@vibesdotdev/platform 0.0.0-stage → 1.0.0-rc.2

package/dist/cli/fleets/commands/fleet.daemon.token-env.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Credential sources for `vibes fleet daemon`.
+ *
+ * A value on argv is readable by every process and user on the host for the
+ * daemon's lifetime (`ps`), and an installed service copies argv into its
+ * launchd plist / systemd unit / schtasks wrapper. Every credential therefore
+ * has a non-argv source that the daemon reads natively; the argv flags stay
+ * supported for compatibility and are documented as `ps`-visible.
+ *
+ *   credential          argv (ps-visible)   blessed sources, in precedence order
+ *   connection bearer   --token             store `fleet.daemon-credentials` (runtime.resolveCredential)
+ *   enrollment token    --enroll-token      --enroll-token-file <0600 path> → secret VIBES_FLEET_ENROLL_TOKEN
+ *   durable host token  --host-token        secret VIBES_FLEET_HOST_TOKEN → persisted ~/.vibes/hosts/<id>.json
+ *
+ * No credential is read from the process environment (D-RC05). A `secret`
+ * source is `runtime.resolveCredential({ source: 'secret', key })` against the
+ * host's composed stores: an operator publishes one for a run with
+ * `vibes secrets exec --with VIBES_FLEET_ENROLL_TOKEN -- vibes fleet daemon`
+ * (the `host-credentials` store), or keeps it in a store the host composes.
+ * The connection bearer resolves through the by-id `secrets/store` in
+ * `../lib/daemon-credentials-store.ts`, which `vibes fleet daemon install`
+ * writes. Every credential read needs the host's declared environment tier
+ * (`tier-undeclared` otherwise); an installed or provisioned daemon declares
+ * it in its bound root (`@vibesdotdev/platform/fleets/provision`
+ * `daemon-host-config.ts`). Argv keeps top precedence everywhere so
+ * already-installed services and scripts keep their meaning. The daemon
+ * consumes an enrollment token once: a file source is removed after the
+ * durable host token is persisted. Children the daemon spawns get the
+ * environment the kernel composes for them (`envMode: 'replace'`), never the
+ * daemon's own.
+ */
+import type { VibesRuntime } from '@vibesdotdev/kernel';
+import { FLEET_ENROLL_TOKEN_ENV } from '@vibesdotdev/platform/fleets/provision';
+import { FLEET_DAEMON_CREDENTIALS_STORE_ID } from '../lib/daemon-credentials-store.ts';
+export { FLEET_ENROLL_TOKEN_ENV };
+/** The secret key an explicitly published durable host token resolves under. */
+export declare const FLEET_HOST_TOKEN_ENV = "VIBES_FLEET_HOST_TOKEN";
+/** Where the daemon's connection bearer came from; never the value. */
+export type FleetDaemonBearerSource = {
+    readonly kind: 'argv';
+} | {
+    readonly kind: 'store';
+    readonly store: typeof FLEET_DAEMON_CREDENTIALS_STORE_ID;
+};
+export interface FleetDaemonBearer {
+    readonly token: string;
+    readonly source: FleetDaemonBearerSource;
+}
+/**
+ * Resolve the daemon's connection bearer: `--token` (argv, ps-visible) first,
+ * then `runtime.resolveCredential` against the `fleet.daemon-credentials`
+ * store composed on `runtime` for `hostId`. `credential-not-set` is no bearer
+ * (`undefined`); every other failure propagates typed.
+ */
+export declare function resolveFleetDaemonConnectionToken(runtime: VibesRuntime, options: {
+    readonly hostId: string;
+    readonly argvToken?: string;
+}): Promise<FleetDaemonBearer | undefined>;
+export type FleetEnrollTokenSource = 'argv' | 'file' | 'secret';
+export interface FleetEnrollTokenResolution {
+    readonly token: string;
+    readonly source: FleetEnrollTokenSource;
+    /** Set when `source === 'file'`: the path the daemon removes once the token is spent. */
+    readonly file?: string;
+}
+/** What the credential sources read: the handed runtime's composed credential stores. */
+export type FleetTokenRuntime = VibesRuntime;
+/**
+ * Resolve the one-time enrollment token: `--enroll-token` → `--enroll-token-file`
+ * → the `VIBES_FLEET_ENROLL_TOKEN` secret. A named file that is absent is the
+ * steady state after a previous run consumed it, so it falls through rather
+ * than failing; a file readable by other users throws (see `readEnrollTokenFile`).
+ */
+export declare function resolveFleetEnrollToken(runtime: FleetTokenRuntime, options: {
+    readonly argvToken?: string;
+    readonly tokenFile?: string;
+}): Promise<FleetEnrollTokenResolution | undefined>;
+/**
+ * Resolve an explicitly supplied durable host token: `--host-token` → the
+ * `VIBES_FLEET_HOST_TOKEN` secret. The persisted token file is the caller's
+ * fallback.
+ */
+export declare function resolveFleetHostToken(runtime: FleetTokenRuntime, options: {
+    readonly argvToken?: string;
+}): Promise<string | undefined>;
+//# sourceMappingURL=fleet.daemon.token-env.d.ts.map

