        readonly flags: "--environment <name>";
+        readonly description: "Vibes environment for secret resolution (local|dev|staging|production)";
+    }, {
+        readonly flags: "-o, --output <format>";
+        readonly description: "Output format (text|json)";
+        readonly default: "text";
+    }];
+    readonly surfaces: ["cli"];
+    readonly hardware: ["consumer", "cloud"];
+    readonly enabled: true;
+};
+export default _default;
+//# sourceMappingURL=infra-edge-tls-list.cli-command.descriptor.d.ts.map

package/dist/cli/edge-tls/infra-edge-tls-list.cli-command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-edge-tls-list.cli-command.descriptor.d.ts","sourceRoot":"","sources":["../../../src/cli/edge-tls/infra-edge-tls-list.cli-command.descriptor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,wBAiCG"}

package/dist/cli/edge-tls/infra-edge-tls-list.cli-command.descriptor.js

@@ -0,0 +1,35 @@
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+export default createRuntimeAsset({
+    id: 'infra-edge-tls.list',
+    kind: 'cli/command',
+    name: 'list',
+    description: 'List per-hostname edge-to-origin TLS policies and the zone default',
+    group: 'infra-edge-tls',
+    options: [
+        {
+            flags: '--zone <zone>',
+            description: 'Apex zone to read (e.g. example.com); inferred from --hostname or repo config when omitted'
+        },
+        {
+            flags: '--hostname <name>',
+            description: 'Narrow to policies covering one hostname'
+        },
+        {
+            flags: '--provider <id>',
+            description: 'Provider impl id (default: cloudflare-edge-tls)'
+        },
+        {
+            flags: '--environment <name>',
+            description: 'Vibes environment for secret resolution (local|dev|staging|production)'
+        },
+        {
+            flags: '-o, --output <format>',
+            description: 'Output format (text|json)',
+            default: 'text'
+        }
+    ],
+    surfaces: ['cli'],
+    hardware: ['consumer', 'cloud'],
+    enabled: true
+});
+//# sourceMappingURL=infra-edge-tls-list.cli-command.descriptor.js.map

package/dist/cli/edge-tls/infra-edge-tls-list.cli-command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-edge-tls-list.cli-command.descriptor.js","sourceRoot":"","sources":["../../../src/cli/edge-tls/infra-edge-tls-list.cli-command.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,eAAe,kBAAkB,CAAC;IACjC,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,aAAa;IACnB,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,oEAAoE;IACjF,KAAK,EAAE,gBAAgB;IACvB,OAAO,EAAE;QACR;YACC,KAAK,EAAE,eAAe;YACtB,WAAW,EACV,4FAA4F;SAC7F;QACD;YACC,KAAK,EAAE,mBAAmB;YAC1B,WAAW,EAAE,0CAA0C;SACvD;QACD;YACC,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,iDAAiD;SAC9D;QACD;YACC,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,wEAAwE;SACrF;QACD;YACC,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,2BAA2B;YACxC,OAAO,EAAE,MAAM;SACf;KACD;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,IAAI;CACb,CAAC,CAAC"}

package/dist/cli/edge-tls/infra-edge-tls-list.cli-command.impl.d.ts

@@ -0,0 +1,19 @@
+/**
+ * `vibes infra edge-tls list [--zone Z] [--hostname H]`
+ *
+ * Reads how the edge connects to origins in a zone:
+ *
+ *   zone default  opportunistic (flexible)
+ *
+ *   hostnames                                          policy    managed
+ *   -------------------------------------------------  --------  -------
+ *   git-ssh.vibes.dev, git.vibes.dev, gitd.vibes.dev   verified  true
+ *
+ * `--output json` emits the raw EdgeTlsSnapshot for piping.
+ */
+import type { CommandContext, CommandOptions } from '@vibesdotdev/cli';
+declare const _default: {
+    execute(_args: CommandOptions, opts: CommandOptions, context: CommandContext): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=infra-edge-tls-list.cli-command.impl.d.ts.map

package/dist/cli/edge-tls/infra-edge-tls-list.cli-command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-edge-tls-list.cli-command.impl.d.ts","sourceRoot":"","sources":["../../../src/cli/edge-tls/infra-edge-tls-list.cli-command.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;;mBAO9D,cAAc,QACf,cAAc,WACX,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC;;AALjB,wBA8EE"}

