@vibesdotdev/infra-deploy 0.0.2 → 1.0.0-rc.4

package/dist/cli/edge-tls/infra-edge-tls-set-zone-default.cli-command.impl.js

@@ -0,0 +1,81 @@
+/**
+ * `vibes infra edge-tls set-zone-default --policy P --confirm-origin-breakage`
+ *
+ * Separate from `set` because the blast radius is different in kind: a
+ * per-hostname policy affects the hostnames the operator named, while the zone
+ * default affects every hostname that has no policy of its own — including
+ * hostnames the operator has never looked at. Both the flag and the
+ * implementation guard must be satisfied, so neither a script nor a provider
+ * client can flip it silently.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import {} from '@vibesdotdev/cli/providers';
+import { readString, resolveEdgeTlsImplementation } from "./resolve-edge-tls-provider.js";
+const POLICIES = ['verified', 'encrypted', 'opportunistic', 'off'];
+function parseOriginTlsPolicy(raw) {
+    if (raw === 'verified' || raw === 'encrypted' || raw === 'opportunistic' || raw === 'off') {
+        return raw;
+    }
+    return undefined;
+}
+export default {
+    async execute(_args, opts, context) {
+        const { runtime } = context;
+        const ui = await runtime.context('cli/ui');
+        const output = readString(opts.output) ?? 'text';
+        const dryRun = opts['dry-run'] === true || opts.dryRun === true;
+        const assumeYes = opts.yes === true;
+        const acknowledged = opts['confirm-origin-breakage'] === true || opts.confirmOriginBreakage === true;
+        const requested = parseOriginTlsPolicy(readString(opts.policy));
+        if (!requested) {
+            throw new CapabilityError(`--policy must be one of ${POLICIES.join('|')}.`, 'INVALID_INPUT');
+        }
+        const { impl, descriptor } = await resolveEdgeTlsImplementation(runtime, opts);
+        const snapshot = await impl.read();
+        const covered = new Set(snapshot.policies.flatMap((policy) => policy.hostnames));
+        if (dryRun || !acknowledged) {
+            const detail = {
+                zone: snapshot.zone,
+                from: snapshot.default.policy,
+                fromProviderValue: snapshot.default.providerValue,
+                to: requested,
+                hostnamesWithOwnPolicy: [...covered].sort(),
+                acknowledged
+            };
+            if (output === 'json') {
+                ui.json({ dryRun: true, provider: descriptor.id, ...detail });
+            }
+            else {
+                ui.info(`zone ${snapshot.zone} default: ${snapshot.default.policy ?? snapshot.default.providerValue} -> ${requested}`);
+                ui.info(`${covered.size} hostname(s) carry their own policy and are unaffected: ${[...covered].sort().join(', ') || 'none'}`);
+                ui.info('Every other hostname in the zone inherits this default. Under `verified`, any origin whose certificate is self-signed, expired, or issued for a different name starts failing immediately.');
+            }
+            if (!acknowledged && !dryRun) {
+                throw new CapabilityError('--confirm-origin-breakage is required to change the zone default.', 'INVALID_INPUT');
+            }
+            if (dryRun)
+                return;
+        }
+        if (!assumeYes) {
+            const confirmed = await ui.confirm(`Change the ${snapshot.zone} zone default to ${requested} for every hostname without its own policy?`, false);
+            if (!confirmed) {
+                ui.info('Aborted.');
+                return;
+            }
+        }
+        try {
+            const change = await impl.setZoneDefault(requested, { acknowledgeOriginBreakage: true });
+            if (output === 'json') {
+                ui.json({ provider: descriptor.id, ...change });
+                return;
+            }
+            ui.info(`zone ${change.zone} default is now ${change.to} (was ${change.from ?? snapshot.default.providerValue}).`);
+        }
+        catch (err) {
+            if (err instanceof CapabilityError)
+                throw err;
+            throw new CapabilityError('Failed to change the zone edge TLS default.', 'INTERNAL', { cause: err });
+        }
+    }
+};
+//# sourceMappingURL=infra-edge-tls-set-zone-default.cli-command.impl.js.map