package/dist/cli/fleets/commands/fleet.daemon.token-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet.daemon.token-env.d.ts","sourceRoot":"","sources":["../../../../src/cli/fleets/commands/fleet.daemon.token-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAEhF,OAAO,EACN,iCAAiC,EAGjC,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EAAE,sBAAsB,EAAE,CAAC;AAElC,gFAAgF;AAChF,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAE7D,uEAAuE;AACvE,MAAM,MAAM,uBAAuB,GAChC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,iCAAiC,CAAA;CAAE,CAAC;AAExF,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;CACzC;AAED;;;;;GAKG;AACH,wBAAsB,iCAAiC,CACtD,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/D,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAYxC;AAED,MAAM,MAAM,sBAAsB,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEhE,MAAM,WAAW,0BAA0B;IAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC,yFAAyF;IACzF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,yFAAyF;AACzF,MAAM,MAAM,iBAAiB,GAAG,YAAY,CAAC;AAqB7C;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC5C,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE;IACR,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC5B,GACC,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC,CAQjD;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAC1C,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE;IAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACtC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAG7B"}

package/dist/cli/fleets/commands/fleet.daemon.token-env.js

@@ -0,0 +1,106 @@
+/**
+ * Credential sources for `vibes fleet daemon`.
+ *
+ * A value on argv is readable by every process and user on the host for the
+ * daemon's lifetime (`ps`), and an installed service copies argv into its
+ * launchd plist / systemd unit / schtasks wrapper. Every credential therefore
+ * has a non-argv source that the daemon reads natively; the argv flags stay
+ * supported for compatibility and are documented as `ps`-visible.
+ *
+ *   credential          argv (ps-visible)   blessed sources, in precedence order
+ *   connection bearer   --token             store `fleet.daemon-credentials` (runtime.resolveCredential)
+ *   enrollment token    --enroll-token      --enroll-token-file <0600 path> → secret VIBES_FLEET_ENROLL_TOKEN
+ *   durable host token  --host-token        secret VIBES_FLEET_HOST_TOKEN → persisted ~/.vibes/hosts/<id>.json
+ *
+ * No credential is read from the process environment (D-RC05). A `secret`
+ * source is `runtime.resolveCredential({ source: 'secret', key })` against the
+ * host's composed stores: an operator publishes one for a run with
+ * `vibes secrets exec --with VIBES_FLEET_ENROLL_TOKEN -- vibes fleet daemon`
+ * (the `host-credentials` store), or keeps it in a store the host composes.
+ * The connection bearer resolves through the by-id `secrets/store` in
+ * `../lib/daemon-credentials-store.ts`, which `vibes fleet daemon install`
+ * writes. Every credential read needs the host's declared environment tier
+ * (`tier-undeclared` otherwise); an installed or provisioned daemon declares
+ * it in its bound root (`@vibesdotdev/platform/fleets/provision`
+ * `daemon-host-config.ts`). Argv keeps top precedence everywhere so
+ * already-installed services and scripts keep their meaning. The daemon
+ * consumes an enrollment token once: a file source is removed after the
+ * durable host token is persisted. Children the daemon spawns get the
+ * environment the kernel composes for them (`envMode: 'replace'`), never the
+ * daemon's own.
+ */
+import { FLEET_ENROLL_TOKEN_ENV } from '@vibesdotdev/platform/fleets/provision';
+import { readEnrollTokenFile } from "../lib/host-token-store.js";
+import { FLEET_DAEMON_CREDENTIALS_STORE_ID, readFleetDaemonBearer, registerFleetDaemonCredentials } from "../lib/daemon-credentials-store.js";
+// One owner for the secret key: the provision module names it for operators.
+export { FLEET_ENROLL_TOKEN_ENV };
+/** The secret key an explicitly published durable host token resolves under. */
+export const FLEET_HOST_TOKEN_ENV = 'VIBES_FLEET_HOST_TOKEN';
+/**
+ * Resolve the daemon's connection bearer: `--token` (argv, ps-visible) first,
+ * then `runtime.resolveCredential` against the `fleet.daemon-credentials`
+ * store composed on `runtime` for `hostId`. `credential-not-set` is no bearer
+ * (`undefined`); every other failure propagates typed.
+ */
+export async function resolveFleetDaemonConnectionToken(runtime, options) {
+    // Keep argv precedence so already-installed services with --token keep working.
+    if (options.argvToken)
+        return { token: options.argvToken, source: { kind: 'argv' } };
+    const retract = registerFleetDaemonCredentials(runtime, options.hostId);
+    try {
+        const token = await readFleetDaemonBearer(runtime);
+        return token === undefined
+            ? undefined
+            : { token, source: { kind: 'store', store: FLEET_DAEMON_CREDENTIALS_STORE_ID } };
+    }
+    finally {
+        retract();
+    }
+}
+/**
+ * The confirmed absences of a secret source: the selected store does not hold
+ * the key (`credential-not-set`), or the host composes no secrets store at all
+ * (`no-store`), so nothing was published to it.
+ */
+const SECRET_ABSENT = new Set(['credential-not-set', 'no-store']);
+/**
+ * One secret through `runtime.resolveCredential`: its value, or `undefined`
+ * on a confirmed absence. Every other failure (`tier-undeclared`, an exposed
+ * or stale store) propagates typed.
+ */
+async function resolveSecret(runtime, key) {
+    const result = await runtime.resolveCredential({ source: 'secret', key });
+    if (result.ok)
+        return result.value.trim() || undefined;
+    if (SECRET_ABSENT.has(result.error.reason))
+        return undefined;
+    throw result.error;
+}
+/**
+ * Resolve the one-time enrollment token: `--enroll-token` → `--enroll-token-file`
+ * → the `VIBES_FLEET_ENROLL_TOKEN` secret. A named file that is absent is the
+ * steady state after a previous run consumed it, so it falls through rather
+ * than failing; a file readable by other users throws (see `readEnrollTokenFile`).
+ */
+export async function resolveFleetEnrollToken(runtime, options) {
+    if (options.argvToken)
+        return { token: options.argvToken, source: 'argv' };
+    if (options.tokenFile) {
+        const token = await readEnrollTokenFile(runtime, options.tokenFile);
+        if (token)
+            return { token, source: 'file', file: options.tokenFile };
+    }
+    const secret = await resolveSecret(runtime, FLEET_ENROLL_TOKEN_ENV);
+    return secret ? { token: secret, source: 'secret' } : undefined;
+}
+/**
+ * Resolve an explicitly supplied durable host token: `--host-token` → the
+ * `VIBES_FLEET_HOST_TOKEN` secret. The persisted token file is the caller's
+ * fallback.
+ */
+export async function resolveFleetHostToken(runtime, options) {
+    if (options.argvToken)
+        return options.argvToken;
+    return resolveSecret(runtime, FLEET_HOST_TOKEN_ENV);
+}
+//# sourceMappingURL=fleet.daemon.token-env.js.map

