alepha 0.21.2 → 0.23.0

package/dist/cli/platform/index.d.ts

@@ -1,1121 +1,19 @@
-import * as _$alepha from "alepha";
-import { Alepha, Static, TSchema } from "alepha";
-import { AlephaCliUtils, AppEntry, AppEntryProvider, PackageManagerUtils, ViteBuildProvider } from "alepha/cli";
-import * as _$alepha_command0 from "alepha/command";
-import { Asker, EnvUtils, Runner, RunnerMethod } from "alepha/command";
-import * as _$alepha_logger0 from "alepha/logger";
+import { AppEntry, AppEntryProvider, ViteBuildProvider } from "alepha/cli";
+import { DetectedResources, GitHubSecretStore, NamingService, PlatformInspector, PlatformOptions, PlatformOrchestrator, ResolvedPlatformConfig, SecretFilterService, SecretStoreProvider } from "alepha/cli/platform-lib";
+import { EnvUtils } from "alepha/command";
 import { ConsoleColorProvider } from "alepha/logger";
-import { FileSystemProvider, ShellProvider } from "alepha/system";
-import { DateTimeProvider } from "alepha/datetime";
-import * as _$typebox from "typebox";
 
-//#region ../../src/cli/platform/atoms/platformOptions.d.ts
-/**
- * Platform deployment configuration atom.
- *
- * Filled from the `platform` section of `alepha.config.ts`.
- * Read by `PlatformCommand` to resolve environments and adapters.
- */
-declare const platformOptions: _$alepha.Atom<_$typebox.TOptional<_$typebox.TObject<{
-  /**
-   * Project name override. Defaults to root package.json "name".
-   */
-  name: _$typebox.TOptional<_$typebox.TString>;
-  /**
-   * Default environment when --env is omitted.
-   *
-   * @default "production"
-   */
-  default: _$typebox.TOptional<_$typebox.TString>;
-  /**
-   * Secret store configuration for syncing .env secrets
-   * to external providers (e.g. GitHub Actions environments).
-   */
-  secrets: _$typebox.TOptional<_$typebox.TObject<{
-    /**
-     * Secret store backend.
-     */
-    store: _$typebox.TUnsafe<"github">;
-    /**
-     * Pattern for resolving environment names in the store.
-     * Placeholders: {project}, {env}.
-     *
-     * @default "{project}-{env}"
-     */
-    environmentPattern: _$typebox.TOptional<_$typebox.TString>;
-  }>>;
-  /**
-   * Named environments with their adapter and configuration.
-   */
-  environments: _$typebox.TRecord<"^.*$", _$typebox.TObject<{
-    adapter: _$typebox.TUnsafe<"cloudflare" | "vercel">;
-    /**
-     * Custom domain for the deployed worker (e.g. "api.example.com").
-     *
-     * On Cloudflare this is attached as a custom-domain route.
-     * Omit to use the adapter's default `*.workers.dev` / preview URL.
-     *
-     * Wildcards are supported for multi-tenant SaaS apps:
-     * `"*.club.alepha.dev"` routes every subdomain to the worker.
-     * Wildcard patterns require `zone` to be set, and the wildcard DNS
-     * record must already exist (proxied) in the Cloudflare zone.
-     */
-    domain: _$typebox.TOptional<_$typebox.TString>;
-    /**
-     * Cloudflare zone name (e.g. "alepha.dev") that owns `domain`.
-     *
-     * Required when `domain` contains a wildcard (`*`). Ignored for
-     * plain custom domains, which Cloudflare resolves automatically.
-     */
-    zone: _$typebox.TOptional<_$typebox.TString>;
-    /**
-     * Cloudflare data jurisdiction for R2 buckets and D1 databases.
-     * - "eu": data stays within the EU
-     * - "fedramp": FedRAMP-authorized regions
-     *
-     * Omit for the default (global) jurisdiction.
-     */
-    jurisdiction: _$typebox.TOptional<_$typebox.TUnsafe<"eu" | "fedramp">>;
-    /**
-     * Cloudflare account ID to deploy into.
-     *
-     * Falls back to `CLOUDFLARE_ACCOUNT_ID` env var, then to the
-     * token's account when the token is scoped to exactly one.
-     * Required when the token has access to multiple accounts.
-     */
-    accountId: _$typebox.TOptional<_$typebox.TString>;
-  }>>;
-}>>, "alepha.cli.platform.options">;
-/**
- * Type for platform options.
- */
-type PlatformOptions = Static<typeof platformOptions.schema>;
-/**
- * Configuration for a single named environment.
- */
-interface EnvironmentConfig {
-  adapter: "cloudflare" | "vercel";
-  domain?: string;
-  zone?: string;
-  vars?: Record<string, string>;
-  jurisdiction?: "eu" | "fedramp";
-  accountId?: string;
-}
-//#endregion
-//#region ../../src/cli/platform/providers/PlatformCacheProvider.d.ts
-interface PlatformCache {
-  [adapter: string]: {
-    lastLoginCheck: number;
-    accountId?: string;
-  };
-}
-/**
- * Caches cloud provider login state to avoid slow auth checks.
- *
- * Stored in node_modules/.alepha/platform.json (gitignored, project-scoped).
- * TTL: 4 hours.
- */
-declare class PlatformCacheProvider {
-  protected static readonly TTL_MS: number;
-  protected readonly fs: FileSystemProvider;
-  protected readonly dateTime: DateTimeProvider;
-  protected cachePath(root: string): string;
-  isLoginFresh(root: string, adapter: string): Promise<boolean>;
-  getAccountId(root: string, adapter: string): Promise<string | undefined>;
-  recordLogin(root: string, adapter: string, accountId?: string): Promise<void>;
-  protected readCache(root: string): Promise<PlatformCache>;
-  protected writeCache(root: string, cache: PlatformCache): Promise<void>;
-}
-//#endregion
-//#region ../../src/cli/platform/schemas/cloudflare.d.ts
-declare const cloudflareAccountSchema: _$typebox.TObject<{
-  id: _$typebox.TString;
-  name: _$typebox.TString;
-}>;
-type CloudflareAccount = Static<typeof cloudflareAccountSchema>;
-declare const cloudflareD1Schema: _$typebox.TObject<{
-  uuid: _$typebox.TString;
-  name: _$typebox.TString;
-}>;
-type CloudflareD1 = Static<typeof cloudflareD1Schema>;
-declare const cloudflareKVSchema: _$typebox.TObject<{
-  id: _$typebox.TString;
-  title: _$typebox.TString;
-}>;
-type CloudflareKV = Static<typeof cloudflareKVSchema>;
-declare const cloudflareR2Schema: _$typebox.TObject<{
-  name: _$typebox.TString;
-  creation_date: _$typebox.TOptional<_$typebox.TString>;
-}>;
-type CloudflareR2 = Static<typeof cloudflareR2Schema>;
-declare const cloudflareR2ListSchema: _$typebox.TObject<{
-  buckets: _$typebox.TArray<_$typebox.TObject<{
-    name: _$typebox.TString;
-    creation_date: _$typebox.TOptional<_$typebox.TString>;
-  }>>;
-}>;
-declare const cloudflareQueueSchema: _$typebox.TObject<{
-  queue_id: _$typebox.TString;
-  queue_name: _$typebox.TString;
-}>;
-type CloudflareQueue = Static<typeof cloudflareQueueSchema>;
-declare const cloudflareQueueConsumerSchema: _$typebox.TObject<{
-  consumer_id: _$typebox.TString;
-  service: _$typebox.TString;
-  environment: _$typebox.TOptional<_$typebox.TString>;
-}>;
-type CloudflareQueueConsumer = Static<typeof cloudflareQueueConsumerSchema>;
-declare const cloudflareHyperdriveOriginSchema: _$typebox.TObject<{
-  host: _$typebox.TString;
-}>;
-declare const cloudflareHyperdriveSchema: _$typebox.TObject<{
-  id: _$typebox.TString;
-  name: _$typebox.TString;
-  origin: _$typebox.TObject<{
-    host: _$typebox.TString;
-  }>;
-}>;
-type CloudflareHyperdrive = Static<typeof cloudflareHyperdriveSchema>;
-declare const cloudflareWorkerSchema: _$typebox.TObject<{
-  id: _$typebox.TString;
-  created_on: _$typebox.TString;
-  modified_on: _$typebox.TString;
-}>;
-type CloudflareWorker = Static<typeof cloudflareWorkerSchema>;
-declare const cloudflareDeploymentVersionSchema: _$typebox.TObject<{
-  version_id: _$typebox.TString;
-  percentage: _$typebox.TNumber;
-}>;
-declare const cloudflareDeploymentSchema: _$typebox.TObject<{
-  id: _$typebox.TString;
-  versions: _$typebox.TArray<_$typebox.TObject<{
-    version_id: _$typebox.TString;
-    percentage: _$typebox.TNumber;
-  }>>;
-  created_on: _$typebox.TString;
-}>;
-type CloudflareDeployment = Static<typeof cloudflareDeploymentSchema>;
-declare const cloudflareDeploymentListSchema: _$typebox.TObject<{
-  deployments: _$typebox.TArray<_$typebox.TObject<{
-    id: _$typebox.TString;