package/dist/cli/edge-tls/infra-edge-tls-list.cli-command.impl.js

@@ -0,0 +1,73 @@
+/**
+ * `vibes infra edge-tls list [--zone Z] [--hostname H]`
+ *
+ * Reads how the edge connects to origins in a zone:
+ *
+ *   zone default  opportunistic (flexible)
+ *
+ *   hostnames                                          policy    managed
+ *   -------------------------------------------------  --------  -------
+ *   git-ssh.vibes.dev, git.vibes.dev, gitd.vibes.dev   verified  true
+ *
+ * `--output json` emits the raw EdgeTlsSnapshot for piping.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import {} from '@vibesdotdev/cli/providers';
+import { readString, resolveEdgeTlsImplementation } from "./resolve-edge-tls-provider.js";
+export default {
+    async execute(_args, opts, context) {
+        const { runtime } = context;
+        const ui = await runtime.context('cli/ui');
+        const output = readString(opts.output) ?? 'text';
+        const { impl } = await resolveEdgeTlsImplementation(runtime, opts);
+        const hostname = readString(opts.hostname);
+        let snapshot;
+        try {
+            snapshot = await impl.read(hostname ? { hostname } : undefined);
+        }
+        catch (err) {
+            if (err instanceof CapabilityError)
+                throw err;
+            throw new CapabilityError('Failed to read edge TLS policy.', 'INTERNAL', { cause: err });
+        }
+        if (output === 'json') {
+            ui.json(snapshot);
+            return;
+        }
+        const fallback = snapshot.default;
+        ui.info(`  zone ${snapshot.zone} default: ${fallback.policy ?? 'unmapped'} (${fallback.providerValue})` +
+            `${fallback.editable ? '' : ' [not editable on this plan]'}`);
+        if (fallback.policy === 'opportunistic' || fallback.policy === 'off') {
+            ui.info('  Hostnames without their own policy reach their origin unencrypted; an origin that redirects to HTTPS will loop.');
+        }
+        ui.info('');
+        if (snapshot.policies.length === 0) {
+            ui.info('  No per-hostname edge TLS policies.');
+        }
+        else {
+            const rows = snapshot.policies.map((policy) => ({
+                hostnames: policy.hostnames.join(', ') || policy.expression,
+                policy: `${policy.policy ?? 'unmapped'} (${policy.providerValue})`,
+                managed: policy.managed
+            }));
+            const hostWidth = Math.max(9, ...rows.map((row) => row.hostnames.length));
+            const policyWidth = Math.max(6, ...rows.map((row) => row.policy.length));
+            ui.info(`  ${'hostnames'.padEnd(hostWidth)}  ${'policy'.padEnd(policyWidth)}  managed  enabled`);
+            ui.info(`  ${'-'.repeat(hostWidth)}  ${'-'.repeat(policyWidth)}  -------  -------`);
+            for (const [index, row] of rows.entries()) {
+                const live = snapshot.policies[index];
+                ui.info(`  ${row.hostnames.padEnd(hostWidth)}  ${row.policy.padEnd(policyWidth)}  ${String(row.managed).padEnd(7)}  ${live?.enabled ?? true}`);
+            }
+            const unmanaged = snapshot.policies.filter((policy) => !policy.managed);
+            if (unmanaged.length > 0) {
+                ui.info('');
+                ui.info(`  ${unmanaged.length} policy/policies are not shaped by this kind and are never rewritten here.`);
+            }
+        }
+        if (snapshot.coTenantRules > 0) {
+            ui.info('');
+            ui.info(`  ${snapshot.coTenantRules} other configuration rule(s) share this provider container and are preserved on write.`);
+        }
+    }
+};
+//# sourceMappingURL=infra-edge-tls-list.cli-command.impl.js.map

