alepha 0.22.0 → 0.24.0

package/dist/cli/platform-lib/index.d.ts

@@ -4,7 +4,6 @@ import { Asker, EnvUtils, Runner, RunnerMethod } from "alepha/command";
 import { ConsoleColorProvider } from "alepha/logger";
 import { FileSystemProvider, ShellProvider } from "alepha/system";
 import { DateTimeProvider } from "alepha/datetime";
-
 //#region ../../src/cli/platform-lib/providers/PlatformCacheProvider.d.ts
 interface PlatformCache {
   [adapter: string]: {
@@ -31,161 +30,161 @@ declare class PlatformCacheProvider {
 }
 //#endregion
 //#region ../../src/cli/platform-lib/schemas/cloudflare.d.ts
-declare const cloudflareAccountSchema: import("typebox").TObject<{
-  id: import("typebox").TString;
-  name: import("typebox").TString;
-}>;
+declare const cloudflareAccountSchema: import("zod").ZodObject<{
+  id: import("zod").ZodString;
+  name: import("zod").ZodString;
+}, import("zod/v4/core").$strip>;
 type CloudflareAccount = Static<typeof cloudflareAccountSchema>;
-declare const cloudflareD1Schema: import("typebox").TObject<{
-  uuid: import("typebox").TString;
-  name: import("typebox").TString;
-}>;
+declare const cloudflareD1Schema: import("zod").ZodObject<{
+  uuid: import("zod").ZodString;
+  name: import("zod").ZodString;
+}, import("zod/v4/core").$strip>;
 type CloudflareD1 = Static<typeof cloudflareD1Schema>;
-declare const cloudflareKVSchema: import("typebox").TObject<{
-  id: import("typebox").TString;
-  title: import("typebox").TString;
-}>;
+declare const cloudflareKVSchema: import("zod").ZodObject<{
+  id: import("zod").ZodString;
+  title: import("zod").ZodString;
+}, import("zod/v4/core").$strip>;
 type CloudflareKV = Static<typeof cloudflareKVSchema>;
-declare const cloudflareR2Schema: import("typebox").TObject<{
-  name: import("typebox").TString;
-  creation_date: import("typebox").TOptional<import("typebox").TString>;
-}>;
+declare const cloudflareR2Schema: import("zod").ZodObject<{
+  name: import("zod").ZodString;
+  creation_date: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>;
 type CloudflareR2 = Static<typeof cloudflareR2Schema>;
-declare const cloudflareR2ListSchema: import("typebox").TObject<{
-  buckets: import("typebox").TArray<import("typebox").TObject<{
-    name: import("typebox").TString;
-    creation_date: import("typebox").TOptional<import("typebox").TString>;
-  }>>;
-}>;
-declare const cloudflareQueueSchema: import("typebox").TObject<{
-  queue_id: import("typebox").TString;
-  queue_name: import("typebox").TString;
-}>;
+declare const cloudflareR2ListSchema: import("zod").ZodObject<{
+  buckets: import("zod").ZodArray<import("zod").ZodObject<{
+    name: import("zod").ZodString;
+    creation_date: import("zod").ZodOptional<import("zod").ZodString>;
+  }, import("zod/v4/core").$strip>>;
+}, import("zod/v4/core").$strip>;
+declare const cloudflareQueueSchema: import("zod").ZodObject<{
+  queue_id: import("zod").ZodString;
+  queue_name: import("zod").ZodString;
+}, import("zod/v4/core").$strip>;
 type CloudflareQueue = Static<typeof cloudflareQueueSchema>;
-declare const cloudflareQueueConsumerSchema: import("typebox").TObject<{
-  consumer_id: import("typebox").TString;
-  service: import("typebox").TString;
-  environment: import("typebox").TOptional<import("typebox").TString>;
-}>;
+declare const cloudflareQueueConsumerSchema: import("zod").ZodObject<{
+  consumer_id: import("zod").ZodString;
+  service: import("zod").ZodString;
+  environment: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>;
 type CloudflareQueueConsumer = Static<typeof cloudflareQueueConsumerSchema>;
-declare const cloudflareHyperdriveOriginSchema: import("typebox").TObject<{
-  host: import("typebox").TString;
-}>;
-declare const cloudflareHyperdriveSchema: import("typebox").TObject<{
-  id: import("typebox").TString;
-  name: import("typebox").TString;
-  origin: import("typebox").TObject<{
-    host: import("typebox").TString;
-  }>;
-}>;
+declare const cloudflareHyperdriveOriginSchema: import("zod").ZodObject<{
+  host: import("zod").ZodString;
+}, import("zod/v4/core").$strip>;
+declare const cloudflareHyperdriveSchema: import("zod").ZodObject<{
+  id: import("zod").ZodString;
+  name: import("zod").ZodString;
+  origin: import("zod").ZodObject<{
+    host: import("zod").ZodString;
+  }, import("zod/v4/core").$strip>;
+}, import("zod/v4/core").$strip>;
 type CloudflareHyperdrive = Static<typeof cloudflareHyperdriveSchema>;
-declare const cloudflareWorkerSchema: import("typebox").TObject<{
-  id: import("typebox").TString;
-  created_on: import("typebox").TString;
-  modified_on: import("typebox").TString;
-}>;
+declare const cloudflareWorkerSchema: import("zod").ZodObject<{
+  id: import("zod").ZodString;
+  created_on: import("zod").ZodString;
+  modified_on: import("zod").ZodString;
+}, import("zod/v4/core").$strip>;
 type CloudflareWorker = Static<typeof cloudflareWorkerSchema>;
-declare const cloudflareDeploymentVersionSchema: import("typebox").TObject<{
-  version_id: import("typebox").TString;
-  percentage: import("typebox").TNumber;
-}>;
-declare const cloudflareDeploymentSchema: import("typebox").TObject<{
-  id: import("typebox").TString;