-    versions: _$typebox.TArray<_$typebox.TObject<{
-      version_id: _$typebox.TString;
-      percentage: _$typebox.TNumber;
-    }>>;
-    created_on: _$typebox.TString;
-  }>>;
-}>;
-declare const cloudflareVersionSchema: _$typebox.TObject<{
-  id: _$typebox.TString;
-  metadata: _$typebox.TObject<{
-    created_on: _$typebox.TString;
-  }>;
-  annotations: _$typebox.TOptional<_$typebox.TRecord<"^.*$", _$typebox.TString>>;
-}>;
-type CloudflareVersion = Static<typeof cloudflareVersionSchema>;
-declare const cloudflareVersionListSchema: _$typebox.TObject<{
-  items: _$typebox.TArray<_$typebox.TObject<{
-    id: _$typebox.TString;
-    metadata: _$typebox.TObject<{
-      created_on: _$typebox.TString;
-    }>;
-    annotations: _$typebox.TOptional<_$typebox.TRecord<"^.*$", _$typebox.TString>>;
-  }>>;
-}>;
-declare const cloudflareSecretSchema: _$typebox.TObject<{
-  name: _$typebox.TString;
-  type: _$typebox.TString;
-}>;
-type CloudflareSecret = Static<typeof cloudflareSecretSchema>;
-declare const createD1BodySchema: _$typebox.TObject<{
-  name: _$typebox.TString;
-  primary_location_hint: _$typebox.TOptional<_$typebox.TString>;
-  jurisdiction: _$typebox.TOptional<_$typebox.TString>;
-}>;
-declare const createKVBodySchema: _$typebox.TObject<{
-  title: _$typebox.TString;
-}>;
-declare const createR2BodySchema: _$typebox.TObject<{
-  name: _$typebox.TString;
-}>;
-declare const cloudflareR2TokenSchema: _$typebox.TObject<{
-  id: _$typebox.TString;
-  accessKeyId: _$typebox.TString;
-  secretAccessKey: _$typebox.TString;
-}>;
-type CloudflareR2Token = Static<typeof cloudflareR2TokenSchema>;
-declare const createR2TokenBodySchema: _$typebox.TObject<{
-  name: _$typebox.TString;
-  policies: _$typebox.TArray<_$typebox.TObject<{
-    effect: _$typebox.TString;
-    permissions: _$typebox.TArray<_$typebox.TString>;
-    buckets: _$typebox.TOptional<_$typebox.TArray<_$typebox.TString>>;
-  }>>;
-}>;
-declare const createQueueBodySchema: _$typebox.TObject<{
-  queue_name: _$typebox.TString;
-}>;
-declare const createHyperdriveOriginSchema: _$typebox.TObject<{
-  scheme: _$typebox.TString;
-  host: _$typebox.TString;
-  port: _$typebox.TNumber;
-  database: _$typebox.TString;
-  user: _$typebox.TString;
-  password: _$typebox.TString;
-}>;
-declare const createHyperdriveBodySchema: _$typebox.TObject<{
-  name: _$typebox.TString;
-  origin: _$typebox.TObject<{
-    scheme: _$typebox.TString;
-    host: _$typebox.TString;
-    port: _$typebox.TNumber;
-    database: _$typebox.TString;
-    user: _$typebox.TString;
-    password: _$typebox.TString;
-  }>;
-}>;
-declare const putSecretBodySchema: _$typebox.TObject<{
-  name: _$typebox.TString;
-  text: _$typebox.TString;
-  type: _$typebox.TString;
-}>;
-declare const cloudflareApiErrorSchema: _$typebox.TObject<{
-  code: _$typebox.TNumber;
-  message: _$typebox.TString;
-}>;
-type CloudflareApiError = Static<typeof cloudflareApiErrorSchema>;
-//#endregion
-//#region ../../src/cli/platform/services/WranglerApi.d.ts
-/**
- * Wraps wrangler CLI commands that are kept as shell-outs.
- *
- * Only used for operations where wrangler provides value
- * beyond a raw API call: OAuth login, worker deploy (bundling/upload),
- * D1 migrations, and secret bulk push.
- */
-declare class WranglerApi {
-  protected readonly log: _$alepha_logger0.Logger;
-  protected readonly shell: ShellProvider;
-  protected readonly utils: AlephaCliUtils;
-  protected readonly pm: PackageManagerUtils;
-  protected readonly runner: Runner;
-  protected runShell(command: string, options?: Parameters<ShellProvider["run"]>[1]): Promise<string>;
-  /**
-   * Ensure wrangler is installed in the project.
-   */
-  ensureInstalled(root: string, run: RunnerMethod): Promise<void>;
-  /**
-   * Check if the user is authenticated. Returns the whoami output.
-   */
-  whoami(): Promise<string>;
-  /**
-   * Open the browser-based OAuth login flow.
-   */
-  login(): Promise<void>;
-  /**
-   * Get the current auth token from wrangler (auto-refreshes if expired).
-   */
-  getAuthToken(): Promise<string>;
-  /**
-   * Deploy a worker via wrangler (handles bundling and upload).
-   *
-   * Returns the workers.dev URL if found in the output.
-   */
-  deploy(workerName: string, configPath: string): Promise<string | undefined>;
-  /**
-   * Apply D1 migrations remotely.
-   */
-  d1MigrationsApply(dbName: string, configPath: string): Promise<void>;
-}
-//#endregion
-//#region ../../src/cli/platform/services/CloudflareApi.d.ts
-/**
- * Thin wrapper over the Cloudflare REST API.
- *
- * Uses `wrangler auth token` to obtain credentials,
- * then calls `fetch()` directly for all CRUD operations.
- */
-declare class CloudflareApi {
-  protected static readonly BASE = "https://api.cloudflare.com/client/v4";
-  protected readonly log: _$alepha_logger0.Logger;
-  protected readonly alepha: Alepha;
-  protected readonly wrangler: WranglerApi;
-  protected token?: string;
-  protected accountId?: string;
-  protected jurisdiction?: "eu" | "fedramp";
-  /**
-   * Set the Cloudflare data jurisdiction for R2 and D1 resources.
-   *
-   * R2 buckets and D1 databases created under a jurisdiction live in a
-   * separate namespace — every R2 API call (list/create/delete) must include
-   * the `cf-r2-jurisdiction` header, and D1 create must include the field
-   * in the request body. Omit / pass `undefined` for the default (global).
-   */
-  setJurisdiction(jurisdiction?: "eu" | "fedramp"): void;
-  /**
-   * Override the Cloudflare account ID (from platform config).
-   *
-   * When unset, `resolveAccountId` falls back to `CLOUDFLARE_ACCOUNT_ID` env
-   * var or the token's single account.
-   */
-  setAccountId(accountId?: string): void;
-  /**
-   * Obtain the current auth token from wrangler.
-   */
-  resolveToken(): Promise<string>;
-  /**
-   * Resolve the Cloudflare account ID.
-   *
-   * Calls /accounts and picks the first one. Cached after first call.
-   */
-  resolveAccountId(): Promise<string>;
-  listD1(): Promise<CloudflareD1[]>;
-  createD1(name: string, location?: string): Promise<CloudflareD1>;
-  deleteD1(databaseId: string): Promise<void>;
-  listKV(): Promise<CloudflareKV[]>;
-  createKV(title: string): Promise<CloudflareKV>;
-  deleteKV(namespaceId: string): Promise<void>;
-  listR2(): Promise<CloudflareR2[]>;
-  createR2(name: string): Promise<void>;
-  deleteR2(name: string): Promise<void>;
-  /**
-   * Mint a bucket-scoped R2 API token (S3 access key + secret) using the
-   * current bearer token. Used by teardown to wipe a bucket over the S3
-   * protocol without requiring users to pre-create R2 access keys.
-   *
-   * The returned token should be revoked with `deleteR2Token` as soon as the
-   * wipe is done.
-   */
-  createR2Token(name: string, bucket: string): Promise<CloudflareR2Token>;
-  deleteR2Token(tokenId: string): Promise<void>;
-  listQueues(): Promise<CloudflareQueue[]>;
-  createQueue(name: string): Promise<CloudflareQueue>;
-  deleteQueue(queueId: string): Promise<void>;
-  listQueueConsumers(queueId: string): Promise<CloudflareQueueConsumer[]>;
-  deleteQueueConsumer(queueId: string, consumerService: string): Promise<void>;
-  listHyperdrive(): Promise<CloudflareHyperdrive[]>;
-  createHyperdrive(name: string, connectionString: string): Promise<CloudflareHyperdrive>;
-  deleteHyperdrive(configId: string): Promise<void>;
-  getWorker(scriptName: string): Promise<CloudflareWorker | undefined>;
-  deleteWorker(scriptName: string): Promise<void>;
-  listDeployments(scriptName: string): Promise<CloudflareDeployment[]>;
-  listVersions(scriptName: string): Promise<CloudflareVersion[]>;
-  listSecrets(scriptName: string): Promise<CloudflareSecret[]>;
-  putSecret(scriptName: string, name: string, value: string): Promise<void>;
-  /**
-   * Fetch the current worker bindings via the script-settings endpoint.