package/dist/cli/edge-tls/infra-edge-tls-set-zone-default.cli-command.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-edge-tls-set-zone-default.cli-command.impl.js","sourceRoot":"","sources":["../../../src/cli/edge-tls/infra-edge-tls-set-zone-default.cli-command.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAkB,MAAM,4BAA4B,CAAC;AAE5D,OAAO,EAAE,UAAU,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAE1F,MAAM,QAAQ,GAA+B,CAAC,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;AAE/F,SAAS,oBAAoB,CAAC,GAAuB;IACpD,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,eAAe,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;QAC3F,OAAO,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,eAAe;IACd,KAAK,CAAC,OAAO,CACZ,KAAqB,EACrB,IAAoB,EACpB,OAAuB;QAEvB,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAC5B,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,CAAY,QAAQ,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;QAChE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC;QACpC,MAAM,YAAY,GACjB,IAAI,CAAC,yBAAyB,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,qBAAqB,KAAK,IAAI,CAAC;QAEjF,MAAM,SAAS,GAAG,oBAAoB,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,MAAM,IAAI,eAAe,CACxB,2BAA2B,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAChD,eAAe,CACf,CAAC;QACH,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC/E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAEjF,IAAI,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG;gBACd,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM;gBAC7B,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,aAAa;gBACjD,EAAE,EAAE,SAAS;gBACb,sBAAsB,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE;gBAC3C,YAAY;aACZ,CAAC;YACF,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACvB,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;YAC/D,CAAC;iBAAM,CAAC;gBACP,EAAE,CAAC,IAAI,CACN,QAAQ,QAAQ,CAAC,IAAI,aAAa,QAAQ,CAAC,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,OAAO,CAAC,aAAa,OAAO,SAAS,EAAE,CAC7G,CAAC;gBACF,EAAE,CAAC,IAAI,CACN,GAAG,OAAO,CAAC,IAAI,2DAA2D,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CACpH,CAAC;gBACF,EAAE,CAAC,IAAI,CACN,4LAA4L,CAC5L,CAAC;YACH,CAAC;YACD,IAAI,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC9B,MAAM,IAAI,eAAe,CACxB,mEAAmE,EACnE,eAAe,CACf,CAAC;YACH,CAAC;YACD,IAAI,MAAM;gBAAE,OAAO;QACpB,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CACjC,cAAc,QAAQ,CAAC,IAAI,oBAAoB,SAAS,6CAA6C,EACrG,KAAK,CACL,CAAC;YACF,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChB,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACpB,OAAO;YACR,CAAC;QACF,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC,CAAC;YACzF,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACvB,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;gBAChD,OAAO;YACR,CAAC;YACD,EAAE,CAAC,IAAI,CACN,QAAQ,MAAM,CAAC,IAAI,mBAAmB,MAAM,CAAC,EAAE,SAAS,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,CAAC,aAAa,IAAI,CACzG,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,eAAe;gBAAE,MAAM,GAAG,CAAC;YAC9C,MAAM,IAAI,eAAe,CACxB,6CAA6C,EAC7C,UAAU,EACV,EAAE,KAAK,EAAE,GAAG,EAAE,CACd,CAAC;QACH,CAAC;IACF,CAAC;CACD,CAAC"}

package/dist/cli/edge-tls/infra-edge-tls-set.cli-command.descriptor.d.ts

@@ -0,0 +1,40 @@
+declare const _default: {
+    readonly id: "infra-edge-tls.set";
+    readonly kind: "cli/command";
+    readonly name: "set";
+    readonly description: "Declare the edge-to-origin TLS policy for one or more hostnames";
+    readonly group: "infra-edge-tls";
+    readonly options: [{
+        readonly flags: "--hostname <names>";
+        readonly description: "Comma-separated hostnames this policy covers (e.g. app.example.com,api.example.com)";
+    }, {
+        readonly flags: "--policy <policy>";
+        readonly description: "verified (valid origin certificate required) | encrypted (no validation) | opportunistic (plaintext allowed; loops when the origin redirects to HTTPS) | off";
+        readonly default: "verified";
+    }, {
+        readonly flags: "--description <text>";
+        readonly description: "Operator note stored alongside the policy";
+    }, {
+        readonly flags: "--zone <zone>";
+        readonly description: "Apex zone override; inferred from --hostname or repo config when omitted";
+    }, {
+        readonly flags: "--provider <id>";
+        readonly description: "Provider impl id (default: cloudflare-edge-tls)";
+    }, {
+        readonly flags: "--environment <name>";
+        readonly description: "Vibes environment for secret resolution (local|dev|staging|production)";
+    }, {
+        readonly flags: "--dry-run";
+        readonly description: "Show what would change; do not write";
+        readonly default: false;
+    }, {
+        readonly flags: "-o, --output <format>";
+        readonly description: "Output format (text|json)";
+        readonly default: "text";
+    }];
+    readonly surfaces: ["cli"];
+    readonly hardware: ["consumer", "cloud"];
+    readonly enabled: true;
+};
+export default _default;
+//# sourceMappingURL=infra-edge-tls-set.cli-command.descriptor.d.ts.map

package/dist/cli/edge-tls/infra-edge-tls-set.cli-command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-edge-tls-set.cli-command.descriptor.d.ts","sourceRoot":"","sources":["../../../src/cli/edge-tls/infra-edge-tls-set.cli-command.descriptor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,wBAgDG"}