package/dist/cli/fleets/commands/fleet.daemon.token-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet.daemon.token-env.js","sourceRoot":"","sources":["../../../../src/cli/fleets/commands/fleet.daemon.token-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAGH,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EACN,iCAAiC,EACjC,qBAAqB,EACrB,8BAA8B,EAC9B,MAAM,oCAAoC,CAAC;AAE5C,6EAA6E;AAC7E,OAAO,EAAE,sBAAsB,EAAE,CAAC;AAElC,gFAAgF;AAChF,MAAM,CAAC,MAAM,oBAAoB,GAAG,wBAAwB,CAAC;AAY7D;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACtD,OAAqB,EACrB,OAAiE;IAEjE,gFAAgF;IAChF,IAAI,OAAO,CAAC,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;IACrF,MAAM,OAAO,GAAG,8BAA8B,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACxE,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACnD,OAAO,KAAK,KAAK,SAAS;YACzB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAAE,CAAC;IACnF,CAAC;YAAS,CAAC;QACV,OAAO,EAAE,CAAC;IACX,CAAC;AACF,CAAC;AAcD;;;;GAIG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC,CAAC;AAElE;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAAC,OAA0B,EAAE,GAAW;IACnE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1E,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IACvD,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7D,MAAM,MAAM,CAAC,KAAK,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,OAA0B,EAC1B,OAGC;IAED,IAAI,OAAO,CAAC,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC3E,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACpE,IAAI,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;IACtE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IACpE,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,OAA0B,EAC1B,OAAwC;IAExC,IAAI,OAAO,CAAC,SAAS;QAAE,OAAO,OAAO,CAAC,SAAS,CAAC;IAChD,OAAO,aAAa,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;AACrD,CAAC"}

package/dist/cli/fleets/commands/fleet.daemon.uninstall.command.descriptor.d.ts

@@ -0,0 +1,7 @@
+/**
+ * `vibes fleet daemon uninstall` — remove the fleet daemon OS service.
+ */
+import type { CLICommandAssetDescriptor } from '@vibesdotdev/kernel/schemas/asset';
+declare const descriptor: CLICommandAssetDescriptor;
+export default descriptor;
+//# sourceMappingURL=fleet.daemon.uninstall.command.descriptor.d.ts.map

package/dist/cli/fleets/commands/fleet.daemon.uninstall.command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet.daemon.uninstall.command.descriptor.d.ts","sourceRoot":"","sources":["../../../../src/cli/fleets/commands/fleet.daemon.uninstall.command.descriptor.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAEnF,QAAA,MAAM,UAAU,EAAE,yBAoBjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/cli/fleets/commands/fleet.daemon.uninstall.command.descriptor.js

@@ -0,0 +1,26 @@
+/**
+ * `vibes fleet daemon uninstall` — remove the fleet daemon OS service.
+ */
+const descriptor = {
+    kind: 'cli/command',
+    id: 'fleet.daemon.uninstall',
+    name: 'uninstall',
+    description: 'Uninstall the fleet daemon OS service',
+    group: 'fleet',
+    arguments: [],
+    options: [
+        {
+            flags: '--host-id <id>',
+            description: 'Host ID (required, e.g. studio-mini)'
+        },
+        {
+            flags: '--scope <scope>',
+            description: 'Service scope: user (default) or system'
+        }
+    ],
+    surfaces: ['cli'],
+    hardware: ['consumer'],
+    enabled: true
+};
+export default descriptor;
+//# sourceMappingURL=fleet.daemon.uninstall.command.descriptor.js.map

package/dist/cli/fleets/commands/fleet.daemon.uninstall.command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet.daemon.uninstall.command.descriptor.js","sourceRoot":"","sources":["../../../../src/cli/fleets/commands/fleet.daemon.uninstall.command.descriptor.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,MAAM,UAAU,GAA8B;IAC7C,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,wBAAwB;IAC5B,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,uCAAuC;IACpD,KAAK,EAAE,OAAO;IACd,SAAS,EAAE,EAAE;IACb,OAAO,EAAE;QACR;YACC,KAAK,EAAE,gBAAgB;YACvB,WAAW,EAAE,sCAAsC;SACnD;QACD;YACC,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,yCAAyC;SACtD;KACD;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;CACb,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/cli/fleets/commands/fleet.daemon.uninstall.command.impl.d.ts