-   * Used to merge new secrets into the existing binding set in one PATCH
-   * (avoids the per-secret `putSecret` calls, each of which creates a
-   * Cloudflare deployment — pushing 7 secrets meant 7 deployment rows).
-   *
-   * Secret bindings come back with `name` + `type` but no `text` (they're
-   * write-only on Cloudflare's side); to preserve them across a PATCH we
-   * forward each one as `{ type, name }` and Cloudflare keeps the stored
-   * value.
-   */
-  getWorkerSettings(scriptName: string): Promise<{
-    bindings: Array<{
-      type: string;
-      name: string;
-      text?: string;
-    }>;
-  }>;
-  /**
-   * Replace the worker's binding set in one call (= one Cloudflare
-   * deployment, regardless of how many secrets are being updated).
-   *
-   * The endpoint expects multipart FormData with a `settings` field whose
-   * value is a JSON-encoded `{ bindings: [...] }` — the `fetch` helper
-   * above is JSON-only, so this one bypasses it and calls `globalThis.fetch`
-   * directly. Mirrors what `wrangler secret bulk` does internally.
-   */
-  patchWorkerBindings(scriptName: string, bindings: Array<{
-    type: string;
-    name: string;
-    text?: string;
-  }>): Promise<void>;
-  protected fetch<T = unknown>(path: string, options?: {
-    method?: string;
-    body?: unknown;
-    bodySchema?: TSchema;
-    schema?: TSchema;
-    query?: Record<string, string>;
-  }): Promise<T>;
-  /**
-   * Paginate a page-based list endpoint (`result_info.total_pages`).
-   *
-   * Cloudflare defaults to `per_page=20`; we push it to 1000 (max on most
-   * list endpoints) and loop if more pages exist. Each page is validated
-   * against the item schema.
-   */
-  protected paginate<T>(path: string, itemSchema: TSchema, perPage?: number): Promise<T[]>;
-  /**
-   * Paginate a cursor-based list endpoint where `result` is an object
-   * containing both the items array and a `cursor` field (R2 buckets,
-   * Workers versions). Returns the flattened item array.
-   */
-  protected paginateCursor<T>(path: string, itemsKey: string, itemSchema: TSchema, perPage?: number): Promise<T[]>;
-  /**
-   * Parse a postgres:// connection string into Hyperdrive origin fields.
-   */
-  protected parseConnectionString(connectionString: string): {
-    scheme: string;
-    host: string;
-    port: number;
-    database: string;
-    user: string;
-    password: string;
-  };
-}
-//#endregion
-//#region ../../src/cli/platform/services/NamingService.d.ts
-/**
- * Generates deterministic resource names for cloud deployments.
- *
- * Pattern: `<project>-<env>`.
- *
- * All segments are slugified (lowercase, alphanumeric + dashes, max 63
- * chars). One app per workspace — see `alepha platform`.
- */
-declare class NamingService {
-  forContext(project: string, env: string): NamingContext;
-  slugify(name: string): string;
-}
-declare class NamingContext {
-  protected readonly prefix: string;
-  constructor(prefix: string);
-  worker(): string;
-  d1(): string;
-  hyperdrive(): string;
-  r2(): string;
-  kv(): string;
-  queue(): string;
-}
-//#endregion
-//#region ../../src/cli/platform/adapters/PlatformAdapter.d.ts
-interface DetectedResources {
-  hasDatabase: boolean;
-  hasBucket: boolean;
-  hasKV: boolean;
-  hasQueue: boolean;
-  hasCron: boolean;
-}
-interface AppDefinition {
-  /**
-   * Slugified app name (from package.json).
-   */
-  name: string;
-  /**
-   * Relative path from root (e.g., "apps/api").
-   * Empty string for standalone apps.
-   */
-  path: string;
-  /**
-   * Resolved entry points for this app.
-   */
-  entry: AppEntry;
-  /**
-   * Cloud resources detected by introspecting the app.
-   */
-  resources: DetectedResources;
-}
-interface PlatformContext {
-  /**
-   * Slugified project name (from root package.json or config).
-   */
-  project: string;
-  /**
-   * Environment key (e.g., "production", "staging", "tmp-bug001").
-   */
-  env: string;
-  /**
-   * Environment configuration from alepha.config.ts.
-   */
-  envConfig: EnvironmentConfig;
-  /**
-   * All apps in the project.
-   */
-  apps: AppDefinition[];
-  /**
-   * Monorepo/project root path.
-   */
-  root: string;
-  /**
-   * Resource name generator bound to this project+env.
-   */
-  naming: NamingContext;
-  /**
-   * Pre-built mode. When true, the adapter's `build()` should skip the
-   * Vite bundle steps and only regenerate the deploy config
-   * (wrangler.jsonc, Dockerfile, etc.) so it reflects current bindings +
-   * per-tenant overrides.
-   */
-  prebuilt?: boolean;
-}
-interface AppContext extends PlatformContext {
-  /**
-   * The specific app being operated on.
-   */
-  app: AppDefinition;
-}
-interface ResourceState {
-  name: string;
-  exists: boolean;
-  id?: string;
-  detail?: string;
-}
-interface WorkerState extends ResourceState {
-  version?: string;
-  tag?: string;
-  createdAt?: string;
-}
-interface SecretState {
-  name: string;
-  deployed: boolean;
-}
-interface PlatformState {
-  workers: WorkerState[];
-  databases: ResourceState[];
-  buckets: ResourceState[];
-  kvNamespaces: ResourceState[];
-  queues: ResourceState[];
-  secrets: SecretState[];
-}
-/**
- * Abstract platform adapter.
- *
- * Each cloud provider (Cloudflare, AKS, docker-compose) implements this.
- * The PlatformOrchestrator calls these methods in the correct order.
- */
-declare abstract class PlatformAdapter {
-  /**
-   * Ensure the user is authenticated with the cloud provider.
-   * May use cached credentials to avoid slow checks.
-   */
-  abstract authenticate(ctx: PlatformContext, run: RunnerMethod): Promise<void>;
-  /**
-   * Build artifacts for a single app.
-   */
-  abstract build(ctx: AppContext, run: RunnerMethod): Promise<void>;
-  /**
-   * Deploy a single app (upload + activate atomically, e.g., wrangler deploy).
-   * Returns the live URL if the platform provides one.
-   */
-  abstract deploy(ctx: AppContext, run: RunnerMethod): Promise<string | undefined>;
-  /**
-   * Create/ensure cloud resources exist (DB, buckets, queues).
-   * Not all adapters provision -- AKS defers to Helm.
-   */
-  provision(_ctx: PlatformContext, _run: RunnerMethod): Promise<void>;
-  /**
-   * Run database migrations.
-   */
-  migrate(_ctx: PlatformContext, _run: RunnerMethod): Promise<void>;
-  /**
-   * Push runtime secrets to the deployed worker(s).
-   *
-   * Reads secrets from `.env.{env}` files (parsed, not from process.env),
-   * filters out vars already handled by bindings (DATABASE_URL, R2, etc.),
-   * and pushes the rest via the platform's secret management.
-   */
-  secrets(_ctx: PlatformContext, _run: RunnerMethod): Promise<void>;
-  /**
-   * Detect existing resources and their state.
-   * Used by `plan` and `status` commands.
-   */
-  abstract inspect(ctx: PlatformContext, run: RunnerMethod): Promise<PlatformState>;
-  /**
-   * Tear down all resources for an environment.
-   */
-  abstract teardown(ctx: PlatformContext, run: RunnerMethod): Promise<void>;
-}
-//#endregion
-//#region ../../src/cli/platform/adapters/CloudflareAdapter.d.ts
-/**
- * Cloudflare Workers adapter.
- *
- * Uses the Cloudflare REST API (via CloudflareApi) for resource provisioning
- * and teardown, and wrangler CLI (via WranglerApi) for login, deploy,
- * D1 migrations, and secret bulk push.
- */
-declare class CloudflareAdapter extends PlatformAdapter {
-  protected readonly log: _$alepha_logger0.Logger;
-  protected readonly fs: FileSystemProvider;
-  protected readonly shell: ShellProvider;
-  protected readonly cache: PlatformCacheProvider;
-  protected readonly alepha: Alepha;
-  protected readonly envUtils: EnvUtils;
-  protected readonly api: CloudflareApi;
-  protected readonly wrangler: WranglerApi;
-  protected readonly runner: Runner;
-  protected provisionedD1Id?: string;
-  protected provisionedHyperdriveId?: string;
-  protected provisionedKVIds: Map<string, string>;
-  /**
-   * Check if the user's DATABASE_URL points to an external Postgres database.