package/dist/cli/edge-tls/infra-edge-tls-set.cli-command.descriptor.js

@@ -0,0 +1,49 @@
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+export default createRuntimeAsset({
+    id: 'infra-edge-tls.set',
+    kind: 'cli/command',
+    name: 'set',
+    description: 'Declare the edge-to-origin TLS policy for one or more hostnames',
+    group: 'infra-edge-tls',
+    options: [
+        {
+            flags: '--hostname <names>',
+            description: 'Comma-separated hostnames this policy covers (e.g. app.example.com,api.example.com)'
+        },
+        {
+            flags: '--policy <policy>',
+            description: 'verified (valid origin certificate required) | encrypted (no validation) | opportunistic (plaintext allowed; loops when the origin redirects to HTTPS) | off',
+            default: 'verified'
+        },
+        {
+            flags: '--description <text>',
+            description: 'Operator note stored alongside the policy'
+        },
+        {
+            flags: '--zone <zone>',
+            description: 'Apex zone override; inferred from --hostname or repo config when omitted'
+        },
+        {
+            flags: '--provider <id>',
+            description: 'Provider impl id (default: cloudflare-edge-tls)'
+        },
+        {
+            flags: '--environment <name>',
+            description: 'Vibes environment for secret resolution (local|dev|staging|production)'
+        },
+        {
+            flags: '--dry-run',
+            description: 'Show what would change; do not write',
+            default: false
+        },
+        {
+            flags: '-o, --output <format>',
+            description: 'Output format (text|json)',
+            default: 'text'
+        }
+    ],
+    surfaces: ['cli'],
+    hardware: ['consumer', 'cloud'],
+    enabled: true
+});
+//# sourceMappingURL=infra-edge-tls-set.cli-command.descriptor.js.map

package/dist/cli/edge-tls/infra-edge-tls-set.cli-command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-edge-tls-set.cli-command.descriptor.js","sourceRoot":"","sources":["../../../src/cli/edge-tls/infra-edge-tls-set.cli-command.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,eAAe,kBAAkB,CAAC;IACjC,EAAE,EAAE,oBAAoB;IACxB,IAAI,EAAE,aAAa;IACnB,IAAI,EAAE,KAAK;IACX,WAAW,EAAE,iEAAiE;IAC9E,KAAK,EAAE,gBAAgB;IACvB,OAAO,EAAE;QACR;YACC,KAAK,EAAE,oBAAoB;YAC3B,WAAW,EACV,qFAAqF;SACtF;QACD;YACC,KAAK,EAAE,mBAAmB;YAC1B,WAAW,EACV,8JAA8J;YAC/J,OAAO,EAAE,UAAU;SACnB;QACD;YACC,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,2CAA2C;SACxD;QACD;YACC,KAAK,EAAE,eAAe;YACtB,WAAW,EAAE,0EAA0E;SACvF;QACD;YACC,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,iDAAiD;SAC9D;QACD;YACC,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,wEAAwE;SACrF;QACD;YACC,KAAK,EAAE,WAAW;YAClB,WAAW,EAAE,sCAAsC;YACnD,OAAO,EAAE,KAAK;SACd;QACD;YACC,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,2BAA2B;YACxC,OAAO,EAAE,MAAM;SACf;KACD;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,IAAI;CACb,CAAC,CAAC"}

package/dist/cli/edge-tls/infra-edge-tls-set.cli-command.impl.d.ts

@@ -0,0 +1,14 @@
+/**
+ * `vibes infra edge-tls set --hostname H[,H2] --policy P [--dry-run]`
+ *
+ * Idempotent on the hostname set: updates the live policy for exactly those
+ * hostnames instead of adding a second policy that would race it by rule
+ * order. `--dry-run` prints the diff the write would produce and exits without
+ * touching the provider.
+ */
+import type { CommandContext, CommandOptions } from '@vibesdotdev/cli';
+declare const _default: {
+    execute(_args: CommandOptions, opts: CommandOptions, context: CommandContext): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=infra-edge-tls-set.cli-command.impl.d.ts.map

package/dist/cli/edge-tls/infra-edge-tls-set.cli-command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-edge-tls-set.cli-command.impl.d.ts","sourceRoot":"","sources":["../../../src/cli/edge-tls/infra-edge-tls-set.cli-command.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;;mBAoB9D,cAAc,QACf,cAAc,WACX,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC;;AALjB,wBAiFE"}