@@ -0,0 +1,6 @@
+import type { CommandContext, CommandOptions } from '@vibesdotdev/cli';
+declare const _default: {
+    execute(_args: CommandOptions, opts: CommandOptions, context: CommandContext): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=fleet.daemon.uninstall.command.impl.d.ts.map

package/dist/cli/fleets/commands/fleet.daemon.uninstall.command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet.daemon.uninstall.command.impl.d.ts","sourceRoot":"","sources":["../../../../src/cli/fleets/commands/fleet.daemon.uninstall.command.impl.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;;mBAKjD,cAAc,QAAQ,cAAc,WAAW,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;;AADnG,wBAqBE"}

package/dist/cli/fleets/commands/fleet.daemon.uninstall.command.impl.js

@@ -0,0 +1,30 @@
+import { FleetDaemonUninstallOptionsSchema } from "../../../schemas/cli/daemon-install.js";
+import { writeStdoutLine } from '@vibesdotdev/cli/output';
+/**
+ * `vibes fleet daemon uninstall` implementation.
+ */
+import { getFleetServiceBackend } from '@vibesdotdev/platform/fleets/service-backends';
+import { buildFleetDaemonUninstallDescriptor } from "./fleet.daemon.service-descriptor.js";
+import { getPathRoots } from '@vibesdotdev/paths';
+import { defaultEnrollTokenFile, removeEnrollTokenFile } from "../lib/host-token-store.js";
+export default {
+    async execute(_args, opts, context) {
+        const { hostId, scope } = FleetDaemonUninstallOptionsSchema.parse(opts);
+        const descriptor = buildFleetDaemonUninstallDescriptor(context.runtime, { hostId, scope });
+        const backend = await getFleetServiceBackend(context.runtime);
+        const isReg = await backend.isRegistered(descriptor);
+        if (!isReg) {
+            await writeStdoutLine(context.runtime, `[fleet daemon uninstall] Service not found: ${descriptor.id}`);
+            return;
+        }
+        await backend.unregister(descriptor);
+        await writeStdoutLine(context.runtime, `[fleet daemon uninstall] Uninstalled: ${descriptor.id}`);
+        // An enrollment token the install wrote but the daemon never consumed
+        // (service never started) must not outlive the service.
+        const enrollTokenFile = defaultEnrollTokenFile(getPathRoots(context.runtime), hostId);
+        if (await removeEnrollTokenFile(context.runtime, enrollTokenFile)) {
+            await writeStdoutLine(context.runtime, `[fleet daemon uninstall] Removed unconsumed enrollment token file: ${enrollTokenFile}`);
+        }
+    }
+};
+//# sourceMappingURL=fleet.daemon.uninstall.command.impl.js.map

package/dist/cli/fleets/commands/fleet.daemon.uninstall.command.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet.daemon.uninstall.command.impl.js","sourceRoot":"","sources":["../../../../src/cli/fleets/commands/fleet.daemon.uninstall.command.impl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iCAAiC,EAAE,MAAM,wCAAwC,CAAC;AAC3F,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D;;GAEG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,EAAE,mCAAmC,EAAE,MAAM,sCAAsC,CAAC;AAE3F,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAE3F,eAAe;IACd,KAAK,CAAC,OAAO,CAAC,KAAqB,EAAE,IAAoB,EAAE,OAAuB;QACjF,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,iCAAiC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxE,MAAM,UAAU,GAAG,mCAAmC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAE3F,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,MAAM,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,+CAA+C,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;YACvG,OAAO;QACR,CAAC;QACD,MAAM,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QACrC,MAAM,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,yCAAyC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QAEjG,sEAAsE;QACtE,wDAAwD;QACxD,MAAM,eAAe,GAAG,sBAAsB,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QACtF,IAAI,MAAM,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,CAAC;YACnE,MAAM,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,sEAAsE,eAAe,EAAE,CAAC,CAAC;QACjI,CAAC;IACF,CAAC;CACD,CAAC"}

package/dist/cli/fleets/commands/fleet.destroy.command.descriptor.d.ts

@@ -0,0 +1,7 @@
+/**
+ * `vibes fleet destroy` — tear down a launched fleet host (droplet + record).
+ */
+import type { CLICommandAssetDescriptor } from '@vibesdotdev/kernel/schemas/asset';
+declare const descriptor: CLICommandAssetDescriptor;
+export default descriptor;
+//# sourceMappingURL=fleet.destroy.command.descriptor.d.ts.map

package/dist/cli/fleets/commands/fleet.destroy.command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet.destroy.command.descriptor.d.ts","sourceRoot":"","sources":["../../../../src/cli/fleets/commands/fleet.destroy.command.descriptor.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAEnF,QAAA,MAAM,UAAU,EAAE,yBAWjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/cli/fleets/commands/fleet.destroy.command.descriptor.js