-   * If so, we use Hyperdrive instead of D1.
-   *
-   * Reads from `.env.{env}` first, falls back to `process.env`.
-   */
-  protected isPostgres(ctx: PlatformContext): Promise<boolean>;
-  /**
-   * Propagate the environment's data-jurisdiction setting to the API client.
-   *
-   * Must be invoked at the top of every entry point (authenticate, build,
-   * deploy, secrets, provision, migrate, inspect, teardown) because
-   * CloudflareApi is a singleton reused across env invocations.
-   */
-  protected configureApi(ctx: PlatformContext): void;
-  protected runShell(command: string, options?: Parameters<ShellProvider["run"]>[1]): Promise<string>;
-  authenticate(ctx: PlatformContext, run: RunnerMethod): Promise<void>;
-  build(ctx: AppContext, run: RunnerMethod): Promise<void>;
-  deploy(ctx: AppContext, run: RunnerMethod): Promise<string | undefined>;
-  /**
-   * Vars that are handled by wrangler bindings or build config.
-   * These should not be pushed as secrets.
-   */
-  static readonly EXCLUDED_SECRET_KEYS: Set<string>;
-  secrets(ctx: PlatformContext, run: RunnerMethod): Promise<void>;
-  /**
-   * Plain-text binding used to fingerprint the deployed secret set so the
-   * next `up` can skip the PATCH when nothing has changed.
-   */
-  static readonly SECRETS_HASH_BINDING = "ALEPHA_SECRETS_HASH";
-  provision(ctx: PlatformContext, run: RunnerMethod): Promise<void>;
-  migrate(ctx: PlatformContext, run: RunnerMethod): Promise<void>;
-  protected migrateD1(ctx: PlatformContext, run: RunnerMethod): Promise<void>;
-  protected migratePostgres(ctx: PlatformContext, run: RunnerMethod): Promise<void>;
-  inspect(ctx: PlatformContext, run: RunnerMethod): Promise<PlatformState>;
-  teardown(ctx: PlatformContext, run: RunnerMethod): Promise<void>;
-  protected ensureD1(name: string): Promise<string>;
-  protected ensureHyperdrive(name: string, connectionString: string): Promise<string>;
-  protected ensureR2(name: string): Promise<void>;
-  /**
-   * Empty an R2 bucket via the S3-compatible API.
-   *
-   * Cloudflare's REST `DELETE /r2/buckets/:name` rejects non-empty buckets
-   * with `BucketNotEmpty`, and the REST API has no object-level endpoints —
-   * objects must be listed and deleted over the S3 protocol. To avoid
-   * making users pre-create R2 access keys, we mint a short-lived
-   * bucket-scoped API token using the wrangler bearer token, wipe the
-   * bucket with `s3mini`, then revoke the token.
-   *
-   * Also aborts any pending multipart uploads — those count as bucket
-   * contents from R2's perspective and would otherwise block the delete.
-   */
-  protected wipeR2Bucket(bucketName: string, ctx: PlatformContext): Promise<void>;
-  protected ensureKV(name: string): Promise<string>;
-  protected ensureQueue(name: string): Promise<void>;
-  /**
-   * Get the currently active deployment for a worker.
-   */
-  protected getActiveDeployment(workerName: string): Promise<{
-    versionId: string;
-    tag?: string;
-    createdAt?: string;
-  } | undefined>;
-}
-//#endregion
-//#region ../../src/cli/platform/schemas/vercel.d.ts
-declare const vercelProjectSchema: _$typebox.TObject<{
-  id: _$typebox.TString;
-  name: _$typebox.TString;
-  accountId: _$typebox.TString;
-}>;
-type VercelProject = Static<typeof vercelProjectSchema>;
-declare const createProjectBodySchema: _$typebox.TObject<{
-  name: _$typebox.TString;
-  framework: _$typebox.TOptional<_$typebox.TNull>;
-}>;
-declare const vercelDeploymentSchema: _$typebox.TObject<{
-  uid: _$typebox.TString;
-  name: _$typebox.TString;
-  url: _$typebox.TString;
-  state: _$typebox.TOptional<_$typebox.TString>;
-  readyState: _$typebox.TOptional<_$typebox.TString>;
-  created: _$typebox.TOptional<_$typebox.TNumber>;
-  target: _$typebox.TOptional<_$typebox.TString>;
-  alias: _$typebox.TOptional<_$typebox.TArray<_$typebox.TString>>;
-}>;
-type VercelDeployment = Static<typeof vercelDeploymentSchema>;
-declare const vercelEnvVarSchema: _$typebox.TObject<{
-  id: _$typebox.TString;
-  key: _$typebox.TString;
-  value: _$typebox.TOptional<_$typebox.TString>;
-  type: _$typebox.TString;
-  target: _$typebox.TArray<_$typebox.TString>;
-}>;
-type VercelEnvVar = Static<typeof vercelEnvVarSchema>;
-declare const createEnvVarBodySchema: _$typebox.TObject<{
-  key: _$typebox.TString;
-  value: _$typebox.TString;
-  type: _$typebox.TString;
-  target: _$typebox.TArray<_$typebox.TString>;
-}>;
-//#endregion
-//#region ../../src/cli/platform/services/VercelCli.d.ts
-/**
- * Wraps Vercel CLI commands and token management.
- *
- * Used for operations where the Vercel CLI provides value:
- * OAuth login, prebuilt deploy, and auth token extraction.
- */
-declare class VercelCli {
-  protected readonly log: _$alepha_logger0.Logger;
-  protected readonly shell: ShellProvider;
-  protected readonly fs: FileSystemProvider;
-  protected readonly utils: AlephaCliUtils;
-  protected readonly pm: PackageManagerUtils;
-  protected readonly runner: Runner;
-  protected runShell(command: string, options?: Parameters<ShellProvider["run"]>[1]): Promise<string>;
-  /**
-   * Ensure vercel CLI is installed in the project.
-   */
-  ensureInstalled(root: string, run: RunnerMethod): Promise<void>;
-  /**
-   * Get the Vercel auth token.
-   *
-   * Priority:
-   * 1. VERCEL_TOKEN environment variable (CI/CD)
-   * 2. Vercel CLI auth.json file (local dev)
-   */
-  getAuthToken(): Promise<string>;
-  /**
-   * Validate the current auth token.
-   */
-  whoami(): Promise<string>;
-  /**
-   * Open the browser-based login flow.
-   */
-  login(): Promise<void>;
-  /**
-   * Deploy a prebuilt .vercel/output/ directory.
-   *
-   * Returns the deployment URL.
-   */
-  deploy(distDir: string, options: {
-    prod?: boolean;
-    token?: string;
-  }): Promise<string | undefined>;
-  /**
-   * Resolve the path to Vercel CLI auth.json.
-   */
-  protected getAuthFilePath(): string;
-}
-//#endregion
-//#region ../../src/cli/platform/services/VercelApi.d.ts
-/**
- * Thin wrapper over the Vercel REST API.
- *
- * Uses the auth token from VercelCli for all requests.
- */
-declare class VercelApi {
-  protected static readonly BASE = "https://api.vercel.com";
-  protected readonly log: _$alepha_logger0.Logger;
-  protected readonly alepha: Alepha;
-  protected readonly vercelCli: VercelCli;
-  protected token?: string;
-  /**
-   * Obtain the current auth token from the Vercel CLI.
-   */
-  resolveToken(): Promise<string>;
-  listProjects(): Promise<VercelProject[]>;
-  getProject(nameOrId: string): Promise<VercelProject | undefined>;
-  createProject(name: string): Promise<VercelProject>;
-  updateProject(nameOrId: string, settings: {
-    framework?: null;
-  }): Promise<void>;
-  deleteProject(nameOrId: string): Promise<void>;
-  listDeployments(projectId: string, options?: {
-    limit?: number;
-    target?: string;
-  }): Promise<VercelDeployment[]>;
-  listEnvVars(projectId: string): Promise<VercelEnvVar[]>;
-  upsertEnvVars(projectId: string, vars: Array<{
-    key: string;
-    value: string;
-    target: string[];
-  }>): Promise<void>;
-  deleteEnvVar(projectId: string, envVarId: string): Promise<void>;
-  protected fetch<T = unknown>(path: string, options?: {
-    method?: string;
-    body?: unknown;
-    bodySchema?: TSchema;
-    schema?: TSchema;
-    query?: Record<string, string>;
-  }): Promise<T>;
-}
-//#endregion
-//#region ../../src/cli/platform/adapters/VercelAdapter.d.ts
-/**
- * Vercel platform adapter.
- *
- * Uses the Vercel CLI for login and deploy (--prebuilt),
- * and the Vercel REST API for project management, env vars, and inspection.