package/dist/cli/edge-tls/infra-edge-tls-set.cli-command.impl.js

@@ -0,0 +1,78 @@
+/**
+ * `vibes infra edge-tls set --hostname H[,H2] --policy P [--dry-run]`
+ *
+ * Idempotent on the hostname set: updates the live policy for exactly those
+ * hostnames instead of adding a second policy that would race it by rule
+ * order. `--dry-run` prints the diff the write would produce and exits without
+ * touching the provider.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import {} from '@vibesdotdev/cli/providers';
+import { readHostnames, readString, resolveEdgeTlsImplementation } from "./resolve-edge-tls-provider.js";
+const POLICIES = ['verified', 'encrypted', 'opportunistic', 'off'];
+function parseOriginTlsPolicy(raw) {
+    if (raw === 'verified' || raw === 'encrypted' || raw === 'opportunistic' || raw === 'off') {
+        return raw;
+    }
+    return undefined;
+}
+export default {
+    async execute(_args, opts, context) {
+        const { runtime } = context;
+        const ui = await runtime.context('cli/ui');
+        const output = readString(opts.output) ?? 'text';
+        const dryRun = opts['dry-run'] === true || opts.dryRun === true;
+        const hostnames = readHostnames(opts.hostname);
+        if (hostnames.length === 0) {
+            throw new CapabilityError('--hostname is required.', 'INVALID_INPUT');
+        }
+        const rawPolicy = readString(opts.policy);
+        const requested = rawPolicy ? parseOriginTlsPolicy(rawPolicy) : 'verified';
+        if (!requested) {
+            throw new CapabilityError(`--policy must be one of ${POLICIES.join('|')}; received "${rawPolicy}".`, 'INVALID_INPUT');
+        }
+        const description = readString(opts.description);
+        const policy = description
+            ? { hostnames, policy: requested, description }
+            : { hostnames, policy: requested };
+        const { impl, descriptor } = await resolveEdgeTlsImplementation(runtime, opts);
+        if (dryRun) {
+            const diff = await impl.diff([policy]);
+            if (output === 'json') {
+                ui.json({ dryRun: true, provider: descriptor.id, ...diff });
+                return;
+            }
+            for (const created of diff.create) {
+                ui.info(`create  ${created.hostnames.join(', ')} -> ${created.policy}`);
+            }
+            for (const changed of diff.update) {
+                ui.info(`update  ${changed.to.hostnames.join(', ')}: ` +
+                    `${changed.from.policy ?? changed.from.providerValue} -> ${changed.to.policy}`);
+            }
+            for (const same of diff.unchanged) {
+                ui.info(`ok      ${same.hostnames.join(', ')} already ${same.policy ?? same.providerValue}`);
+            }
+            return;
+        }
+        let result;
+        try {
+            result = await impl.setPolicy(policy);
+        }
+        catch (err) {
+            if (err instanceof CapabilityError)
+                throw err;
+            throw new CapabilityError('Failed to write edge TLS policy.', 'INTERNAL', { cause: err });
+        }
+        if (output === 'json') {
+            ui.json({ provider: descriptor.id, policy, ...result });
+            return;
+        }
+        ui.info(`${result.created ? 'created' : 'updated'} ${hostnames.join(', ')} -> ${requested} ` +
+            `(id=${result.providerId || 'unknown'})`);
+        ui.info(`preserved ${result.preservedRules} co-tenant rule(s); ${result.totalRules} rule(s) now in the container.`);
+        if (requested === 'opportunistic' || requested === 'off') {
+            ui.info('This policy lets the edge reach the origin unencrypted. An origin that redirects HTTP to HTTPS will loop until the edge gives up.');
+        }
+    }
+};
+//# sourceMappingURL=infra-edge-tls-set.cli-command.impl.js.map

package/dist/cli/edge-tls/infra-edge-tls-set.cli-command.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-edge-tls-set.cli-command.impl.js","sourceRoot":"","sources":["../../../src/cli/edge-tls/infra-edge-tls-set.cli-command.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAkB,MAAM,4BAA4B,CAAC;AAE5D,OAAO,EACN,aAAa,EACb,UAAU,EACV,4BAA4B,EAC5B,MAAM,gCAAgC,CAAC;AAExC,MAAM,QAAQ,GAA+B,CAAC,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;AAE/F,SAAS,oBAAoB,CAAC,GAAuB;IACpD,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,eAAe,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;QAC3F,OAAO,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,eAAe;IACd,KAAK,CAAC,OAAO,CACZ,KAAqB,EACrB,IAAoB,EACpB,OAAuB;QAEvB,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAC5B,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,CAAY,QAAQ,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;QAEhE,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,eAAe,CAAC,yBAAyB,EAAE,eAAe,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QAC3E,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,MAAM,IAAI,eAAe,CACxB,2BAA2B,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,SAAS,IAAI,EACzE,eAAe,CACf,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjD,MAAM,MAAM,GAAuB,WAAW;YAC7C,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE;YAC/C,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAEpC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAE/E,IAAI,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YACvC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACvB,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;gBAC5D,OAAO;YACR,CAAC;YACD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBACnC,EAAE,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBACnC,EAAE,CAAC,IAAI,CACN,WAAW,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;oBAC7C,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,aAAa,OAAO,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAC/E,CAAC;YACH,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnC,EAAE,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,OAAO;QACR,CAAC;QAED,IAAI,MAA0B,CAAC;QAC/B,IAAI,CAAC;YACJ,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,eAAe;gBAAE,MAAM,GAAG,CAAC;YAC9C,MAAM,IAAI,eAAe,CACxB,kCAAkC,EAClC,UAAU,EACV,EAAE,KAAK,EAAE,GAAG,EAAE,CACd,CAAC;QACH,CAAC;QAED,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACvB,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;YACxD,OAAO;QACR,CAAC;QACD,EAAE,CAAC,IAAI,CACN,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,SAAS,GAAG;YACnF,OAAO,MAAM,CAAC,UAAU,IAAI,SAAS,GAAG,CACzC,CAAC;QACF,EAAE,CAAC,IAAI,CACN,aAAa,MAAM,CAAC,cAAc,uBAAuB,MAAM,CAAC,UAAU,gCAAgC,CAC1G,CAAC;QACF,IAAI,SAAS,KAAK,eAAe,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YAC1D,EAAE,CAAC,IAAI,CACN,mIAAmI,CACnI,CAAC;QACH,CAAC;IACF,CAAC;CACD,CAAC"}