-  versions: import("typebox").TArray<import("typebox").TObject<{
-    version_id: import("typebox").TString;
-    percentage: import("typebox").TNumber;
-  }>>;
-  created_on: import("typebox").TString;
-}>;
+declare const cloudflareDeploymentVersionSchema: import("zod").ZodObject<{
+  version_id: import("zod").ZodString;
+  percentage: import("zod").ZodNumber;
+}, import("zod/v4/core").$strip>;
+declare const cloudflareDeploymentSchema: import("zod").ZodObject<{
+  id: import("zod").ZodString;
+  versions: import("zod").ZodArray<import("zod").ZodObject<{
+    version_id: import("zod").ZodString;
+    percentage: import("zod").ZodNumber;
+  }, import("zod/v4/core").$strip>>;
+  created_on: import("zod").ZodString;
+}, import("zod/v4/core").$strip>;
 type CloudflareDeployment = Static<typeof cloudflareDeploymentSchema>;
-declare const cloudflareDeploymentListSchema: import("typebox").TObject<{
-  deployments: import("typebox").TArray<import("typebox").TObject<{
-    id: import("typebox").TString;
-    versions: import("typebox").TArray<import("typebox").TObject<{
-      version_id: import("typebox").TString;
-      percentage: import("typebox").TNumber;
-    }>>;
-    created_on: import("typebox").TString;
-  }>>;
-}>;
-declare const cloudflareVersionSchema: import("typebox").TObject<{
-  id: import("typebox").TString;
-  metadata: import("typebox").TObject<{
-    created_on: import("typebox").TString;
-  }>;
-  annotations: import("typebox").TOptional<import("typebox").TRecord<"^.*$", import("typebox").TString>>;
-}>;
+declare const cloudflareDeploymentListSchema: import("zod").ZodObject<{
+  deployments: import("zod").ZodArray<import("zod").ZodObject<{
+    id: import("zod").ZodString;
+    versions: import("zod").ZodArray<import("zod").ZodObject<{
+      version_id: import("zod").ZodString;
+      percentage: import("zod").ZodNumber;
+    }, import("zod/v4/core").$strip>>;
+    created_on: import("zod").ZodString;
+  }, import("zod/v4/core").$strip>>;
+}, import("zod/v4/core").$strip>;
+declare const cloudflareVersionSchema: import("zod").ZodObject<{
+  id: import("zod").ZodString;
+  metadata: import("zod").ZodObject<{
+    created_on: import("zod").ZodString;
+  }, import("zod/v4/core").$strip>;
+  annotations: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodString>>;
+}, import("zod/v4/core").$strip>;
 type CloudflareVersion = Static<typeof cloudflareVersionSchema>;
-declare const cloudflareVersionListSchema: import("typebox").TObject<{
-  items: import("typebox").TArray<import("typebox").TObject<{
-    id: import("typebox").TString;
-    metadata: import("typebox").TObject<{
-      created_on: import("typebox").TString;
-    }>;
-    annotations: import("typebox").TOptional<import("typebox").TRecord<"^.*$", import("typebox").TString>>;
-  }>>;
-}>;
-declare const cloudflareSecretSchema: import("typebox").TObject<{
-  name: import("typebox").TString;
-  type: import("typebox").TString;
-}>;
+declare const cloudflareVersionListSchema: import("zod").ZodObject<{
+  items: import("zod").ZodArray<import("zod").ZodObject<{
+    id: import("zod").ZodString;
+    metadata: import("zod").ZodObject<{
+      created_on: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
+    annotations: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodString>>;
+  }, import("zod/v4/core").$strip>>;
+}, import("zod/v4/core").$strip>;
+declare const cloudflareSecretSchema: import("zod").ZodObject<{
+  name: import("zod").ZodString;
+  type: import("zod").ZodString;
+}, import("zod/v4/core").$strip>;
 type CloudflareSecret = Static<typeof cloudflareSecretSchema>;
-declare const createD1BodySchema: import("typebox").TObject<{
-  name: import("typebox").TString;
-  primary_location_hint: import("typebox").TOptional<import("typebox").TString>;
-  jurisdiction: import("typebox").TOptional<import("typebox").TString>;
-}>;
-declare const createKVBodySchema: import("typebox").TObject<{
-  title: import("typebox").TString;
-}>;
-declare const createR2BodySchema: import("typebox").TObject<{
-  name: import("typebox").TString;
-}>;
-declare const cloudflareR2TokenSchema: import("typebox").TObject<{
-  id: import("typebox").TString;
-  accessKeyId: import("typebox").TString;
-  secretAccessKey: import("typebox").TString;
-}>;
+declare const createD1BodySchema: import("zod").ZodObject<{
+  name: import("zod").ZodString;
+  primary_location_hint: import("zod").ZodOptional<import("zod").ZodString>;
+  jurisdiction: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>;
+declare const createKVBodySchema: import("zod").ZodObject<{
+  title: import("zod").ZodString;
+}, import("zod/v4/core").$strip>;
+declare const createR2BodySchema: import("zod").ZodObject<{
+  name: import("zod").ZodString;
+}, import("zod/v4/core").$strip>;
+declare const cloudflareR2TokenSchema: import("zod").ZodObject<{
+  id: import("zod").ZodString;
+  accessKeyId: import("zod").ZodString;
+  secretAccessKey: import("zod").ZodString;
+}, import("zod/v4/core").$strip>;
 type CloudflareR2Token = Static<typeof cloudflareR2TokenSchema>;
-declare const createR2TokenBodySchema: import("typebox").TObject<{
-  name: import("typebox").TString;