- *
- * v1 scope: deploy pipeline only. No DB/storage/KV provisioning.
- */
-declare class VercelAdapter extends PlatformAdapter {
-  protected readonly log: _$alepha_logger0.Logger;
-  protected readonly fs: FileSystemProvider;
-  protected readonly shell: ShellProvider;
-  protected readonly utils: AlephaCliUtils;
-  protected readonly cache: PlatformCacheProvider;
-  protected readonly alepha: Alepha;
-  protected readonly envUtils: EnvUtils;
-  protected readonly api: VercelApi;
-  protected readonly vercelCli: VercelCli;
-  protected readonly runner: Runner;
-  /**
-   * Vars that should not be pushed as env vars.
-   * These are either handled by the build or are internal.
-   */
-  static readonly EXCLUDED_SECRET_KEYS: Set<string>;
-  protected runShell(command: string, options?: Parameters<ShellProvider["run"]>[1]): Promise<string>;
-  authenticate(ctx: PlatformContext, run: RunnerMethod): Promise<void>;
-  build(ctx: AppContext, run: RunnerMethod): Promise<void>;
-  deploy(ctx: AppContext, run: RunnerMethod): Promise<string | undefined>;
-  secrets(ctx: PlatformContext, run: RunnerMethod): Promise<void>;
-  inspect(ctx: PlatformContext, run: RunnerMethod): Promise<PlatformState>;
-  teardown(ctx: PlatformContext, run: RunnerMethod): Promise<void>;
-}
-//#endregion
-//#region ../../src/cli/platform/services/PlatformInspector.d.ts
-interface ResolvedPlatformConfig {
-  project: string;
-  defaultEnv: string;
-  environments: Record<string, EnvironmentConfig>;
-}
-/**
- * Reads platform config and resolves project topology.
- *
- * Validates project name and environment configuration. Does NOT
- * introspect app code for resources — that happens at deploy time via
- * ViteBuildProvider.
- *
- * Each app self-declares its platform topology via its own
- * `alepha.config.ts`. Run `alepha platform <op>` from the app's
- * directory; no monorepo-root orchestration here.
- */
-declare class PlatformInspector {
-  protected readonly log: _$alepha_logger0.Logger;
-  protected readonly alepha: Alepha;
-  protected readonly fs: FileSystemProvider;
-  protected readonly asker: Asker;
-  protected readonly options: Readonly<{
-    name?: string | undefined;
-    default?: string | undefined;
-    secrets?: {
-      environmentPattern?: string | undefined;
-      store: "github";
-    } | undefined;
-    environments: Record<string, {
-      domain?: string | undefined;
-      zone?: string | undefined;
-      jurisdiction?: "eu" | "fedramp" | undefined;
-      accountId?: string | undefined;
-      adapter: "cloudflare" | "vercel";
-    }>;
-  }>;
-  protected readonly naming: NamingService;
-  /**
-   * Resolve and validate the full platform configuration.
-   */
-  resolveConfig(root: string): Promise<ResolvedPlatformConfig>;
-  /**
-   * Resolve a specific environment, validating it exists.
-   */
-  resolveEnvironment(root: string, envName: string): Promise<EnvironmentConfig>;
-  protected resolveProjectName(root: string, configName?: string): Promise<string>;
-}
-//#endregion
-//#region ../../src/cli/platform/services/PlatformOrchestrator.d.ts
-/**
- * Orchestrates platform lifecycle operations.
- *
- * Coordinates adapter calls in the correct order for
- * up (build -> migrate -> deploy), down, plan, and status.
- */
-declare class PlatformOrchestrator {
-  protected readonly log: _$alepha_logger0.Logger;
-  protected readonly color: ConsoleColorProvider;
-  protected readonly inspector: PlatformInspector;
-  protected readonly naming: NamingService;
-  protected readonly cloudflareAdapter: CloudflareAdapter;
-  protected readonly vercelAdapter: VercelAdapter;
-  protected readonly alepha: Alepha;
-  resolveAdapter(adapterName: string): PlatformAdapter;
-  up(options: {
-    root: string;
-    env: string;
-    apps: AppDefinition[];
-    run: RunnerMethod;
-    /**
-     * Pre-built mode — the artifact's `dist/` is already produced.
-     *
-     * Still runs auth → provision → build → migrate → deploy → secrets,
-     * but the `build` step shells out to `alepha build --prebuilt` which
-     * only regenerates the target-specific deploy config (e.g.
-     * `wrangler.jsonc`) and skips the Vite client + server builds.
-     * Used by external orchestrators (Rocket) that ship a pre-built
-     * `dist/` and just need the wrangler config refreshed for
-     * per-tenant overrides on every deploy.
-     */
-    prebuilt?: boolean;
-  }): Promise<{
-    urls: string[];
-    domain?: string;
-  }>;
-  /**
-   * Pretty-print the `up()` result to stdout. Matches the formatting the
-   * orchestrator used to emit inline; split out so callers that want
-   * JSON output can skip this branch.
-   */
-  printUpSummary(result: {
-    urls: string[];
-    domain?: string;
-  }): void;
-  down(options: {
-    root: string;
-    env: string;
-    apps: AppDefinition[];
-    run: RunnerMethod;
-    confirm: (prompt: string) => Promise<string>;
-  }): Promise<boolean>;
-  plan(options: {
-    root: string;
-    env: string;
-    apps: AppDefinition[];
-  }): Promise<{
-    config: ResolvedPlatformConfig;
-    naming: NamingContext;
-    apps: AppDefinition[];
-  }>;
-  status(options: {
-    root: string;
-    env: string;
-    apps: AppDefinition[];
-    run: RunnerMethod;
-  }): Promise<{
-    config: ResolvedPlatformConfig;
-    state: PlatformState;
-  }>;
-  isTmpEnv(env: string): boolean;
-}
-//#endregion
-//#region ../../src/cli/platform/providers/SecretStoreProvider.d.ts
-/**
- * A secret stored in a remote secret store.
- */
-interface RemoteSecret {
-  name: string;
-  updatedAt?: string;
-}
-/**
- * Abstract provider for managing secrets in an external store.
- *
- * Implementations: GitHubSecretStore, MemorySecretStore
- */
-declare abstract class SecretStoreProvider {
-  /**
-   * Verify the backing store is reachable and authenticated.
-   */
-  abstract ensureAvailable(): Promise<void>;
-  /**
-   * Ensure the target environment exists in the store, creating it if needed.
-   */
-  abstract ensureEnvironment(environment: string): Promise<void>;
-  /**
-   * List all secrets in a given environment.
-   */
-  abstract list(environment: string): Promise<RemoteSecret[]>;
-  /**
-   * Set (create or update) a secret in a given environment.
-   */
-  abstract set(environment: string, key: string, value: string): Promise<void>;
-  /**
-   * Delete a secret from a given environment.
-   */
-  abstract delete(environment: string, key: string): Promise<void>;
-}
-//#endregion
-//#region ../../src/cli/platform/providers/GitHubSecretStore.d.ts
-/**
- * GitHub Actions secret store backed by the `gh` CLI.
- *
- * Requires the GitHub CLI (`gh`) to be installed and authenticated.
- * Pushes secrets into GitHub Actions environments.
- */
-declare class GitHubSecretStore implements SecretStoreProvider {
-  protected readonly log: _$alepha_logger0.Logger;
-  protected readonly shell: ShellProvider;
-  protected readonly fs: FileSystemProvider;
-  /**
-   * Verify that `gh` is installed and authenticated.
-   */
-  ensureAvailable(): Promise<void>;
-  /**
-   * Create the GitHub Actions environment if it doesn't exist.
-   */
-  ensureEnvironment(environment: string): Promise<void>;
-  /**
-   * List all secrets in a GitHub Actions environment.
-   */
-  list(environment: string): Promise<RemoteSecret[]>;
-  /**
-   * Set a secret in a GitHub Actions environment.
-   *
-   * Writes a dotenv-formatted file and uses `gh secret set --env-file` to
-   * avoid shell pipe issues with NodeShellProvider escaping the `|` character.
-   */
-  set(environment: string, key: string, value: string): Promise<void>;
-  /**
-   * Delete a secret from a GitHub Actions environment.
-   */
-  delete(environment: string, key: string): Promise<void>;
-}
-//#endregion
-//#region ../../src/cli/platform/services/SecretFilterService.d.ts
-/**
- * Filters environment variables for secret store syncing.
- *
- * Excludes platform-managed vars (NODE_ENV), build-time vars (VITE_*),
- * and empty values. Keeps everything else — including DATABASE_URL
- * and POSTGRES_SCHEMA which GitHub Actions needs.
- *
- * Also handles renaming GITHUB_* keys since GitHub Actions rejects
- * secret names starting with GITHUB_.