package/dist/cli/edge-tls/infra-edge-tls.cli-group.descriptor.d.ts

@@ -0,0 +1,12 @@
+declare const _default: {
+    readonly id: "infra-edge-tls";
+    readonly kind: "cli/group";
+    readonly name: "edge-tls";
+    readonly description: "Provider-agnostic edge-to-origin TLS policy — list, set, delete";
+    readonly parent: "infra";
+    readonly surfaces: ["cli"];
+    readonly hardware: ["consumer", "cloud"];
+    readonly enabled: true;
+};
+export default _default;
+//# sourceMappingURL=infra-edge-tls.cli-group.descriptor.d.ts.map

package/dist/cli/edge-tls/infra-edge-tls.cli-group.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-edge-tls.cli-group.descriptor.d.ts","sourceRoot":"","sources":["../../../src/cli/edge-tls/infra-edge-tls.cli-group.descriptor.ts"],"names":[],"mappings":";;;;;;;;;;AAEA,wBASG"}

package/dist/cli/edge-tls/infra-edge-tls.cli-group.descriptor.js

@@ -0,0 +1,12 @@
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+export default createRuntimeAsset({
+    id: 'infra-edge-tls',
+    kind: 'cli/group',
+    name: 'edge-tls',
+    description: 'Provider-agnostic edge-to-origin TLS policy — list, set, delete',
+    parent: 'infra',
+    surfaces: ['cli'],
+    hardware: ['consumer', 'cloud'],
+    enabled: true
+});
+//# sourceMappingURL=infra-edge-tls.cli-group.descriptor.js.map

package/dist/cli/edge-tls/infra-edge-tls.cli-group.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-edge-tls.cli-group.descriptor.js","sourceRoot":"","sources":["../../../src/cli/edge-tls/infra-edge-tls.cli-group.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,eAAe,kBAAkB,CAAC;IACjC,EAAE,EAAE,gBAAgB;IACpB,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,UAAU;IAChB,WAAW,EAAE,iEAAiE;IAC9E,MAAM,EAAE,OAAO;IACf,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,IAAI;CACb,CAAC,CAAC"}

package/dist/cli/edge-tls/resolve-edge-tls-provider.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Shared provider resolution for `vibes infra edge-tls *`.
+ *
+ * Picks the `infra/edge-tls` implementation, optionally scoped to a named
+ * provider and a credential environment.
+ */
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import type { EdgeTlsImplementation, InfraEdgeTlsDescriptor } from '@vibesdotdev/infra-core';
+import type { CommandOptions, CommandOptionValue } from '@vibesdotdev/cli';
+import { readString } from '../shared/option-strings.ts';
+export { readString };
+export interface EdgeTlsCreateOptions {
+    environment?: string;
+    zone?: string;
+}
+export interface EdgeTlsScopedFactory extends EdgeTlsImplementation {
+    create?: (opts: EdgeTlsCreateOptions) => Promise<EdgeTlsImplementation>;
+}
+/** Split a comma-separated hostname option into a normalized list. */
+export declare function readHostnames(value: CommandOptionValue | undefined): string[];
+export declare function resolveEdgeTlsImplementation(runtime: VibesRuntime, opts: CommandOptions): Promise<{
+    impl: EdgeTlsImplementation;
+    descriptor: InfraEdgeTlsDescriptor;
+}>;
+//# sourceMappingURL=resolve-edge-tls-provider.d.ts.map