-  policies: import("typebox").TArray<import("typebox").TObject<{
-    effect: import("typebox").TString;
-    permissions: import("typebox").TArray<import("typebox").TString>;
-    buckets: import("typebox").TOptional<import("typebox").TArray<import("typebox").TString>>;
-  }>>;
-}>;
-declare const createQueueBodySchema: import("typebox").TObject<{
-  queue_name: import("typebox").TString;
-}>;
-declare const createHyperdriveOriginSchema: import("typebox").TObject<{
-  scheme: import("typebox").TString;
-  host: import("typebox").TString;
-  port: import("typebox").TNumber;
-  database: import("typebox").TString;
-  user: import("typebox").TString;
-  password: import("typebox").TString;
-}>;
-declare const createHyperdriveBodySchema: import("typebox").TObject<{
-  name: import("typebox").TString;
-  origin: import("typebox").TObject<{
-    scheme: import("typebox").TString;
-    host: import("typebox").TString;
-    port: import("typebox").TNumber;
-    database: import("typebox").TString;
-    user: import("typebox").TString;
-    password: import("typebox").TString;
-  }>;
-}>;
-declare const putSecretBodySchema: import("typebox").TObject<{
-  name: import("typebox").TString;
-  text: import("typebox").TString;
-  type: import("typebox").TString;
-}>;
-declare const cloudflareApiErrorSchema: import("typebox").TObject<{
-  code: import("typebox").TNumber;
-  message: import("typebox").TString;
-}>;
+declare const createR2TokenBodySchema: import("zod").ZodObject<{
+  name: import("zod").ZodString;
+  policies: import("zod").ZodArray<import("zod").ZodObject<{
+    effect: import("zod").ZodString;
+    permissions: import("zod").ZodArray<import("zod").ZodString>;
+    buckets: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+  }, import("zod/v4/core").$strip>>;
+}, import("zod/v4/core").$strip>;
+declare const createQueueBodySchema: import("zod").ZodObject<{
+  queue_name: import("zod").ZodString;
+}, import("zod/v4/core").$strip>;
+declare const createHyperdriveOriginSchema: import("zod").ZodObject<{
+  scheme: import("zod").ZodString;
+  host: import("zod").ZodString;
+  port: import("zod").ZodNumber;
+  database: import("zod").ZodString;
+  user: import("zod").ZodString;
+  password: import("zod").ZodString;
+}, import("zod/v4/core").$strip>;
+declare const createHyperdriveBodySchema: import("zod").ZodObject<{
+  name: import("zod").ZodString;
+  origin: import("zod").ZodObject<{
+    scheme: import("zod").ZodString;
+    host: import("zod").ZodString;
+    port: import("zod").ZodNumber;
+    database: import("zod").ZodString;
+    user: import("zod").ZodString;
+    password: import("zod").ZodString;
+  }, import("zod/v4/core").$strip>;
+}, import("zod/v4/core").$strip>;
+declare const putSecretBodySchema: import("zod").ZodObject<{
+  name: import("zod").ZodString;
+  text: import("zod").ZodString;
+  type: import("zod").ZodString;
+}, import("zod/v4/core").$strip>;
+declare const cloudflareApiErrorSchema: import("zod").ZodObject<{
+  code: import("zod").ZodNumber;
+  message: import("zod").ZodString;
+}, import("zod/v4/core").$strip>;
 type CloudflareApiError = Static<typeof cloudflareApiErrorSchema>;
 //#endregion
 //#region ../../src/cli/platform-lib/services/WranglerApi.d.ts
@@ -201,12 +200,11 @@ declare class WranglerApi {
   protected readonly shell: ShellProvider;
   protected readonly utils: AlephaCliUtils;
   protected readonly pm: PackageManagerUtils;
-  protected readonly runner: Runner;
   protected runShell(command: string, options?: Parameters<ShellProvider["run"]>[1]): Promise<string>;
   /**
    * Ensure wrangler is installed in the project.
    */
-  ensureInstalled(root: string, run: RunnerMethod): Promise<void>;
+  ensureInstalled(root: string): Promise<void>;
   /**
    * Check if the user is authenticated. Returns the whoami output.
    */
@@ -378,107 +376,39 @@ declare class CloudflareApi {
  * Filled from the `platform` section of `alepha.config.ts`.
  * Read by `PlatformCommand` to resolve environments and adapters.
  */
-declare const platformOptions: import("alepha").Atom<import("typebox").TOptional<import("typebox").TObject<{
-  /**
-   * Project name override. Defaults to root package.json "name".
-   */
-  name: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * Default environment when --env is omitted.
-   *
-   * @default "production"
-   */
-  default: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * Multi-tenancy mode — controls whether `--tenant <slug>` is
-   * accepted/required and how it shapes resource names + the domain.
-   *
-   * - `none` (default): single instance. `--tenant` is rejected.
-   * - `required`: every deploy needs `--tenant`; resources are named
-   *   `<tenant>-<project>-<env>` and the host becomes
-   *   `<tenant>.<domain>`. Omitting it errors.
-   * - `optional`: a base instance (no `--tenant`) plus per-tenant
-   *   instances coexist.
-   *
-   * @default "none"
-   */
-  tenancy: import("typebox").TOptional<import("typebox").TUnsafe<"required" | "none" | "optional">>;
-  /**
-   * Secret store configuration for syncing .env secrets
-   * to external providers (e.g. GitHub Actions environments).