- */
-declare class SecretFilterService {
-  protected static readonly EXCLUDED_KEYS: Set<string>;
-  protected static readonly GITHUB_PREFIX = "GITHUB_";
-  protected static readonly REMOTE_PREFIX = "APP_GITHUB_";
-  /**
-   * Return only the entries that should be pushed to a secret store.
-   */
-  filter(envVars: Record<string, string>): Record<string, string>;
-  /**
-   * Convert a local env key to a remote secret name.
-   *
-   * GITHUB_* keys are prefixed with APP_ since GitHub Actions rejects
-   * secret names starting with GITHUB_.
-   */
-  toRemoteName(key: string): string;
-  /**
-   * Convert a remote secret name back to the local env key.
-   */
-  toLocalName(remoteName: string): string;
-}
-//#endregion
 //#region ../../src/cli/platform/commands/SecretsCommand.d.ts
 declare class SecretsCommand {
-  protected readonly log: _$alepha_logger0.Logger;
+  protected readonly log: import("alepha/logger").Logger;
   protected readonly options: Readonly<{
     name?: string | undefined;
     default?: string | undefined;
+    tenancy?: "required" | "none" | "optional" | undefined;
     secrets?: {
+      keys?: string[] | undefined;
+      store?: "github" | undefined;
       environmentPattern?: string | undefined;
-      store: "github";
     } | undefined;
     environments: Record<string, {
       domain?: string | undefined;
@@ -1131,34 +29,36 @@ declare class SecretsCommand {
   protected readonly githubStore: GitHubSecretStore;
   protected readonly filter: SecretFilterService;
   protected readonly color: ConsoleColorProvider;
-  protected readonly envFlags: _$typebox.TObject<{
-    env: _$typebox.TOptional<_$typebox.TString>;
+  protected readonly envFlags: import("typebox").TObject<{
+    env: import("typebox").TOptional<import("typebox").TString>;
   }>;
-  protected readonly list: _$alepha_command0.CommandPrimitive<_$typebox.TObject<{
-    env: _$typebox.TOptional<_$typebox.TString>;
-    format: _$typebox.TOptional<_$typebox.TString>;
-  }>, _$typebox.TSchema, _$typebox.TObject<_$typebox.TProperties>>;
-  protected readonly diff: _$alepha_command0.CommandPrimitive<_$typebox.TObject<{
-    env: _$typebox.TOptional<_$typebox.TString>;
-  }>, _$typebox.TSchema, _$typebox.TObject<_$typebox.TProperties>>;
-  protected readonly apply: _$alepha_command0.CommandPrimitive<_$typebox.TObject<{
-    env: _$typebox.TOptional<_$typebox.TString>;
-    "dry-run": _$typebox.TOptional<_$typebox.TBoolean>;
-  }>, _$typebox.TSchema, _$typebox.TObject<_$typebox.TProperties>>;
-  readonly secrets: _$alepha_command0.CommandPrimitive<_$typebox.TObject<_$typebox.TProperties>, _$typebox.TSchema, _$typebox.TObject<_$typebox.TProperties>>;
+  protected readonly list: import("alepha/command").CommandPrimitive<import("typebox").TObject<{
+    env: import("typebox").TOptional<import("typebox").TString>;
+    format: import("typebox").TOptional<import("typebox").TString>;
+  }>, import("typebox").TSchema, import("typebox").TObject<import("typebox").TProperties>>;
+  protected readonly diff: import("alepha/command").CommandPrimitive<import("typebox").TObject<{
+    env: import("typebox").TOptional<import("typebox").TString>;
+  }>, import("typebox").TSchema, import("typebox").TObject<import("typebox").TProperties>>;
+  protected readonly apply: import("alepha/command").CommandPrimitive<import("typebox").TObject<{
+    env: import("typebox").TOptional<import("typebox").TString>;
+    "dry-run": import("typebox").TOptional<import("typebox").TBoolean>;
+  }>, import("typebox").TSchema, import("typebox").TObject<import("typebox").TProperties>>;
+  readonly secrets: import("alepha/command").CommandPrimitive<import("typebox").TObject<import("typebox").TProperties>, import("typebox").TSchema, import("typebox").TObject<import("typebox").TProperties>>;
   resolveStore(): SecretStoreProvider;
   protected resolveEnvironmentName(project: string, env: string): string;
 }
 //#endregion
 //#region ../../src/cli/platform/commands/platform.d.ts
 declare class PlatformCommand {
-  protected readonly log: _$alepha_logger0.Logger;
+  protected readonly log: import("alepha/logger").Logger;
   protected readonly options: Readonly<{
     name?: string | undefined;
     default?: string | undefined;
+    tenancy?: "required" | "none" | "optional" | undefined;
     secrets?: {
+      keys?: string[] | undefined;
+      store?: "github" | undefined;
       environmentPattern?: string | undefined;
-      store: "github";
     } | undefined;
     environments: Record<string, {
       domain?: string | undefined;
@@ -1179,49 +79,71 @@ declare class PlatformCommand {
   /**
    * Common flags for env targeting.
    */
-  protected readonly envFlags: _$typebox.TObject<{
-    env: _$typebox.TOptional<_$typebox.TString>;
-    verbose: _$typebox.TOptional<_$typebox.TBoolean>;
-    json: _$typebox.TOptional<_$typebox.TBoolean>;
+  protected readonly envFlags: import("typebox").TObject<{
+    env: import("typebox").TOptional<import("typebox").TString>;
+    tenant: import("typebox").TOptional<import("typebox").TString>;
+    verbose: import("typebox").TOptional<import("typebox").TBoolean>;
+    json: import("typebox").TOptional<import("typebox").TBoolean>;
   }>;
-  protected readonly plan: _$alepha_command0.CommandPrimitive<_$typebox.TObject<{
-    env: _$typebox.TOptional<_$typebox.TString>;
-    verbose: _$typebox.TOptional<_$typebox.TBoolean>;
-    json: _$typebox.TOptional<_$typebox.TBoolean>;
-  }>, _$typebox.TSchema, _$typebox.TObject<_$typebox.TProperties>>;
-  protected readonly up: _$alepha_command0.CommandPrimitive<_$typebox.TObject<{
-    prebuilt: _$typebox.TOptional<_$typebox.TBoolean>;
-    env: _$typebox.TOptional<_$typebox.TString>;
-    verbose: _$typebox.TOptional<_$typebox.TBoolean>;
-    json: _$typebox.TOptional<_$typebox.TBoolean>;
-  }>, _$typebox.TSchema, _$typebox.TObject<_$typebox.TProperties>>;
-  protected readonly down: _$alepha_command0.CommandPrimitive<_$typebox.TObject<{
-    yes: _$typebox.TOptional<_$typebox.TBoolean>;
-    env: _$typebox.TOptional<_$typebox.TString>;
-    verbose: _$typebox.TOptional<_$typebox.TBoolean>;
-    json: _$typebox.TOptional<_$typebox.TBoolean>;
-  }>, _$typebox.TSchema, _$typebox.TObject<_$typebox.TProperties>>;
-  protected readonly status: _$alepha_command0.CommandPrimitive<_$typebox.TObject<{
-    env: _$typebox.TOptional<_$typebox.TString>;
-    verbose: _$typebox.TOptional<_$typebox.TBoolean>;
-    json: _$typebox.TOptional<_$typebox.TBoolean>;
-  }>, _$typebox.TSchema, _$typebox.TObject<_$typebox.TProperties>>;
-  protected readonly build: _$alepha_command0.CommandPrimitive<_$typebox.TObject<{
-    env: _$typebox.TOptional<_$typebox.TString>;
-    verbose: _$typebox.TOptional<_$typebox.TBoolean>;
-    json: _$typebox.TOptional<_$typebox.TBoolean>;
-  }>, _$typebox.TSchema, _$typebox.TObject<_$typebox.TProperties>>;
-  protected readonly deploy: _$alepha_command0.CommandPrimitive<_$typebox.TObject<{
-    env: _$typebox.TOptional<_$typebox.TString>;
-    verbose: _$typebox.TOptional<_$typebox.TBoolean>;
-    json: _$typebox.TOptional<_$typebox.TBoolean>;
-  }>, _$typebox.TSchema, _$typebox.TObject<_$typebox.TProperties>>;
-  protected readonly migrate: _$alepha_command0.CommandPrimitive<_$typebox.TObject<{
-    env: _$typebox.TOptional<_$typebox.TString>;
-    verbose: _$typebox.TOptional<_$typebox.TBoolean>;
-    json: _$typebox.TOptional<_$typebox.TBoolean>;
-  }>, _$typebox.TSchema, _$typebox.TObject<_$typebox.TProperties>>;