package/dist/cli/edge-tls/resolve-edge-tls-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-edge-tls-provider.d.ts","sourceRoot":"","sources":["../../../src/cli/edge-tls/resolve-edge-tls-provider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,KAAK,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAC7F,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAG3E,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD,OAAO,EAAE,UAAU,EAAE,CAAC;AAEtB,MAAM,WAAW,oBAAoB;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAqB,SAAQ,qBAAqB;IAClE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,oBAAoB,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACxE;AAED,sEAAsE;AACtE,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,SAAS,GAAG,MAAM,EAAE,CAO7E;AAED,wBAAsB,4BAA4B,CACjD,OAAO,EAAE,YAAY,EACrB,IAAI,EAAE,cAAc,GAClB,OAAO,CAAC;IACV,IAAI,EAAE,qBAAqB,CAAC;IAC5B,UAAU,EAAE,sBAAsB,CAAC;CACnC,CAAC,CAwDD"}

package/dist/cli/edge-tls/resolve-edge-tls-provider.js

@@ -0,0 +1,74 @@
+/**
+ * Shared provider resolution for `vibes infra edge-tls *`.
+ *
+ * Picks the `infra/edge-tls` implementation, optionally scoped to a named
+ * provider and a credential environment.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { inferApexZoneFromWorkspace } from "../shared/infer-apex-zone.js";
+import { readString } from "../shared/option-strings.js";
+export { readString };
+/** Split a comma-separated hostname option into a normalized list. */
+export function readHostnames(value) {
+    const raw = readString(value);
+    if (!raw)
+        return [];
+    return raw
+        .split(',')
+        .map((host) => host.trim())
+        .filter((host) => host.length > 0);
+}
+export async function resolveEdgeTlsImplementation(runtime, opts) {
+    if (!runtime.hasKind('infra/edge-tls')) {
+        throw new CapabilityError('No infra/edge-tls kind registered. Load infra-cloudflare or a sibling provider plugin.', 'NOT_FOUND');
+    }
+    const providerFilter = readString(opts.provider);
+    const descriptors = runtime
+        .assets('infra/edge-tls')
+        .descriptors();
+    const descriptor = providerFilter
+        ? descriptors.find((d) => d.adapter === providerFilter || d.id === providerFilter)
+        : descriptors[0];
+    if (!descriptor) {
+        throw new CapabilityError(`No matching edge TLS provider${providerFilter ? ` for --provider "${providerFilter}"` : ''}.`, 'NOT_FOUND');
+    }
+    const base = await runtime
+        .query('infra/edge-tls')
+        .withId(descriptor.id)
+        .resolve();
+    const environment = readString(opts.environment);
+    let zone = readString(opts.zone);
+    if (!zone) {
+        const hostnames = readHostnames(opts.hostname);
+        if (hostnames.length > 0 && hostnames[0]) {
+            const parts = hostnames[0].split('.');
+            if (parts.length >= 2)
+                zone = parts.slice(-2).join('.');
+        }
+    }
+    if (!zone) {
+        zone = await inferApexZoneFromWorkspace(runtime);
+    }
+    if (!environment && !zone)
+        return { impl: base, descriptor };
+    // Re-create the impl so the descriptor carries the caller's environment
+    // and zone; the memoized zone lookup belongs to the new instance.
+    if (!base.create)
+        return { impl: base, descriptor };
+    const createOpts = {};
+    if (environment)
+        createOpts.environment = environment;
+    if (zone)
+        createOpts.zone = zone;
+    const scoped = await base.create(createOpts);
+    const scopedDescriptor = { ...descriptor };
+    if (environment)
+        scopedDescriptor.environment = environment;
+    if (zone)
+        scopedDescriptor.zone = zone;
+    return {
+        impl: scoped,
+        descriptor: scopedDescriptor
+    };
+}
+//# sourceMappingURL=resolve-edge-tls-provider.js.map

package/dist/cli/edge-tls/resolve-edge-tls-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-edge-tls-provider.js","sourceRoot":"","sources":["../../../src/cli/edge-tls/resolve-edge-tls-provider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAqB,MAAM,qBAAqB,CAAC;AAIzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD,OAAO,EAAE,UAAU,EAAE,CAAC;AAWtB,sEAAsE;AACtE,MAAM,UAAU,aAAa,CAAC,KAAqC;IAClE,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,GAAG;SACR,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CACjD,OAAqB,EACrB,IAAoB;IAKpB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,eAAe,CACxB,wFAAwF,EACxF,WAAW,CACX,CAAC;IACH,CAAC;IACD,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,OAAO;SACzB,MAAM,CAAkC,gBAAgB,CAAC;SACzD,WAAW,EAAE,CAAC;IAChB,MAAM,UAAU,GAAG,cAAc;QAChC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,cAAc,IAAI,CAAC,CAAC,EAAE,KAAK,cAAc,CAAC;QAClF,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAClB,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,MAAM,IAAI,eAAe,CACxB,gCAAgC,cAAc,CAAC,CAAC,CAAC,oBAAoB,cAAc,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAC9F,WAAW,CACX,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,OAAO;SACxB,KAAK,CAA+C,gBAAgB,CAAC;SACrE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;SACrB,OAAO,EAAE,CAAC;IAEZ,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;gBAAE,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzD,CAAC;IACF,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,IAAI,GAAG,MAAM,0BAA0B,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAE7D,wEAAwE;IACxE,kEAAkE;IAClE,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACpD,MAAM,UAAU,GAAyB,EAAE,CAAC;IAC5C,IAAI,WAAW;QAAE,UAAU,CAAC,WAAW,GAAG,WAAW,CAAC;IACtD,IAAI,IAAI;QAAE,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAE7C,MAAM,gBAAgB,GAA2B,EAAE,GAAG,UAAU,EAAE,CAAC;IACnE,IAAI,WAAW;QAAE,gBAAgB,CAAC,WAAW,GAAG,WAAW,CAAC;IAC5D,IAAI,IAAI;QAAE,gBAAgB,CAAC,IAAI,GAAG,IAAI,CAAC;IAEvC,OAAO;QACN,IAAI,EAAE,MAAM;QACZ,UAAU,EAAE,gBAAgB;KAC5B,CAAC;AACH,CAAC"}