-   */
-  secrets: import("typebox").TOptional<import("typebox").TObject<{
-    /**
-     * Explicit override of the worker secret-key allowlist.
-     *
-     * By default the deploy `secrets` step uses the build manifest's
-     * `env` list (every key the app declares via `$env`, captured at
-     * build time) as the allowlist, resolving each value from
-     * `.env.<env>[.local]` first, then `process.env`. This lets CI
-     * deliver secrets via the job environment (no `.env` file on the
-     * runner) while only ever pushing declared keys — ambient runner
-     * vars (PATH, GITHUB_*, …) can never leak.
-     *
-     * Set `keys` to override that auto-detected list (e.g. to narrow it,
-     * or to add a key read via `process.env` rather than `$env`). When
-     * neither this nor a manifest is present, the `.env.<env>` file is
-     * itself the allowlist (legacy fallback).
-     */
-    keys: import("typebox").TOptional<import("typebox").TArray<import("typebox").TString>>;
-    /**
-     * Secret store backend.
-     */
-    store: import("typebox").TOptional<import("typebox").TUnsafe<"github">>;
-    /**
-     * Pattern for resolving environment names in the store.
-     * Placeholders: {project}, {env}.
-     *
-     * @default "{project}-{env}"
-     */
-    environmentPattern: import("typebox").TOptional<import("typebox").TString>;
+declare const platformOptions: import("alepha").Atom<import("zod").ZodOptional<import("zod").ZodObject<{
+  name: import("zod").ZodOptional<import("zod").ZodString>;
+  default: import("zod").ZodOptional<import("zod").ZodString>;
+  tenancy: import("zod").ZodOptional<import("zod").ZodEnum<{
+    none: "none";
+    optional: "optional";
+    required: "required";
   }>>;
-  /**
-   * Named environments with their adapter and configuration.
-   */
-  environments: import("typebox").TRecord<"^.*$", import("typebox").TObject<{
-    adapter: import("typebox").TUnsafe<"cloudflare" | "vercel">;
-    /**
-     * Custom domain for the deployed worker (e.g. "api.example.com").
-     *
-     * On Cloudflare this is attached as a custom-domain route.
-     * Omit to use the adapter's default `*.workers.dev` / preview URL.
-     *
-     * Wildcards are supported for multi-tenant SaaS apps:
-     * `"*.club.alepha.dev"` routes every subdomain to the worker.
-     * Wildcard patterns require `zone` to be set, and the wildcard DNS
-     * record must already exist (proxied) in the Cloudflare zone.
-     */
-    domain: import("typebox").TOptional<import("typebox").TString>;
-    /**
-     * Cloudflare zone name (e.g. "alepha.dev") that owns `domain`.
-     *
-     * Required when `domain` contains a wildcard (`*`). Ignored for
-     * plain custom domains, which Cloudflare resolves automatically.
-     */
-    zone: import("typebox").TOptional<import("typebox").TString>;
-    /**
-     * Cloudflare data jurisdiction for R2 buckets and D1 databases.
-     * - "eu": data stays within the EU
-     * - "fedramp": FedRAMP-authorized regions
-     *
-     * Omit for the default (global) jurisdiction.
-     */
-    jurisdiction: import("typebox").TOptional<import("typebox").TUnsafe<"eu" | "fedramp">>;
-    /**
-     * Cloudflare account ID to deploy into.
-     *
-     * Falls back to `CLOUDFLARE_ACCOUNT_ID` env var, then to the
-     * token's account when the token is scoped to exactly one.
-     * Required when the token has access to multiple accounts.
-     */
-    accountId: import("typebox").TOptional<import("typebox").TString>;
-  }>>;
-}>>, "alepha.cli.platform.options">;
+  secrets: import("zod").ZodOptional<import("zod").ZodObject<{
+    keys: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+    store: import("zod").ZodOptional<import("zod").ZodEnum<{
+      github: "github";
+    }>>;
+    environmentPattern: import("zod").ZodOptional<import("zod").ZodString>;
+  }, import("zod/v4/core").$strip>>;
+  environments: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
+    adapter: import("zod").ZodEnum<{
+      cloudflare: "cloudflare";
+      vercel: "vercel";
+    }>;
+    domain: import("zod").ZodOptional<import("zod").ZodString>;
+    zone: import("zod").ZodOptional<import("zod").ZodString>;
+    services: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodObject<{
+      binding: import("zod").ZodString;
+      service: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>>>;
+    jurisdiction: import("zod").ZodOptional<import("zod").ZodEnum<{
+      eu: "eu";
+      fedramp: "fedramp";
+    }>>;
+    accountId: import("zod").ZodOptional<import("zod").ZodString>;
+  }, import("zod/v4/core").$strip>>;
+}, import("zod/v4/core").$strip>>, "alepha.cli.platform.options">;
 /**
  * Type for platform options.