-  readonly platform: _$alepha_command0.CommandPrimitive<_$typebox.TObject<_$typebox.TProperties>, _$typebox.TSchema, _$typebox.TObject<_$typebox.TProperties>>;
+  protected readonly plan: import("alepha/command").CommandPrimitive<import("typebox").TObject<{
+    env: import("typebox").TOptional<import("typebox").TString>;
+    tenant: import("typebox").TOptional<import("typebox").TString>;
+    verbose: import("typebox").TOptional<import("typebox").TBoolean>;
+    json: import("typebox").TOptional<import("typebox").TBoolean>;
+  }>, import("typebox").TSchema, import("typebox").TObject<import("typebox").TProperties>>;
+  protected readonly up: import("alepha/command").CommandPrimitive<import("typebox").TObject<{
+    prebuilt: import("typebox").TOptional<import("typebox").TBoolean>;
+    env: import("typebox").TOptional<import("typebox").TString>;
+    tenant: import("typebox").TOptional<import("typebox").TString>;
+    verbose: import("typebox").TOptional<import("typebox").TBoolean>;
+    json: import("typebox").TOptional<import("typebox").TBoolean>;
+  }>, import("typebox").TSchema, import("typebox").TObject<import("typebox").TProperties>>;
+  protected readonly down: import("alepha/command").CommandPrimitive<import("typebox").TObject<{
+    yes: import("typebox").TOptional<import("typebox").TBoolean>;
+    env: import("typebox").TOptional<import("typebox").TString>;
+    tenant: import("typebox").TOptional<import("typebox").TString>;
+    verbose: import("typebox").TOptional<import("typebox").TBoolean>;
+    json: import("typebox").TOptional<import("typebox").TBoolean>;
+  }>, import("typebox").TSchema, import("typebox").TObject<import("typebox").TProperties>>;
+  protected readonly status: import("alepha/command").CommandPrimitive<import("typebox").TObject<{
+    env: import("typebox").TOptional<import("typebox").TString>;
+    tenant: import("typebox").TOptional<import("typebox").TString>;
+    verbose: import("typebox").TOptional<import("typebox").TBoolean>;
+    json: import("typebox").TOptional<import("typebox").TBoolean>;
+  }>, import("typebox").TSchema, import("typebox").TObject<import("typebox").TProperties>>;
+  protected readonly build: import("alepha/command").CommandPrimitive<import("typebox").TObject<{
+    env: import("typebox").TOptional<import("typebox").TString>;
+    tenant: import("typebox").TOptional<import("typebox").TString>;
+    verbose: import("typebox").TOptional<import("typebox").TBoolean>;
+    json: import("typebox").TOptional<import("typebox").TBoolean>;
+  }>, import("typebox").TSchema, import("typebox").TObject<import("typebox").TProperties>>;
+  protected readonly deploy: import("alepha/command").CommandPrimitive<import("typebox").TObject<{
+    env: import("typebox").TOptional<import("typebox").TString>;
+    tenant: import("typebox").TOptional<import("typebox").TString>;
+    verbose: import("typebox").TOptional<import("typebox").TBoolean>;
+    json: import("typebox").TOptional<import("typebox").TBoolean>;
+  }>, import("typebox").TSchema, import("typebox").TObject<import("typebox").TProperties>>;
+  protected readonly migrate: import("alepha/command").CommandPrimitive<import("typebox").TObject<{
+    env: import("typebox").TOptional<import("typebox").TString>;
+    tenant: import("typebox").TOptional<import("typebox").TString>;
+    verbose: import("typebox").TOptional<import("typebox").TBoolean>;
+    json: import("typebox").TOptional<import("typebox").TBoolean>;
+  }>, import("typebox").TSchema, import("typebox").TObject<import("typebox").TProperties>>;
+  protected readonly dbExport: import("alepha/command").CommandPrimitive<import("typebox").TObject<{
+    output: import("typebox").TOptional<import("typebox").TString>;
+    keepSql: import("typebox").TOptional<import("typebox").TBoolean>;
+    env: import("typebox").TOptional<import("typebox").TString>;
+    tenant: import("typebox").TOptional<import("typebox").TString>;
+    verbose: import("typebox").TOptional<import("typebox").TBoolean>;
+    json: import("typebox").TOptional<import("typebox").TBoolean>;
+  }>, import("typebox").TSchema, import("typebox").TObject<import("typebox").TProperties>>;
+  /**
+   * `db` subgroup — operations against the *deployed* database (export,
+   * migrate). They live under `platform` (not core `alepha db`) because
+   * they need the env config, tenancy, adapter, and resource naming.
+   */
+  protected readonly db: import("alepha/command").CommandPrimitive<import("typebox").TObject<import("typebox").TProperties>, import("typebox").TSchema, import("typebox").TObject<import("typebox").TProperties>>;
+  readonly platform: import("alepha/command").CommandPrimitive<import("typebox").TObject<import("typebox").TProperties>, import("typebox").TSchema, import("typebox").TObject<import("typebox").TProperties>>;
   /**
    * Resolve app definitions.
    *
@@ -1232,186 +154,47 @@ declare class PlatformCommand {
    * ViteBuildProvider.init() per app. This is expensive -- only done
    * for up/down/status, not for plan.
    */
-  protected resolveApps(root: string, config: ResolvedPlatformConfig, isServerless: boolean): Promise<AppDefinition[]>;
-  protected isServerless(adapter: string): boolean;
-  protected detectResources(alepha: any): DetectedResources;
-}
-//#endregion
-//#region ../../src/cli/platform/providers/MemorySecretStore.d.ts
-interface MemorySecretStoreCall {
-  method: "ensureAvailable" | "ensureEnvironment" | "list" | "set" | "delete";
-  environment?: string;
-  key?: string;
-  value?: string;
-}
-/**
- * In-memory implementation of SecretStoreProvider for testing.
- * Records all operations and stores secrets in a nested Map.
- */
-declare class MemorySecretStore implements SecretStoreProvider {
-  /**
-   * Secrets keyed by environment, then by key.
-   */
-  secrets: Map<string, Map<string, string>>;
-  /**
-   * All recorded operations.
-   */
-  calls: MemorySecretStoreCall[];
-  /**
-   * When set, ensureAvailable() will throw with this message.
-   */
-  availableError: string | null;
-  ensureAvailable(): Promise<void>;
-  ensureEnvironment(environment: string): Promise<void>;
-  list(environment: string): Promise<RemoteSecret[]>;
-  set(environment: string, key: string, value: string): Promise<void>;
-  delete(environment: string, key: string): Promise<void>;
-  /**
-   * Check if set() was called for a given environment and key.
-   */
-  wasSet(environment: string, key: string): boolean;
-  /**
-   * Check if delete() was called for a given environment and key.
-   */
-  wasDeleted(environment: string, key: string): boolean;
+  protected resolveApp(root: string, _config: ResolvedPlatformConfig, isServerless: boolean, options?: {
+    prebuilt?: boolean;
+  }): Promise<{
+    entry: AppEntry;
+    resources: DetectedResources;
+  }>;
   /**
-   * Get all set() calls for a given environment.
+   * @deprecated single-app projects; use `resolveApp` directly.
+   * Kept temporarily so existing commands can be migrated one at a time.
    */
-  getSetCalls(environment: string): Array<{
-    key: string;
-    value: string;
-  }>;
+  protected resolveApps(root: string, config: ResolvedPlatformConfig, isServerless: boolean, options?: {
+    prebuilt?: boolean;
+  }): Promise<Array<{
+    name: string;
+    path: string;
+    entry: AppEntry;
+    resources: DetectedResources;
+  }>>;
+  protected isServerless(adapter: string): boolean;
   /**
-   * Reset all state.
+   * Read `dist/manifest.json` if present. Returns `null` when the file
+   * doesn't exist or isn't parseable — caller falls back to the
+   * Vite-introspection path.