@@ -0,0 +1,17 @@
+/**
+ * `vibes fleet destroy` — tear down a launched fleet host (droplet + record).
+ */
+const descriptor = {
+    kind: 'cli/command',
+    id: 'fleet.destroy',
+    name: 'destroy',
+    description: 'Destroy a launched fleet host — tears down the droplet and retires the record',
+    group: 'fleet',
+    arguments: [{ name: 'id', description: 'Host ID or record ID to destroy', required: true }],
+    options: [{ flags: '--json', description: 'Output as JSON' }],
+    surfaces: ['cli'],
+    hardware: ['consumer', 'cloud'],
+    enabled: true
+};
+export default descriptor;
+//# sourceMappingURL=fleet.destroy.command.descriptor.js.map

package/dist/cli/fleets/commands/fleet.destroy.command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet.destroy.command.descriptor.js","sourceRoot":"","sources":["../../../../src/cli/fleets/commands/fleet.destroy.command.descriptor.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,MAAM,UAAU,GAA8B;IAC7C,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,SAAS;IACf,WAAW,EAAE,+EAA+E;IAC5F,KAAK,EAAE,OAAO;IACd,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,iCAAiC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3F,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAC7D,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,IAAI;CACb,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/cli/fleets/commands/fleet.destroy.command.impl.d.ts

@@ -0,0 +1,41 @@
+/**
+ * `vibes fleet destroy` implementation (fleet-droplet F1.1, gap G3).
+ *
+ * Calls the deprovision route (`DELETE /api/hosts/[id]`, fleet-droplet F1.4)
+ * which tears down the IaaS instance and retires the host record. The
+ * argument accepts either the host record uuid or the kebab-case hostId —
+ * resolved against the owner-scoped inventory first so a 404 from DELETE
+ * unambiguously means the route is absent.
+ *
+ * The command reports what the platform says it tore down, never what an
+ * HTTP 200 implies. Measured 2026-09-06: `vibes fleet destroy
+ * workspace-vibes-visual-kit --json` printed `deprovisioned: true` for a row
+ * whose sandboxResourceId was null; nothing was deleted and the droplet kept
+ * billing. The route now answers `{ deprovisioned, deletedInstanceIds,
+ * reason? }` (platform-web #78). A body without those fields is reported as
+ * unknown, not as success, and the exit code is 0 only when the platform
+ * confirmed an instance was deleted — a script that chains on exit 0 must
+ * never proceed past a droplet that is still running.
+ *
+ * Fallback: against a platform that predates the deprovision route the
+ * command retires the record (`PATCH status=retired`) and reports that the
+ * droplet teardown is left to the reaper (F1.3) — also a non-zero exit.
+ */
+import type { CommandContext, CommandOptions } from '@vibesdotdev/cli';
+import type { PlatformApiClient } from '@vibesdotdev/platform/api';
+import type { Host } from '@vibesdotdev/platform/hosts/schemas/types';
+import { type FleetDestroyOutcome } from '../../../schemas/fleet-cli.ts';
+export type { FleetDestroyOutcome } from '../../../schemas/fleet-cli.ts';
+export declare const UNKNOWN_DEPROVISION_REASON = "the platform did not report whether an instance was deleted (legacy response body); verify the droplet by hand";
+export declare const RETIRE_ONLY_REASON = "the platform has no deprovision route; the record is retired and the droplet is left to the stale-host reaper";
+export declare function interpretDeprovisionBody<Body>(host: Host, body: Body): FleetDestroyOutcome;
+export declare function executeFleetDestroy(ref: string, platform: PlatformApiClient): Promise<FleetDestroyOutcome>;
+/** Exit 0 only when the platform confirmed an instance was deleted. */
+export declare function fleetDestroyExitCode(outcome: Pick<FleetDestroyOutcome, 'deprovisioned'>): 0 | 1;
+/** One human-readable line stating the outcome; shared with `workspace destroy`. */
+export declare function describeDestroyOutcome(noun: 'host' | 'workspace', outcome: FleetDestroyOutcome): string;
+declare const _default: {
+    execute(args: CommandOptions, opts: CommandOptions, context: CommandContext): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=fleet.destroy.command.impl.d.ts.map

package/dist/cli/fleets/commands/fleet.destroy.command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet.destroy.command.impl.d.ts","sourceRoot":"","sources":["../../../../src/cli/fleets/commands/fleet.destroy.command.impl.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAIvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,2CAA2C,CAAC;AAKtE,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAClG,YAAY,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAEzE,eAAO,MAAM,0BAA0B,mHAC0E,CAAC;AAElH,eAAO,MAAM,kBAAkB,kHACiF,CAAC;AAEjH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,GAAG,mBAAmB,CAU1F;AAED,wBAAsB,mBAAmB,CACxC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,iBAAiB,GACzB,OAAO,CAAC,mBAAmB,CAAC,CAkB9B;AAED,uEAAuE;AACvE,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,mBAAmB,EAAE,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAE/F;AAED,oFAAoF;AACpF,wBAAgB,sBAAsB,CACrC,IAAI,EAAE,MAAM,GAAG,WAAW,EAC1B,OAAO,EAAE,mBAAmB,GAC1B,MAAM,CAaR;;kBAGoB,cAAc,QAAQ,cAAc,WAAW,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;;AADlG,wBA6BE"}