  */
@@ -493,6 +423,10 @@ interface EnvironmentConfig {
   vars?: Record<string, string>;
   jurisdiction?: "eu" | "fedramp";
   accountId?: string;
+  services?: Array<{
+    binding: string;
+    service: string;
+  }>;
 }
 //#endregion
 //#region ../../src/cli/platform-lib/services/NamingService.d.ts
@@ -728,20 +662,24 @@ declare class CloudflareAdapter extends PlatformAdapter {
   protected readonly options: Readonly<{
     name?: string | undefined;
     default?: string | undefined;
-    tenancy?: "required" | "none" | "optional" | undefined;
+    tenancy?: "none" | "optional" | "required" | undefined;
     secrets?: {
       keys?: string[] | undefined;
       store?: "github" | undefined;
       environmentPattern?: string | undefined;
     } | undefined;
     environments: Record<string, {
+      adapter: "cloudflare" | "vercel";
       domain?: string | undefined;
       zone?: string | undefined;
+      services?: {
+        binding: string;
+        service: string;
+      }[] | undefined;
       jurisdiction?: "eu" | "fedramp" | undefined;
       accountId?: string | undefined;
-      adapter: "cloudflare" | "vercel";
     }>;
-  }>;
+  } | undefined>;
   protected provisionedD1Id?: string;
   protected provisionedHyperdriveId?: string;
   protected provisionedKVIds: Map<string, string>;
@@ -812,15 +750,41 @@ declare class CloudflareAdapter extends PlatformAdapter {
   protected ensureD1(name: string): Promise<string>;
   protected ensureHyperdrive(name: string, connectionString: string): Promise<string>;
   protected ensureR2(name: string): Promise<void>;
+  /** Whether a Cloudflare error message indicates the bucket is already gone. */
+  protected isMissingBucketError(msg: string): boolean;
+  /**
+   * Resolve S3 credentials for wiping an R2 bucket over the S3 protocol.
+   *
+   * Prefers the account's R2 S3 credentials from the environment
+   * (`S3_ACCESS_KEY_ID` / `S3_SECRET_ACCESS_KEY`) — these are already
+   * provisioned for the deploy (artifact registry) and are account-scoped,
+   * so they can empty any bucket without minting anything. Returns `null`
+   * when not configured, letting the caller fall back to token minting.
+   */
+  protected resolveR2Credentials(): {
+    accessKeyId: string;
+    secretAccessKey: string;
+  } | null;
+  /**
+   * Delete an R2 bucket, emptying it first only when necessary.
+   *
+   * Cloudflare's REST `DELETE /r2/buckets/:name` succeeds on an empty bucket
+   * but rejects a non-empty one. So we attempt the delete directly (the
+   * common teardown case — no objects, no creds needed), and only on failure
+   * empty the bucket over the S3 protocol and retry. A missing bucket is a
+   * no-op, so teardown is idempotent.
+   */
+  protected deleteR2Bucket(name: string, ctx: PlatformContext): Promise<void>;
   /**
    * Empty an R2 bucket via the S3-compatible API.
    *
-   * Cloudflare's REST `DELETE /r2/buckets/:name` rejects non-empty buckets
-   * with `BucketNotEmpty`, and the REST API has no object-level endpoints —
-   * objects must be listed and deleted over the S3 protocol. To avoid
-   * making users pre-create R2 access keys, we mint a short-lived
-   * bucket-scoped API token using the wrangler bearer token, wipe the
-   * bucket with `s3mini`, then revoke the token.
+   * Cloudflare's REST API has no object-level endpoints — objects must be
+   * listed and deleted over the S3 protocol. We use the account's R2 S3
+   * credentials (`S3_ACCESS_KEY_ID` / `S3_SECRET_ACCESS_KEY`) when present;
+   * otherwise we fall back to minting a short-lived bucket-scoped token via
+   * the CF API (requires a user-scoped `CLOUDFLARE_API_TOKEN`) and revoke it
+   * after. When neither is available the wipe is skipped with a warning —
+   * the caller still attempts the delete, which succeeds for empty buckets.
    *
    * Also aborts any pending multipart uploads — those count as bucket
    * contents from R2's perspective and would otherwise block the delete.
@@ -839,41 +803,41 @@ declare class CloudflareAdapter extends PlatformAdapter {
 }
 //#endregion
 //#region ../../src/cli/platform-lib/schemas/vercel.d.ts
-declare const vercelProjectSchema: import("typebox").TObject<{
-  id: import("typebox").TString;
-  name: import("typebox").TString;
-  accountId: import("typebox").TString;
-}>;
+declare const vercelProjectSchema: import("zod").ZodObject<{
+  id: import("zod").ZodString;
+  name: import("zod").ZodString;
+  accountId: import("zod").ZodString;
+}, import("zod/v4/core").$strip>;
 type VercelProject = Static<typeof vercelProjectSchema>;
-declare const createProjectBodySchema: import("typebox").TObject<{
-  name: import("typebox").TString;
-  framework: import("typebox").TOptional<import("typebox").TNull>;
-}>;
-declare const vercelDeploymentSchema: import("typebox").TObject<{
-  uid: import("typebox").TString;
-  name: import("typebox").TString;
-  url: import("typebox").TString;
-  state: import("typebox").TOptional<import("typebox").TString>;
-  readyState: import("typebox").TOptional<import("typebox").TString>;
-  created: import("typebox").TOptional<import("typebox").TNumber>;
-  target: import("typebox").TOptional<import("typebox").TString>;
-  alias: import("typebox").TOptional<import("typebox").TArray<import("typebox").TString>>;
-}>;
+declare const createProjectBodySchema: import("zod").ZodObject<{