    */
-  reset(): void;
+  protected readManifest(root: string): Promise<{
+    version: number;
+    project: string;
+    resources: DetectedResources;
+  } | null>;
+  protected detectResources(alepha: any): DetectedResources;
 }
 //#endregion
-//#region ../../src/cli/platform/schemas/platform.d.ts
-declare const platformStatusWorkerSchema: _$typebox.TObject<{
-  name: _$typebox.TString;
-  exists: _$typebox.TBoolean;
-  id: _$typebox.TOptional<_$typebox.TString>;
-  detail: _$typebox.TOptional<_$typebox.TString>;
-  version: _$typebox.TOptional<_$typebox.TString>;
-  tag: _$typebox.TOptional<_$typebox.TString>;
-  createdAt: _$typebox.TOptional<_$typebox.TString>;
-}>;
-declare const platformStatusResourceSchema: _$typebox.TObject<{
-  name: _$typebox.TString;
-  exists: _$typebox.TBoolean;
-  id: _$typebox.TOptional<_$typebox.TString>;
-  detail: _$typebox.TOptional<_$typebox.TString>;
-}>;
-declare const platformStatusSecretSchema: _$typebox.TObject<{
-  name: _$typebox.TString;
-  deployed: _$typebox.TBoolean;
-}>;
-declare const platformStatusSchema: _$typebox.TObject<{
-  project: _$typebox.TString;
-  env: _$typebox.TString;
-  adapter: _$typebox.TString;
-  workers: _$typebox.TArray<_$typebox.TObject<{
-    name: _$typebox.TString;
-    exists: _$typebox.TBoolean;
-    id: _$typebox.TOptional<_$typebox.TString>;
-    detail: _$typebox.TOptional<_$typebox.TString>;
-    version: _$typebox.TOptional<_$typebox.TString>;
-    tag: _$typebox.TOptional<_$typebox.TString>;
-    createdAt: _$typebox.TOptional<_$typebox.TString>;
-  }>>;
-  databases: _$typebox.TArray<_$typebox.TObject<{
-    name: _$typebox.TString;
-    exists: _$typebox.TBoolean;
-    id: _$typebox.TOptional<_$typebox.TString>;
-    detail: _$typebox.TOptional<_$typebox.TString>;
-  }>>;
-  buckets: _$typebox.TArray<_$typebox.TObject<{
-    name: _$typebox.TString;
-    exists: _$typebox.TBoolean;
-    id: _$typebox.TOptional<_$typebox.TString>;
-    detail: _$typebox.TOptional<_$typebox.TString>;
-  }>>;
-  kvNamespaces: _$typebox.TArray<_$typebox.TObject<{
-    name: _$typebox.TString;
-    exists: _$typebox.TBoolean;
-    id: _$typebox.TOptional<_$typebox.TString>;
-    detail: _$typebox.TOptional<_$typebox.TString>;
-  }>>;
-  queues: _$typebox.TArray<_$typebox.TObject<{
-    name: _$typebox.TString;
-    exists: _$typebox.TBoolean;
-    id: _$typebox.TOptional<_$typebox.TString>;
-    detail: _$typebox.TOptional<_$typebox.TString>;
-  }>>;
-  secrets: _$typebox.TArray<_$typebox.TObject<{
-    name: _$typebox.TString;
-    deployed: _$typebox.TBoolean;
-  }>>;
-}>;
-type PlatformStatusOutput = Static<typeof platformStatusSchema>;
-declare const platformPlanAppResourcesSchema: _$typebox.TObject<{
-  hasDatabase: _$typebox.TBoolean;
-  hasBucket: _$typebox.TBoolean;
-  hasKV: _$typebox.TBoolean;
-  hasQueue: _$typebox.TBoolean;
-  hasCron: _$typebox.TBoolean;
-}>;
-declare const platformPlanAppSchema: _$typebox.TObject<{
-  name: _$typebox.TString;
-  path: _$typebox.TString;
-  resources: _$typebox.TObject<{
-    hasDatabase: _$typebox.TBoolean;
-    hasBucket: _$typebox.TBoolean;
-    hasKV: _$typebox.TBoolean;
-    hasQueue: _$typebox.TBoolean;
-    hasCron: _$typebox.TBoolean;
-  }>;
-}>;
-declare const platformPlanEnvironmentSchema: _$typebox.TObject<{
-  adapter: _$typebox.TString;
-  domain: _$typebox.TOptional<_$typebox.TString>;
-  zone: _$typebox.TOptional<_$typebox.TString>;
-}>;
-declare const platformPlanResourceSchema: _$typebox.TObject<{
-  label: _$typebox.TString;
-  value: _$typebox.TString;
-}>;
-declare const platformPlanSchema: _$typebox.TObject<{
-  project: _$typebox.TString;
-  env: _$typebox.TString;
-  mode: _$typebox.TUnsafe<"monorepo" | "standalone">;
-  apps: _$typebox.TArray<_$typebox.TObject<{
-    name: _$typebox.TString;
-    path: _$typebox.TString;
-    resources: _$typebox.TObject<{
-      hasDatabase: _$typebox.TBoolean;
-      hasBucket: _$typebox.TBoolean;
-      hasKV: _$typebox.TBoolean;
-      hasQueue: _$typebox.TBoolean;
-      hasCron: _$typebox.TBoolean;
-    }>;
-  }>>;
-  environments: _$typebox.TRecord<"^.*$", _$typebox.TObject<{
-    adapter: _$typebox.TString;
-    domain: _$typebox.TOptional<_$typebox.TString>;
-    zone: _$typebox.TOptional<_$typebox.TString>;
-  }>>;
-  resources: _$typebox.TArray<_$typebox.TObject<{
-    label: _$typebox.TString;
-    value: _$typebox.TString;
-  }>>;
-  secretCount: _$typebox.TNumber;
-}>;
-type PlatformPlanOutput = Static<typeof platformPlanSchema>;
-//#endregion
 //#region ../../src/cli/platform/index.d.ts
 /**
  * CLI plugin for multi-cloud deployment orchestration.
  *
- * Manages the full lifecycle of deploying Alepha apps: provision
- * resources, build, migrate databases, deploy, and sync secrets.
- * Supports Cloudflare Workers and Vercel.
+ * Wraps `AlephaPlatformLibPlugin` (the framework-agnostic deploy
+ * services) with `$command` instances so the orchestration is
+ * reachable from `alepha platform …`. Non-CLI consumers (e.g. Alepha
+ * Rocket) should depend on `alepha/cli/platform-lib` directly instead
+ * of pulling in this command surface.
  *
  * Commands:
  * - `alepha platform plan`    — show project topology and resource names
@@ -1419,9 +202,10 @@ type PlatformPlanOutput = Static<typeof platformPlanSchema>;
  * - `alepha platform down`    — teardown an environment
  * - `alepha platform status`  — inspect deployed resources
  * - `alepha platform build`   — build apps locally
- * - `alepha platform deploy`  — deploy to cloud
- * - `alepha platform migrate` — run database migrations
- * - `alepha platform secrets` — manage external secret stores
+ * - `alepha platform deploy`     — deploy to cloud
+ * - `alepha platform db migrate` — run database migrations
+ * - `alepha platform db export`  — pull the deployed DB into a local snapshot
+ * - `alepha platform secrets`    — manage external secret stores
  *
  * Configuration in `alepha.config.ts`:
  *
@@ -1439,8 +223,8 @@ type PlatformPlanOutput = Static<typeof platformPlanSchema>;
  * });
  * ```
  */
-declare const AlephaCliPlatformPlugin: _$alepha.Service<_$alepha.Module>;
+declare const AlephaCliPlatformPlugin: import("alepha").Service<import("alepha").Module>;
 declare const platform: (options: PlatformOptions) => () => void;
 //#endregion
-export { AlephaCliPlatformPlugin, AppContext, AppDefinition, CloudflareAccount, CloudflareAdapter, CloudflareApi, CloudflareApiError, type CloudflareD1, type CloudflareDeployment, type CloudflareHyperdrive, type CloudflareKV, type CloudflareQueue, type CloudflareQueueConsumer, type CloudflareR2, type CloudflareR2Token, type CloudflareSecret, type CloudflareVersion, type CloudflareWorker, DetectedResources, EnvironmentConfig, GitHubSecretStore, MemorySecretStore, MemorySecretStoreCall, NamingContext, NamingService, PlatformAdapter, PlatformCacheProvider, PlatformCommand, PlatformContext, PlatformInspector, PlatformOptions, PlatformOrchestrator, PlatformPlanOutput, PlatformState, PlatformStatusOutput, RemoteSecret, ResolvedPlatformConfig, ResourceState, SecretFilterService, SecretState, SecretStoreProvider, SecretsCommand, VercelAdapter, VercelApi, VercelCli, VercelDeployment, VercelEnvVar, VercelProject, WorkerState, WranglerApi, cloudflareAccountSchema, cloudflareApiErrorSchema, cloudflareD1Schema, cloudflareDeploymentListSchema, cloudflareDeploymentSchema, cloudflareDeploymentVersionSchema, cloudflareHyperdriveOriginSchema, cloudflareHyperdriveSchema, cloudflareKVSchema, cloudflareQueueConsumerSchema, cloudflareQueueSchema, cloudflareR2ListSchema, cloudflareR2Schema, cloudflareR2TokenSchema, cloudflareSecretSchema, cloudflareVersionListSchema, cloudflareVersionSchema, cloudflareWorkerSchema, createD1BodySchema, createEnvVarBodySchema, createHyperdriveBodySchema, createHyperdriveOriginSchema, createKVBodySchema, createProjectBodySchema, createQueueBodySchema, createR2BodySchema, createR2TokenBodySchema, platform, platformOptions, platformPlanAppResourcesSchema, platformPlanAppSchema, platformPlanEnvironmentSchema, platformPlanResourceSchema, platformPlanSchema, platformStatusResourceSchema, platformStatusSchema, platformStatusSecretSchema, platformStatusWorkerSchema, putSecretBodySchema, vercelDeploymentSchema, vercelEnvVarSchema, vercelProjectSchema };
+export { AlephaCliPlatformPlugin, PlatformCommand, SecretsCommand, platform };
 //# sourceMappingURL=index.d.ts.map