package/dist/cli/fleets/commands/fleet.destroy.command.impl.js

@@ -0,0 +1,89 @@
+import { settle } from '@vibesdotdev/kernel';
+import { writeStdoutLine, commandWriters } from '@vibesdotdev/cli/output';
+import { PlatformApiError } from '@vibesdotdev/platform/client';
+import { getAuthedPlatformClient } from "../lib/authed-platform.js";
+import { resolveHost } from "../lib/host-ref.js";
+import { fleetDestroyInputSchema } from "./fleet.schemas.js";
+import { writeJson } from '@vibesdotdev/cli/output';
+import { requestCLIExit } from '@vibesdotdev/cli/providers';
+import { LegacyDeprovisionSchema } from "../../../schemas/fleet-cli.js";
+export const UNKNOWN_DEPROVISION_REASON = 'the platform did not report whether an instance was deleted (legacy response body); verify the droplet by hand';
+export const RETIRE_ONLY_REASON = 'the platform has no deprovision route; the record is retired and the droplet is left to the stale-host reaper';
+export function interpretDeprovisionBody(host, body) {
+    const parsed = LegacyDeprovisionSchema.safeParse(body);
+    const record = parsed.success ? parsed.data : null;
+    const reported = record?.deprovisioned ?? null;
+    return {
+        host: record?.result ?? record?.host ?? host,
+        deprovisioned: reported,
+        deletedInstanceIds: record?.deletedInstanceIds ?? [],
+        reason: record?.reason ?? (reported === null ? UNKNOWN_DEPROVISION_REASON : null)
+    };
+}
+export async function executeFleetDestroy(ref, platform) {
+    const host = await resolveHost(platform, ref);
+    if (!host) {
+        throw new Error(`No fleet host matches '${ref}'. List hosts with \`vibes fleet ls\`.`);
+    }
+    const receipt = await settle(() => platform.hosts.deprovision(host.id));
+    if (receipt.ok)
+        return interpretDeprovisionBody(host, receipt.value);
+    const error = receipt.cause;
+    if (!(error instanceof PlatformApiError && (error.status === 404 || error.status === 405)))
+        throw error;
+    const retired = await platform.hosts.update(host.id, { status: 'retired' });
+    return {
+        host: retired,
+        deprovisioned: false,
+        deletedInstanceIds: [],
+        reason: RETIRE_ONLY_REASON
+    };
+}
+/** Exit 0 only when the platform confirmed an instance was deleted. */
+export function fleetDestroyExitCode(outcome) {
+    return outcome.deprovisioned === true ? 0 : 1;
+}
+/** One human-readable line stating the outcome; shared with `workspace destroy`. */
+export function describeDestroyOutcome(noun, outcome) {
+    const label = `${noun} ${outcome.host.hostId}`;
+    if (outcome.deprovisioned === true) {
+        const ids = outcome.deletedInstanceIds.length > 0
+            ? ` (deleted instance ${outcome.deletedInstanceIds.join(', ')})`
+            : '';
+        return `Destroyed ${label}${ids}.`;
+    }
+    if (outcome.deprovisioned === false) {
+        return `Retired ${label}, but no instance was deleted${outcome.reason ? `: ${outcome.reason}` : ''}.`;
+    }
+    return `Retired ${label}; ${outcome.reason ?? UNKNOWN_DEPROVISION_REASON}.`;
+}
+export default {
+    async execute(args, opts, context) {
+        const asJson = Boolean(opts.json);
+        const parsed = fleetDestroyInputSchema.safeParse({ id: args['id'] });
+        if (!parsed.success) {
+            const issues = parsed.error.issues.map((i) => `${i.path.join('.')}: ${i.message}`).join(', ');
+            throw new Error(`Invalid input: ${issues}`);
+        }
+        const platform = await getAuthedPlatformClient(context.runtime);
+        const outcome = await executeFleetDestroy(parsed.data.id, platform);
+        const exitCode = fleetDestroyExitCode(outcome);
+        if (asJson) {
+            await writeJson(context.runtime, {
+                host: outcome.host,
+                deprovisioned: outcome.deprovisioned,
+                deletedInstanceIds: outcome.deletedInstanceIds,
+                reason: outcome.reason
+            });
+        }
+        else if (exitCode === 0) {
+            await writeStdoutLine(context.runtime, describeDestroyOutcome('host', outcome));
+        }
+        else {
+            (await commandWriters(context.runtime)).log(describeDestroyOutcome('host', outcome));
+        }
+        if (exitCode !== 0)
+            requestCLIExit(exitCode);
+    }
+};
+//# sourceMappingURL=fleet.destroy.command.impl.js.map