+  name: import("zod").ZodString;
+  framework: import("zod").ZodOptional<import("zod").ZodNull>;
+}, import("zod/v4/core").$strip>;
+declare const vercelDeploymentSchema: import("zod").ZodObject<{
+  uid: import("zod").ZodString;
+  name: import("zod").ZodString;
+  url: import("zod").ZodString;
+  state: import("zod").ZodOptional<import("zod").ZodString>;
+  readyState: import("zod").ZodOptional<import("zod").ZodString>;
+  created: import("zod").ZodOptional<import("zod").ZodNumber>;
+  target: import("zod").ZodOptional<import("zod").ZodString>;
+  alias: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+}, import("zod/v4/core").$strip>;
 type VercelDeployment = Static<typeof vercelDeploymentSchema>;
-declare const vercelEnvVarSchema: import("typebox").TObject<{
-  id: import("typebox").TString;
-  key: import("typebox").TString;
-  value: import("typebox").TOptional<import("typebox").TString>;
-  type: import("typebox").TString;
-  target: import("typebox").TArray<import("typebox").TString>;
-}>;
+declare const vercelEnvVarSchema: import("zod").ZodObject<{
+  id: import("zod").ZodString;
+  key: import("zod").ZodString;
+  value: import("zod").ZodOptional<import("zod").ZodString>;
+  type: import("zod").ZodString;
+  target: import("zod").ZodArray<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>;
 type VercelEnvVar = Static<typeof vercelEnvVarSchema>;
-declare const createEnvVarBodySchema: import("typebox").TObject<{
-  key: import("typebox").TString;
-  value: import("typebox").TString;
-  type: import("typebox").TString;
-  target: import("typebox").TArray<import("typebox").TString>;
-}>;
+declare const createEnvVarBodySchema: import("zod").ZodObject<{
+  key: import("zod").ZodString;
+  value: import("zod").ZodString;
+  type: import("zod").ZodString;
+  target: import("zod").ZodArray<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>;
 //#endregion
 //#region ../../src/cli/platform-lib/services/VercelCli.d.ts
 /**
@@ -888,12 +852,11 @@ declare class VercelCli {
   protected readonly fs: FileSystemProvider;
   protected readonly utils: AlephaCliUtils;
   protected readonly pm: PackageManagerUtils;
-  protected readonly runner: Runner;
   protected runShell(command: string, options?: Parameters<ShellProvider["run"]>[1]): Promise<string>;
   /**
    * Ensure vercel CLI is installed in the project.
    */
-  ensureInstalled(root: string, run: RunnerMethod): Promise<void>;
+  ensureInstalled(root: string): Promise<void>;
   /**
    * Get the Vercel auth token.
    *
@@ -987,7 +950,6 @@ declare class VercelAdapter extends PlatformAdapter {
   protected readonly envUtils: EnvUtils;
   protected readonly api: VercelApi;
   protected readonly vercelCli: VercelCli;
-  protected readonly runner: Runner;
   /**
    * Vars that should not be pushed as env vars.
    * These are either handled by the build or are internal.
@@ -1125,121 +1087,124 @@ declare class MemorySecretStore implements SecretStoreProvider {
 }
 //#endregion
 //#region ../../src/cli/platform-lib/schemas/platform.d.ts
-declare const platformStatusWorkerSchema: import("typebox").TObject<{
-  name: import("typebox").TString;
-  exists: import("typebox").TBoolean;
-  id: import("typebox").TOptional<import("typebox").TString>;
-  detail: import("typebox").TOptional<import("typebox").TString>;
-  version: import("typebox").TOptional<import("typebox").TString>;
-  tag: import("typebox").TOptional<import("typebox").TString>;
-  createdAt: import("typebox").TOptional<import("typebox").TString>;
-}>;
-declare const platformStatusResourceSchema: import("typebox").TObject<{
-  name: import("typebox").TString;
-  exists: import("typebox").TBoolean;
-  id: import("typebox").TOptional<import("typebox").TString>;
-  detail: import("typebox").TOptional<import("typebox").TString>;
-}>;
-declare const platformStatusSecretSchema: import("typebox").TObject<{
-  name: import("typebox").TString;
-  deployed: import("typebox").TBoolean;
-}>;
-declare const platformStatusSchema: import("typebox").TObject<{
-  project: import("typebox").TString;
-  env: import("typebox").TString;
-  adapter: import("typebox").TString;
-  workers: import("typebox").TArray<import("typebox").TObject<{
-    name: import("typebox").TString;
-    exists: import("typebox").TBoolean;
-    id: import("typebox").TOptional<import("typebox").TString>;
-    detail: import("typebox").TOptional<import("typebox").TString>;
-    version: import("typebox").TOptional<import("typebox").TString>;
-    tag: import("typebox").TOptional<import("typebox").TString>;
-    createdAt: import("typebox").TOptional<import("typebox").TString>;
-  }>>;
-  databases: import("typebox").TArray<import("typebox").TObject<{
-    name: import("typebox").TString;
-    exists: import("typebox").TBoolean;
-    id: import("typebox").TOptional<import("typebox").TString>;
-    detail: import("typebox").TOptional<import("typebox").TString>;
-  }>>;
-  buckets: import("typebox").TArray<import("typebox").TObject<{
-    name: import("typebox").TString;
-    exists: import("typebox").TBoolean;
-    id: import("typebox").TOptional<import("typebox").TString>;
-    detail: import("typebox").TOptional<import("typebox").TString>;
-  }>>;
-  kvNamespaces: import("typebox").TArray<import("typebox").TObject<{
-    name: import("typebox").TString;
-    exists: import("typebox").TBoolean;
-    id: import("typebox").TOptional<import("typebox").TString>;