package/dist/cli/edge-tls/infra-edge-tls-list.cli-command.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-edge-tls-list.cli-command.impl.js","sourceRoot":"","sources":["../../../src/cli/edge-tls/infra-edge-tls-list.cli-command.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAkB,MAAM,4BAA4B,CAAC;AAE5D,OAAO,EAAE,UAAU,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAE1F,eAAe;IACd,KAAK,CAAC,OAAO,CACZ,KAAqB,EACrB,IAAoB,EACpB,OAAuB;QAEvB,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAC5B,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,CAAY,QAAQ,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;QAEjD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE3C,IAAI,QAAyB,CAAC;QAC9B,IAAI,CAAC;YACJ,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,eAAe;gBAAE,MAAM,GAAG,CAAC;YAC9C,MAAM,IAAI,eAAe,CACxB,iCAAiC,EACjC,UAAU,EACV,EAAE,KAAK,EAAE,GAAG,EAAE,CACd,CAAC;QACH,CAAC;QAED,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACvB,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClB,OAAO;QACR,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC;QAClC,EAAE,CAAC,IAAI,CACN,UAAU,QAAQ,CAAC,IAAI,aAAa,QAAQ,CAAC,MAAM,IAAI,UAAU,KAAK,QAAQ,CAAC,aAAa,GAAG;YAC9F,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,8BAA8B,EAAE,CAC7D,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,KAAK,eAAe,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACtE,EAAE,CAAC,IAAI,CACN,mHAAmH,CACnH,CAAC;QACH,CAAC;QACD,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEZ,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,EAAE,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACP,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC/C,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,UAAU;gBAC3D,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,IAAI,UAAU,KAAK,MAAM,CAAC,aAAa,GAAG;gBAClE,OAAO,EAAE,MAAM,CAAC,OAAO;aACvB,CAAC,CAAC,CAAC;YACJ,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YAC1E,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACzE,EAAE,CAAC,IAAI,CACN,KAAK,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,oBAAoB,CACvF,CAAC;YACF,EAAE,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC;YACpF,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBACtC,EAAE,CAAC,IAAI,CACN,KAAK,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,OAAO,IAAI,IAAI,EAAE,CACrI,CAAC;YACH,CAAC;YACD,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACxE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACZ,EAAE,CAAC,IAAI,CACN,KAAK,SAAS,CAAC,MAAM,4EAA4E,CACjG,CAAC;YACH,CAAC;QACF,CAAC;QAED,IAAI,QAAQ,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;YAChC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACZ,EAAE,CAAC,IAAI,CACN,KAAK,QAAQ,CAAC,aAAa,wFAAwF,CACnH,CAAC;QACH,CAAC;IACF,CAAC;CACD,CAAC"}

package/dist/cli/edge-tls/infra-edge-tls-set-zone-default.cli-command.descriptor.d.ts

@@ -0,0 +1,41 @@
+declare const _default: {
+    readonly id: "infra-edge-tls.set-zone-default";
+    readonly kind: "cli/command";
+    readonly name: "set-zone-default";
+    readonly description: "DANGEROUS: change the zone-wide edge-to-origin TLS default for every hostname without its own policy";
+    readonly group: "infra-edge-tls";
+    readonly options: [{
+        readonly flags: "--policy <policy>";
+        readonly description: "verified | encrypted | opportunistic | off";
+    }, {
+        readonly flags: "--confirm-origin-breakage";
+        readonly description: "Required. The default applies to every hostname with no policy of its own, including ones you did not audit. `verified` returns 526 for any origin whose certificate is self-signed, expired, or issued for a different name; `opportunistic` makes the edge speak plaintext, which loops against an origin that redirects to HTTPS. Run `vibes infra edge-tls list` and check each unprotected origin first";
+        readonly default: false;
+    }, {
+        readonly flags: "--zone <zone>";
+        readonly description: "Apex zone to change (e.g. example.com; inferred from repo config when omitted)";
+    }, {
+        readonly flags: "--provider <id>";
+        readonly description: "Provider impl id (default: cloudflare-edge-tls)";
+    }, {
+        readonly flags: "--environment <name>";
+        readonly description: "Vibes environment for secret resolution (local|dev|staging|production)";
+    }, {
+        readonly flags: "--dry-run";
+        readonly description: "Show the current default and the requested change; do not write";
+        readonly default: false;
+    }, {
+        readonly flags: "-y, --yes";
+        readonly description: "Skip the confirmation prompt";
+        readonly default: false;
+    }, {
+        readonly flags: "-o, --output <format>";
+        readonly description: "Output format (text|json)";
+        readonly default: "text";
+    }];
+    readonly surfaces: ["cli"];
+    readonly hardware: ["consumer", "cloud"];
+    readonly enabled: true;
+};
+export default _default;
+//# sourceMappingURL=infra-edge-tls-set-zone-default.cli-command.descriptor.d.ts.map

package/dist/cli/edge-tls/infra-edge-tls-set-zone-default.cli-command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-edge-tls-set-zone-default.cli-command.descriptor.d.ts","sourceRoot":"","sources":["../../../src/cli/edge-tls/infra-edge-tls-set-zone-default.cli-command.descriptor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,wBAiDG"}

package/dist/cli/edge-tls/infra-edge-tls-set-zone-default.cli-command.descriptor.js