package/dist/cli/infra-deploy.cli-group.descriptor.d.ts

@@ -1,12 +1,12 @@
 declare const _default: {
-    id: string;
-    kind: "cli/group";
-    name: string;
-    description: string;
-    parent: string;
-    surfaces: string[];
-    hardware: string[];
-    enabled: true;
+    readonly id: "infra-deploy";
+    readonly kind: "cli/group";
+    readonly name: "deploy";
+    readonly description: "Build and deploy apps declared in deployment.config.ts";
+    readonly parent: "infra";
+    readonly surfaces: ["cli"];
+    readonly hardware: ["consumer", "cloud"];
+    readonly enabled: true;
 };
 export default _default;
 //# sourceMappingURL=infra-deploy.cli-group.descriptor.d.ts.map

package/dist/cli/infra-deploy.cli-group.descriptor.js

@@ -1,4 +1,4 @@
-import { createRuntimeAsset } from '@vibesdotdev/runtime';
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
 export default createRuntimeAsset({
     id: 'infra-deploy',
     kind: 'cli/group',

package/dist/cli/infra-deploy.cli-group.descriptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"infra-deploy.cli-group.descriptor.js","sourceRoot":"","sources":["../../src/cli/infra-deploy.cli-group.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,eAAe,kBAAkB,CAAC;IACjC,EAAE,EAAE,cAAc;IAClB,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,wDAAwD;IACrE,MAAM,EAAE,OAAO;IACf,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,IAAI;CACb,CAAC,CAAC"}
+{"version":3,"file":"infra-deploy.cli-group.descriptor.js","sourceRoot":"","sources":["../../src/cli/infra-deploy.cli-group.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,eAAe,kBAAkB,CAAC;IACjC,EAAE,EAAE,cAAc;IAClB,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,wDAAwD;IACrE,MAAM,EAAE,OAAO;IACf,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,IAAI;CACb,CAAC,CAAC"}

package/dist/cli/infra.cli-group.descriptor.d.ts

@@ -1,11 +1,11 @@
 declare const _default: {
-    id: string;
-    kind: "cli/group";
-    name: string;
-    description: string;
-    surfaces: string[];
-    hardware: string[];
-    enabled: true;
+    readonly id: "infra";
+    readonly kind: "cli/group";
+    readonly name: "infra";
+    readonly description: "Infrastructure commands";
+    readonly surfaces: ["cli"];
+    readonly hardware: ["consumer", "cloud"];
+    readonly enabled: true;
 };
 export default _default;
 //# sourceMappingURL=infra.cli-group.descriptor.d.ts.map

package/dist/cli/infra.cli-group.descriptor.js

@@ -1,4 +1,4 @@
-import { createRuntimeAsset } from '@vibesdotdev/runtime';
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
 export default createRuntimeAsset({
     id: 'infra',
     kind: 'cli/group',

package/dist/cli/infra.cli-group.descriptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"infra.cli-group.descriptor.js","sourceRoot":"","sources":["../../src/cli/infra.cli-group.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,eAAe,kBAAkB,CAAC;IACjC,EAAE,EAAE,OAAO;IACX,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,OAAO;IACb,WAAW,EAAE,yBAAyB;IACtC,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,IAAI;CACb,CAAC,CAAC"}
+{"version":3,"file":"infra.cli-group.descriptor.js","sourceRoot":"","sources":["../../src/cli/infra.cli-group.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,eAAe,kBAAkB,CAAC;IACjC,EAAE,EAAE,OAAO;IACX,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,OAAO;IACb,WAAW,EAAE,yBAAyB;IACtC,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,IAAI;CACb,CAAC,CAAC"}