-    detail: import("typebox").TOptional<import("typebox").TString>;
-  }>>;
-  queues: import("typebox").TArray<import("typebox").TObject<{
-    name: import("typebox").TString;
-    exists: import("typebox").TBoolean;
-    id: import("typebox").TOptional<import("typebox").TString>;
-    detail: import("typebox").TOptional<import("typebox").TString>;
-  }>>;
-  secrets: import("typebox").TArray<import("typebox").TObject<{
-    name: import("typebox").TString;
-    deployed: import("typebox").TBoolean;
-  }>>;
-}>;
+declare const platformStatusWorkerSchema: import("zod").ZodObject<{
+  name: import("zod").ZodString;
+  exists: import("zod").ZodBoolean;
+  id: import("zod").ZodOptional<import("zod").ZodString>;
+  detail: import("zod").ZodOptional<import("zod").ZodString>;
+  version: import("zod").ZodOptional<import("zod").ZodString>;
+  tag: import("zod").ZodOptional<import("zod").ZodString>;
+  createdAt: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>;
+declare const platformStatusResourceSchema: import("zod").ZodObject<{
+  name: import("zod").ZodString;
+  exists: import("zod").ZodBoolean;
+  id: import("zod").ZodOptional<import("zod").ZodString>;
+  detail: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>;
+declare const platformStatusSecretSchema: import("zod").ZodObject<{
+  name: import("zod").ZodString;
+  deployed: import("zod").ZodBoolean;
+}, import("zod/v4/core").$strip>;
+declare const platformStatusSchema: import("zod").ZodObject<{
+  project: import("zod").ZodString;
+  env: import("zod").ZodString;
+  adapter: import("zod").ZodString;
+  workers: import("zod").ZodArray<import("zod").ZodObject<{
+    name: import("zod").ZodString;
+    exists: import("zod").ZodBoolean;
+    id: import("zod").ZodOptional<import("zod").ZodString>;
+    detail: import("zod").ZodOptional<import("zod").ZodString>;
+    version: import("zod").ZodOptional<import("zod").ZodString>;
+    tag: import("zod").ZodOptional<import("zod").ZodString>;
+    createdAt: import("zod").ZodOptional<import("zod").ZodString>;
+  }, import("zod/v4/core").$strip>>;
+  databases: import("zod").ZodArray<import("zod").ZodObject<{
+    name: import("zod").ZodString;
+    exists: import("zod").ZodBoolean;
+    id: import("zod").ZodOptional<import("zod").ZodString>;
+    detail: import("zod").ZodOptional<import("zod").ZodString>;
+  }, import("zod/v4/core").$strip>>;
+  buckets: import("zod").ZodArray<import("zod").ZodObject<{
+    name: import("zod").ZodString;
+    exists: import("zod").ZodBoolean;
+    id: import("zod").ZodOptional<import("zod").ZodString>;
+    detail: import("zod").ZodOptional<import("zod").ZodString>;
+  }, import("zod/v4/core").$strip>>;
+  kvNamespaces: import("zod").ZodArray<import("zod").ZodObject<{
+    name: import("zod").ZodString;
+    exists: import("zod").ZodBoolean;
+    id: import("zod").ZodOptional<import("zod").ZodString>;
+    detail: import("zod").ZodOptional<import("zod").ZodString>;
+  }, import("zod/v4/core").$strip>>;
+  queues: import("zod").ZodArray<import("zod").ZodObject<{
+    name: import("zod").ZodString;
+    exists: import("zod").ZodBoolean;
+    id: import("zod").ZodOptional<import("zod").ZodString>;
+    detail: import("zod").ZodOptional<import("zod").ZodString>;
+  }, import("zod/v4/core").$strip>>;
+  secrets: import("zod").ZodArray<import("zod").ZodObject<{
+    name: import("zod").ZodString;
+    deployed: import("zod").ZodBoolean;
+  }, import("zod/v4/core").$strip>>;
+}, import("zod/v4/core").$strip>;
 type PlatformStatusOutput = Static<typeof platformStatusSchema>;
-declare const platformPlanAppResourcesSchema: import("typebox").TObject<{
-  hasDatabase: import("typebox").TBoolean;
-  hasBucket: import("typebox").TBoolean;
-  hasKV: import("typebox").TBoolean;
-  hasQueue: import("typebox").TBoolean;
-  hasCron: import("typebox").TBoolean;
-}>;
-declare const platformPlanAppSchema: import("typebox").TObject<{
-  name: import("typebox").TString;
-  path: import("typebox").TString;
-  resources: import("typebox").TObject<{
-    hasDatabase: import("typebox").TBoolean;
-    hasBucket: import("typebox").TBoolean;
-    hasKV: import("typebox").TBoolean;
-    hasQueue: import("typebox").TBoolean;
-    hasCron: import("typebox").TBoolean;
+declare const platformPlanAppResourcesSchema: import("zod").ZodObject<{
+  hasDatabase: import("zod").ZodBoolean;
+  hasBucket: import("zod").ZodBoolean;
+  hasKV: import("zod").ZodBoolean;
+  hasQueue: import("zod").ZodBoolean;
+  hasCron: import("zod").ZodBoolean;
+}, import("zod/v4/core").$strip>;
+declare const platformPlanAppSchema: import("zod").ZodObject<{
+  name: import("zod").ZodString;
+  path: import("zod").ZodString;
+  resources: import("zod").ZodObject<{
+    hasDatabase: import("zod").ZodBoolean;
+    hasBucket: import("zod").ZodBoolean;
+    hasKV: import("zod").ZodBoolean;
+    hasQueue: import("zod").ZodBoolean;
+    hasCron: import("zod").ZodBoolean;
+  }, import("zod/v4/core").$strip>;
+}, import("zod/v4/core").$strip>;
+declare const platformPlanEnvironmentSchema: import("zod").ZodObject<{
+  adapter: import("zod").ZodString;
+  domain: import("zod").ZodOptional<import("zod").ZodString>;
+  zone: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>;
+declare const platformPlanResourceSchema: import("zod").ZodObject<{
+  label: import("zod").ZodString;
+  value: import("zod").ZodString;