package/dist/cli/fleets/commands/fleet.destroy.command.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet.destroy.command.impl.js","sourceRoot":"","sources":["../../../../src/cli/fleets/commands/fleet.destroy.command.impl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AA0B1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,EAAE,uBAAuB,EAA4B,MAAM,+BAA+B,CAAC;AAGlG,MAAM,CAAC,MAAM,0BAA0B,GACtC,gHAAgH,CAAC;AAElH,MAAM,CAAC,MAAM,kBAAkB,GAC9B,+GAA+G,CAAC;AAEjH,MAAM,UAAU,wBAAwB,CAAO,IAAU,EAAE,IAAU;IACpE,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,EAAE,aAAa,IAAI,IAAI,CAAC;IAC/C,OAAO;QACN,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,MAAM,EAAE,IAAI,IAAI,IAAI;QAC5C,aAAa,EAAE,QAAQ;QACvB,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,IAAI,EAAE;QACpD,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC;KACjF,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,GAAW,EACX,QAA2B;IAE3B,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,wCAAwC,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACxE,IAAI,OAAO,CAAC,EAAE;QAAE,OAAO,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,IAAI,CAAC,CAAC,KAAK,YAAY,gBAAgB,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;QAAE,MAAM,KAAK,CAAC;IAExG,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC5E,OAAO;QACN,IAAI,EAAE,OAAO;QACb,aAAa,EAAE,KAAK;QACpB,kBAAkB,EAAE,EAAE;QACtB,MAAM,EAAE,kBAAkB;KAC1B,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,oBAAoB,CAAC,OAAmD;IACvF,OAAO,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,sBAAsB,CACrC,IAA0B,EAC1B,OAA4B;IAE5B,MAAM,KAAK,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IAC/C,IAAI,OAAO,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QACpC,MAAM,GAAG,GACR,OAAO,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;YACpC,CAAC,CAAC,sBAAsB,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAChE,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,aAAa,KAAK,GAAG,GAAG,GAAG,CAAC;IACpC,CAAC;IACD,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;QACrC,OAAO,WAAW,KAAK,gCAAgC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;IACvG,CAAC;IACD,OAAO,WAAW,KAAK,KAAK,OAAO,CAAC,MAAM,IAAI,0BAA0B,GAAG,CAAC;AAC7E,CAAC;AAED,eAAe;IACd,KAAK,CAAC,OAAO,CAAC,IAAoB,EAAE,IAAoB,EAAE,OAAuB;QAChF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAElC,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9F,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,EAAE,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAE/C,IAAI,MAAM,EAAE,CAAC;YACZ,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE;gBAChC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;gBAC9C,MAAM,EAAE,OAAO,CAAC,MAAM;aACtB,CAAC,CAAC;QACJ,CAAC;aAAM,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACjF,CAAC;aAAM,CAAC;YACP,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACtF,CAAC;QAED,IAAI,QAAQ,KAAK,CAAC;YAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC;CACD,CAAC"}

package/dist/cli/fleets/commands/fleet.enroll-token.cli-group.descriptor.d.ts

@@ -0,0 +1,7 @@
+/**
+ * `vibes fleet enroll-token` CLI group descriptor.
+ */
+import type { CLIGroupAssetDescriptor } from '@vibesdotdev/kernel/schemas/asset';
+declare const descriptor: CLIGroupAssetDescriptor;
+export default descriptor;
+//# sourceMappingURL=fleet.enroll-token.cli-group.descriptor.d.ts.map

package/dist/cli/fleets/commands/fleet.enroll-token.cli-group.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet.enroll-token.cli-group.descriptor.d.ts","sourceRoot":"","sources":["../../../../src/cli/fleets/commands/fleet.enroll-token.cli-group.descriptor.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAEjF,QAAA,MAAM,UAAU,EAAE,uBASjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/cli/fleets/commands/fleet.enroll-token.cli-group.descriptor.js

@@ -0,0 +1,15 @@
+/**
+ * `vibes fleet enroll-token` CLI group descriptor.
+ */
+const descriptor = {
+    kind: 'cli/group',
+    id: 'fleet.enroll-token',
+    name: 'enroll-token',
+    description: 'Issue one-time enrollment tokens for user-managed fleet machines',
+    parent: 'fleet',
+    surfaces: ['cli'],
+    hardware: ['consumer', 'cloud'],
+    enabled: true
+};
+export default descriptor;
+//# sourceMappingURL=fleet.enroll-token.cli-group.descriptor.js.map

package/dist/cli/fleets/commands/fleet.enroll-token.cli-group.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet.enroll-token.cli-group.descriptor.js","sourceRoot":"","sources":["../../../../src/cli/fleets/commands/fleet.enroll-token.cli-group.descriptor.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,MAAM,UAAU,GAA4B;IAC3C,IAAI,EAAE,WAAW;IACjB,EAAE,EAAE,oBAAoB;IACxB,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,kEAAkE;IAC/E,MAAM,EAAE,OAAO;IACf,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,IAAI;CACb,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/cli/fleets/commands/fleet.enroll-token.create.command.descriptor.d.ts

@@ -0,0 +1,8 @@
+/**
+ * `vibes fleet enroll-token create` — register a host identity and mint a
+ * one-time enrollment token for a machine you manage yourself.
+ */
+import type { CLICommandAssetDescriptor } from '@vibesdotdev/kernel/schemas/asset';
+declare const descriptor: CLICommandAssetDescriptor;
+export default descriptor;
+//# sourceMappingURL=fleet.enroll-token.create.command.descriptor.d.ts.map

package/dist/cli/fleets/commands/fleet.enroll-token.create.command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet.enroll-token.create.command.descriptor.d.ts","sourceRoot":"","sources":["../../../../src/cli/fleets/commands/fleet.enroll-token.create.command.descriptor.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAEnF,QAAA,MAAM,UAAU,EAAE,yBA8CjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/cli/fleets/commands/fleet.enroll-token.create.command.descriptor.js