package/dist/cli/inventory/infra-inventory.cli-command.descriptor.d.ts

@@ -0,0 +1,26 @@
+declare const _default: {
+    readonly id: "infra-inventory";
+    readonly kind: "cli/command";
+    readonly name: "inventory";
+    readonly description: "Read-only inventory from runtime-registered infrastructure providers";
+    readonly group: "infra";
+    readonly options: [{
+        readonly flags: "--provider <id>";
+        readonly description: "Restrict to one infra/inventory descriptor id";
+    }, {
+        readonly flags: "--include <kinds>";
+        readonly description: "Comma-separated infra resource kinds";
+    }, {
+        readonly flags: "--environment <name>";
+        readonly description: "Secrets environment used by provider adapters";
+    }, {
+        readonly flags: "-o, --output <format>";
+        readonly description: "Output format (text|json)";
+        readonly default: "text";
+    }];
+    readonly surfaces: ["cli"];
+    readonly hardware: ["consumer", "cloud"];
+    readonly enabled: true;
+};
+export default _default;
+//# sourceMappingURL=infra-inventory.cli-command.descriptor.d.ts.map

package/dist/cli/inventory/infra-inventory.cli-command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-inventory.cli-command.descriptor.d.ts","sourceRoot":"","sources":["../../../src/cli/inventory/infra-inventory.cli-command.descriptor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAEA,wBAeG"}

package/dist/cli/inventory/infra-inventory.cli-command.descriptor.js

@@ -0,0 +1,18 @@
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+export default createRuntimeAsset({
+    id: 'infra-inventory',
+    kind: 'cli/command',
+    name: 'inventory',
+    description: 'Read-only inventory from runtime-registered infrastructure providers',
+    group: 'infra',
+    options: [
+        { flags: '--provider <id>', description: 'Restrict to one infra/inventory descriptor id' },
+        { flags: '--include <kinds>', description: 'Comma-separated infra resource kinds' },
+        { flags: '--environment <name>', description: 'Secrets environment used by provider adapters' },
+        { flags: '-o, --output <format>', description: 'Output format (text|json)', default: 'text' }
+    ],
+    surfaces: ['cli'],
+    hardware: ['consumer', 'cloud'],
+    enabled: true
+});
+//# sourceMappingURL=infra-inventory.cli-command.descriptor.js.map

package/dist/cli/inventory/infra-inventory.cli-command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-inventory.cli-command.descriptor.js","sourceRoot":"","sources":["../../../src/cli/inventory/infra-inventory.cli-command.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,eAAe,kBAAkB,CAAC;IACjC,EAAE,EAAE,iBAAiB;IACrB,IAAI,EAAE,aAAa;IACnB,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,sEAAsE;IACnF,KAAK,EAAE,OAAO;IACd,OAAO,EAAE;QACR,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,+CAA+C,EAAE;QAC1F,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,sCAAsC,EAAE;QACnF,EAAE,KAAK,EAAE,sBAAsB,EAAE,WAAW,EAAE,+CAA+C,EAAE;QAC/F,EAAE,KAAK,EAAE,uBAAuB,EAAE,WAAW,EAAE,2BAA2B,EAAE,OAAO,EAAE,MAAM,EAAE;KAC7F;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,IAAI;CACb,CAAC,CAAC"}

package/dist/cli/inventory/infra-inventory.cli-command.impl.d.ts

@@ -0,0 +1,18 @@
+import type { CommandContext, CommandOptions } from '@vibesdotdev/cli';
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import type { InventorySnapshot } from '@vibesdotdev/infra-core/kinds';
+export interface InventoryReport {
+    collectedAt: string;
+    providers: Array<{
+        descriptorId: string;
+        snapshot?: InventorySnapshot;
+        error?: string;
+    }>;
+}
+export declare function collectInventoryReport(runtime: VibesRuntime, opts: CommandOptions): Promise<InventoryReport>;
+export declare function renderInventoryText(report: InventoryReport): string;
+declare const _default: {
+    execute(_args: CommandOptions, opts: CommandOptions, context: CommandContext): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=infra-inventory.cli-command.impl.d.ts.map

package/dist/cli/inventory/infra-inventory.cli-command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-inventory.cli-command.impl.d.ts","sourceRoot":"","sources":["../../../src/cli/inventory/infra-inventory.cli-command.impl.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvE,OAAO,EAA6C,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnG,OAAO,KAAK,EAGX,iBAAiB,EACjB,MAAM,+BAA+B,CAAC;AAkBvC,MAAM,WAAW,eAAe;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,KAAK,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzF;AAkBD,wBAAsB,sBAAsB,CAC3C,OAAO,EAAE,YAAY,EACrB,IAAI,EAAE,cAAc,GAClB,OAAO,CAAC,eAAe,CAAC,CA8C1B;AAwCD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAkFnE;;mBAGqB,cAAc,QAAQ,cAAc,WAAW,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;;AADnG,wBAkBE"}