+}, import("zod/v4/core").$strip>;
+declare const platformPlanSchema: import("zod").ZodObject<{
+  project: import("zod").ZodString;
+  env: import("zod").ZodString;
+  mode: import("zod").ZodEnum<{
+    monorepo: "monorepo";
+    standalone: "standalone";
   }>;
-}>;
-declare const platformPlanEnvironmentSchema: import("typebox").TObject<{
-  adapter: import("typebox").TString;
-  domain: import("typebox").TOptional<import("typebox").TString>;
-  zone: import("typebox").TOptional<import("typebox").TString>;
-}>;
-declare const platformPlanResourceSchema: import("typebox").TObject<{
-  label: import("typebox").TString;
-  value: import("typebox").TString;
-}>;
-declare const platformPlanSchema: import("typebox").TObject<{
-  project: import("typebox").TString;
-  env: import("typebox").TString;
-  mode: import("typebox").TUnsafe<"monorepo" | "standalone">;
-  apps: import("typebox").TArray<import("typebox").TObject<{
-    name: import("typebox").TString;
-    path: import("typebox").TString;
-    resources: import("typebox").TObject<{
-      hasDatabase: import("typebox").TBoolean;
-      hasBucket: import("typebox").TBoolean;
-      hasKV: import("typebox").TBoolean;
-      hasQueue: import("typebox").TBoolean;
-      hasCron: import("typebox").TBoolean;
-    }>;
-  }>>;
-  environments: import("typebox").TRecord<"^.*$", import("typebox").TObject<{
-    adapter: import("typebox").TString;
-    domain: import("typebox").TOptional<import("typebox").TString>;
-    zone: import("typebox").TOptional<import("typebox").TString>;
-  }>>;
-  resources: import("typebox").TArray<import("typebox").TObject<{
-    label: import("typebox").TString;
-    value: import("typebox").TString;
-  }>>;
-  secretCount: import("typebox").TNumber;
-}>;
+  apps: import("zod").ZodArray<import("zod").ZodObject<{
+    name: import("zod").ZodString;
+    path: import("zod").ZodString;
+    resources: import("zod").ZodObject<{
+      hasDatabase: import("zod").ZodBoolean;
+      hasBucket: import("zod").ZodBoolean;
+      hasKV: import("zod").ZodBoolean;
+      hasQueue: import("zod").ZodBoolean;
+      hasCron: import("zod").ZodBoolean;
+    }, import("zod/v4/core").$strip>;
+  }, import("zod/v4/core").$strip>>;
+  environments: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
+    adapter: import("zod").ZodString;
+    domain: import("zod").ZodOptional<import("zod").ZodString>;
+    zone: import("zod").ZodOptional<import("zod").ZodString>;
+  }, import("zod/v4/core").$strip>>;
+  resources: import("zod").ZodArray<import("zod").ZodObject<{
+    label: import("zod").ZodString;
+    value: import("zod").ZodString;
+  }, import("zod/v4/core").$strip>>;
+  secretCount: import("zod").ZodNumber;
+}, import("zod/v4/core").$strip>;
 type PlatformPlanOutput = Static<typeof platformPlanSchema>;
 //#endregion
 //#region ../../src/cli/platform-lib/services/PlatformInspector.d.ts
@@ -1269,20 +1234,24 @@ declare class PlatformInspector {
   protected readonly options: Readonly<{
     name?: string | undefined;
     default?: string | undefined;
-    tenancy?: "required" | "none" | "optional" | undefined;
+    tenancy?: "none" | "optional" | "required" | undefined;
     secrets?: {
       keys?: string[] | undefined;
       store?: "github" | undefined;
       environmentPattern?: string | undefined;
     } | undefined;
     environments: Record<string, {
+      adapter: "cloudflare" | "vercel";
       domain?: string | undefined;
       zone?: string | undefined;
+      services?: {
+        binding: string;
+        service: string;
+      }[] | undefined;
       jurisdiction?: "eu" | "fedramp" | undefined;
       accountId?: string | undefined;
-      adapter: "cloudflare" | "vercel";
     }>;
-  }>;
+  } | undefined>;
   protected readonly naming: NamingService;
   /**
    * Resolve and validate the full platform configuration.
@@ -1345,7 +1314,8 @@ declare class PlatformOrchestrator {
      * `dist/` and just need the wrangler config refreshed for
      * per-tenant overrides on every deploy.
      */
-    prebuilt?: boolean; /** Tenant slug (apps with tenancy optional|required). */
+    prebuilt?: boolean;
+    /** Tenant slug (apps with tenancy optional|required). */
     tenant?: string;
   }): Promise<{
     urls: string[];
@@ -1366,13 +1336,15 @@ declare class PlatformOrchestrator {
     entry: AppEntry;
     resources: DetectedResources;
     run: RunnerMethod;
-    confirm: (prompt: string) => Promise<string>; /** Tenant slug (apps with tenancy optional|required). */
+    confirm: (prompt: string) => Promise<string>;
+    /** Tenant slug (apps with tenancy optional|required). */
     tenant?: string;
   }): Promise<boolean>;
   plan(options: {
     root: string;
     env: string;
-    resources: DetectedResources; /** Tenant slug (apps with tenancy optional|required). */
+    resources: DetectedResources;
+    /** Tenant slug (apps with tenancy optional|required). */
     tenant?: string;
   }): Promise<{
     config: ResolvedPlatformConfig;
@@ -1384,7 +1356,8 @@ declare class PlatformOrchestrator {
     env: string;
     entry: AppEntry;
     resources: DetectedResources;
-    run: RunnerMethod; /** Tenant slug (apps with tenancy optional|required). */
+    run: RunnerMethod;
+    /** Tenant slug (apps with tenancy optional|required). */
     tenant?: string;
   }): Promise<{
     config: ResolvedPlatformConfig;