@@ -0,0 +1,50 @@
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+export default createRuntimeAsset({
+    id: 'infra-edge-tls.set-zone-default',
+    kind: 'cli/command',
+    name: 'set-zone-default',
+    description: 'DANGEROUS: change the zone-wide edge-to-origin TLS default for every hostname without its own policy',
+    group: 'infra-edge-tls',
+    options: [
+        {
+            flags: '--policy <policy>',
+            description: 'verified | encrypted | opportunistic | off'
+        },
+        {
+            flags: '--confirm-origin-breakage',
+            description: 'Required. The default applies to every hostname with no policy of its own, including ones you did not audit. `verified` returns 526 for any origin whose certificate is self-signed, expired, or issued for a different name; `opportunistic` makes the edge speak plaintext, which loops against an origin that redirects to HTTPS. Run `vibes infra edge-tls list` and check each unprotected origin first',
+            default: false
+        },
+        {
+            flags: '--zone <zone>',
+            description: 'Apex zone to change (e.g. example.com; inferred from repo config when omitted)'
+        },
+        {
+            flags: '--provider <id>',
+            description: 'Provider impl id (default: cloudflare-edge-tls)'
+        },
+        {
+            flags: '--environment <name>',
+            description: 'Vibes environment for secret resolution (local|dev|staging|production)'
+        },
+        {
+            flags: '--dry-run',
+            description: 'Show the current default and the requested change; do not write',
+            default: false
+        },
+        {
+            flags: '-y, --yes',
+            description: 'Skip the confirmation prompt',
+            default: false
+        },
+        {
+            flags: '-o, --output <format>',
+            description: 'Output format (text|json)',
+            default: 'text'
+        }
+    ],
+    surfaces: ['cli'],
+    hardware: ['consumer', 'cloud'],
+    enabled: true
+});
+//# sourceMappingURL=infra-edge-tls-set-zone-default.cli-command.descriptor.js.map

package/dist/cli/edge-tls/infra-edge-tls-set-zone-default.cli-command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-edge-tls-set-zone-default.cli-command.descriptor.js","sourceRoot":"","sources":["../../../src/cli/edge-tls/infra-edge-tls-set-zone-default.cli-command.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,eAAe,kBAAkB,CAAC;IACjC,EAAE,EAAE,iCAAiC;IACrC,IAAI,EAAE,aAAa;IACnB,IAAI,EAAE,kBAAkB;IACxB,WAAW,EACV,sGAAsG;IACvG,KAAK,EAAE,gBAAgB;IACvB,OAAO,EAAE;QACR;YACC,KAAK,EAAE,mBAAmB;YAC1B,WAAW,EAAE,4CAA4C;SACzD;QACD;YACC,KAAK,EAAE,2BAA2B;YAClC,WAAW,EACV,8YAA8Y;YAC/Y,OAAO,EAAE,KAAK;SACd;QACD;YACC,KAAK,EAAE,eAAe;YACtB,WAAW,EAAE,gFAAgF;SAC7F;QACD;YACC,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,iDAAiD;SAC9D;QACD;YACC,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,wEAAwE;SACrF;QACD;YACC,KAAK,EAAE,WAAW;YAClB,WAAW,EAAE,iEAAiE;YAC9E,OAAO,EAAE,KAAK;SACd;QACD;YACC,KAAK,EAAE,WAAW;YAClB,WAAW,EAAE,8BAA8B;YAC3C,OAAO,EAAE,KAAK;SACd;QACD;YACC,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,2BAA2B;YACxC,OAAO,EAAE,MAAM;SACf;KACD;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,IAAI;CACb,CAAC,CAAC"}

package/dist/cli/edge-tls/infra-edge-tls-set-zone-default.cli-command.impl.d.ts

@@ -0,0 +1,16 @@
+/**
+ * `vibes infra edge-tls set-zone-default --policy P --confirm-origin-breakage`
+ *
+ * Separate from `set` because the blast radius is different in kind: a
+ * per-hostname policy affects the hostnames the operator named, while the zone
+ * default affects every hostname that has no policy of its own — including
+ * hostnames the operator has never looked at. Both the flag and the
+ * implementation guard must be satisfied, so neither a script nor a provider
+ * client can flip it silently.
+ */
+import type { CommandContext, CommandOptions } from '@vibesdotdev/cli';
+declare const _default: {
+    execute(_args: CommandOptions, opts: CommandOptions, context: CommandContext): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=infra-edge-tls-set-zone-default.cli-command.impl.d.ts.map

package/dist/cli/edge-tls/infra-edge-tls-set-zone-default.cli-command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-edge-tls-set-zone-default.cli-command.impl.d.ts","sourceRoot":"","sources":["../../../src/cli/edge-tls/infra-edge-tls-set-zone-default.cli-command.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;;mBAgB9D,cAAc,QACf,cAAc,WACX,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC;;AALjB,wBAsFE"}