@@ -0,0 +1,51 @@
+/**
+ * `vibes fleet enroll-token create` — register a host identity and mint a
+ * one-time enrollment token for a machine you manage yourself.
+ */
+const descriptor = {
+    kind: 'cli/command',
+    id: 'fleet.enroll-token.create',
+    name: 'create',
+    description: 'Mint a one-time enrollment token for a user-managed fleet machine',
+    group: 'fleet.enroll-token',
+    arguments: [],
+    options: [
+        { flags: '--host-id <id>', description: 'Host ID (kebab-case, e.g. my-droplet)' },
+        { flags: '--name <name>', description: 'Host display name (defaults to the host ID)' },
+        { flags: '--description <text>', description: 'Optional description' },
+        {
+            flags: '--owner-type <type>',
+            description: 'user | organization (default: resolved from your session)'
+        },
+        { flags: '--owner-id <id>', description: 'Owner ID (default: resolved from your session)' },
+        {
+            flags: '--provider <provider>',
+            description: 'custom | aws | do | gcp | azure (default: custom — a machine you manage yourself)'
+        },
+        { flags: '--region <region>', description: 'Region' },
+        { flags: '--label <label...>', description: 'Capability label, repeatable' },
+        {
+            flags: '--accept <kind:source...>',
+            description: 'Action kind and source kind the host accepts, e.g. infra/build-job:git (repeatable; needs host administration). Without it the host accepts nothing until `vibes fleet policy` sets it'
+        },
+        {
+            flags: '--expires-in-hours <hours>',
+            description: 'Token TTL in hours (default 24, max 168)'
+        },
+        {
+            flags: '--cloud-init',
+            description: 'Also print a paste-ready cloud-init user-data script for the machine'
+        },
+        {
+            flags: '--tier <tier>',
+            description: "The provisioned host's environment tier (local, dev, staging or production); required with " +
+                '--cloud-init. It is written to the daemon root as config runtime.host; there is no default.'
+        },
+        { flags: '--json', description: 'Output as JSON' }
+    ],
+    surfaces: ['cli'],
+    hardware: ['consumer', 'cloud'],
+    enabled: true
+};
+export default descriptor;
+//# sourceMappingURL=fleet.enroll-token.create.command.descriptor.js.map

package/dist/cli/fleets/commands/fleet.enroll-token.create.command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet.enroll-token.create.command.descriptor.js","sourceRoot":"","sources":["../../../../src/cli/fleets/commands/fleet.enroll-token.create.command.descriptor.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,UAAU,GAA8B;IAC7C,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,2BAA2B;IAC/B,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,mEAAmE;IAChF,KAAK,EAAE,oBAAoB;IAC3B,SAAS,EAAE,EAAE;IACb,OAAO,EAAE;QACR,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,uCAAuC,EAAE;QACjF,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,6CAA6C,EAAE;QACtF,EAAE,KAAK,EAAE,sBAAsB,EAAE,WAAW,EAAE,sBAAsB,EAAE;QACtE;YACC,KAAK,EAAE,qBAAqB;YAC5B,WAAW,EAAE,2DAA2D;SACxE;QACD,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,gDAAgD,EAAE;QAC3F;YACC,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,mFAAmF;SAChG;QACD,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,QAAQ,EAAE;QACrD,EAAE,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,8BAA8B,EAAE;QAC5E;YACC,KAAK,EAAE,2BAA2B;YAClC,WAAW,EACV,wLAAwL;SACzL;QACD;YACC,KAAK,EAAE,4BAA4B;YACnC,WAAW,EAAE,0CAA0C;SACvD;QACD;YACC,KAAK,EAAE,cAAc;YACrB,WAAW,EAAE,sEAAsE;SACnF;QACD;YACC,KAAK,EAAE,eAAe;YACtB,WAAW,EACV,6FAA6F;gBAC7F,6FAA6F;SAC9F;QACD,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,gBAAgB,EAAE;KAClD;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,IAAI;CACb,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/cli/fleets/commands/fleet.enroll-token.create.command.impl.d.ts

@@ -0,0 +1,22 @@
+import type { VibesRuntime } from '@vibesdotdev/kernel';
+import type { CommandContext, CommandOptions } from '@vibesdotdev/cli';
+import { type FleetEnrollTokenCreateInput } from './fleet.schemas.ts';
+export declare function executeEnrollTokenCreate(runtime: VibesRuntime, input: FleetEnrollTokenCreateInput): Promise<{
+    hostId: string;
+    enrollmentId: string;
+    token: string;
+    expiresAt: Date | null;
+    cloudInit?: string;
+}>;
+/**
+ * The enroll instructions printed after minting. The token is shown once (above
+ * these lines) and never on a daemon argv: argv is visible in `ps` to every
+ * user on the host and an installed service copies it into its definition. The
+ * file path uses `~` because the target machine is usually not this one.
+ */
+export declare function renderEnrollInstructions(hostId: string, token: string): string[];
+declare const _default: {
+    execute(_args: CommandOptions, opts: CommandOptions, context: CommandContext): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=fleet.enroll-token.create.command.impl.d.ts.map

package/dist/cli/fleets/commands/fleet.enroll-token.create.command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet.enroll-token.create.command.impl.d.ts","sourceRoot":"","sources":["../../../../src/cli/fleets/commands/fleet.enroll-token.create.command.impl.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvE,OAAO,EAEN,KAAK,2BAA2B,EAChC,MAAM,oBAAoB,CAAC;AA0C5B,wBAAsB,wBAAwB,CAC7C,OAAO,EAAE,YAAY,EACrB,KAAK,EAAE,2BAA2B,GAChC,OAAO,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC,CAkDD;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAYhF;;mBAIQ,cAAc,QACf,cAAc,WACX,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC;;AALjB,wBA+DE"}