#Infra Plugin

Deploy your full-stack app to the cloud in one command. The infra plugin provisions databases, storage buckets, queues, pushes secrets, runs migrations, and deploys your code.

#Quick Start

Register the plugin in alepha.config.ts with the infra() helper:

 1import { defineConfig } from "alepha/cli/config"; 2import { cloudflare, infra } from "alepha/cli/infra"; 3  4export default defineConfig({ 5  plugins: [ 6    infra({ 7      environments: { 8        production: cloudflare({ domain: "myapp.com" }), 9      },10    }),11  ],12});

alepha deploy

Your app is live. Database created, secrets pushed, worker deployed.

#What It Does

Alepha introspects your application at build time. It scans for primitives - $entity, $storage, $cache - plus $job dispatch and registered cron jobs, and maps them to cloud resources on the target platform.

The deployment lifecycle runs in a fixed order:

authenticate → provision → build → migrate → deploy → secrets

Each step is handled by an adapter, and an environment names its adapter by calling the adapter's factory: cloudflare() (Workers, recommended) and bay() (self-hosted) ship with alepha/cli/infra. There is no list of adapter names to extend: an adapter is an import, so writing your own needs nothing from the framework.

alepha infra shows help without loading configuration. The commands are discoverable without a plugin; config-dependent operations require a nonempty explicit environment map. The former command roots are removed, with no aliases.

#Options

Common flags accepted by most subcommands:

#Configuration

Environment names are arbitrary explicit keys. The default is production; a project using only prod must set default: "prod". Files .env.<env> and .env.<env>.local follow the selected key. No implicit environment or provider is created.

infra() accepts the following options:

--env can only name a key of environments: anything else is refused before an adapter runs. Each environment's options are validated against its adapter's own schema when it is resolved, and a bad one is refused by environment name.

#cloudflare()

From alepha/cli/infra. Node only.

#bay()

From alepha/cli/infra. Node only.

 1import { defineConfig } from "alepha/cli/config"; 2import { bay, cloudflare, infra } from "alepha/cli/infra"; 3  4export default defineConfig({ 5  plugins: [ 6    infra({ 7      name: "myapp", 8      environments: { 9        production: cloudflare({ domain: "myapp.com", jurisdiction: "eu" }),10        staging: cloudflare({ domain: "staging.myapp.com" }),11        edge: bay({ host: "deploy@bay.example.com" }),12      },13    }),14  ],15});

Settings shared by several environments repeat per environment; a plain const holding them is the way to share them.

#Secrets

Runtime secrets are pushed to the cloud provider's secret store during alepha deploy. The key set to push is resolved by precedence:

1. infra().secrets.keys: explicit override in alepha.config.ts.
2. Otherwise, the union of every key your app declares via $env (captured in dist/manifest.json at build time) and any keys in .env.{env}.local. If no readable manifest is available, the base env file supplies the allowlist instead; it is not unioned when the manifest exists.

Each key's value resolves from .env.{env} (then .env.{env}.local) first, then process.env - so CI can deliver secrets via the job environment with no .env file on the runner, while ambient runner variables (PATH, GITHUB_*, ...) can never leak.

STRIPE_SECRET_KEY=sk_live_...
SENDGRID_API_KEY=SG...

Variables handled by platform bindings or build config (DATABASE_URL, R2_BUCKET_NAME, HYPERDRIVE_ID, ...), framework infra knobs (LOG_LEVEL, SERVER_PORT, DEBUG, ...), and VITE_* variables are filtered out automatically. PUBLIC_URL is defaulted at config import only in production mode, from the production key's domain, unless already set. This is independent of --env and of the configured default: set other environments' URLs explicitly.

#Resource Naming

All cloud resources follow a deterministic naming convention:

<app>-<env>
<project>-<app>-<env>   (with infra({ project }))

For an app named acme deployed to production:

Names are slugified - lowercase, alphanumeric and dashes, max 63 characters.

When several apps share one Cloudflare account, project keeps their names apart. With infra({ project: "alepha", name: "docs" }), the Worker is alepha-docs-production. It only prefixes names; nothing else reads it.

⚠️ Adding or removing project renames every resource of the app. The next alepha deploy provisions fresh ones under the new names, an empty database included, and leaves the old ones in place. Read alepha infra plan before the first alepha deploy after the change.

#Commands

#plan

Preview the deployment topology without touching anything. No authentication required.

alepha infra plan
alepha infra plan --env staging
alepha infra plan --json

Shows: project name, environments, detected resources, resource names, and secret count.

#deploy (full lifecycle)

Full deployment pipeline. Runs all six lifecycle steps.

alepha deploy
alepha deploy --env staging

--tag no longer exists - it was removed with the artifact registry. A programmatic caller of orchestrator.up({ ... }) still passing tag needs to drop it.

#down

Tear down all resources for an environment. Requires --env.

alepha infra down --env staging

Prompts for confirmation before deleting. Environments starting with tmp skip the confirmation, and --yes (-y) skips it for non-interactive callers (CI).

#status

Inspect what is currently deployed. Alias: alepha infra s.

alepha infra status
alepha infra status --env staging
alepha infra status --json

Shows: workers (deployed/not deployed, version, date), databases, buckets, KV namespaces, queues, and secrets (pushed/missing).

#login / logout

Manage the deploy credential explicitly:

alepha infra login --env production    # opens the Wrangler OAuth flow; probes with a real API call
alepha infra logout --env production

Cloudflare login is rarely needed - the first alepha deploy opens the same flow (see Prerequisites) - but it's the command to reach for when you want to switch accounts or verify credentials without deploying.

Bay login probes SSH and control-socket access; logout refuses because it stores no token. External adapters define their own policy. Login and logout require an explicit --env.

#build

Calls the configured adapter's build step only. Cloudflare may query existing resource bindings and needs suitable credentials for those lookups. It does not provision missing resources. For a credential-free Worker artifact, use alepha build --runtime workerd instead.

alepha infra build --env production

#infra deploy (granular)

Authenticates, then calls the adapter's deploy step only. It skips the CLI's separate provision, build, migrate and secrets steps. Cloudflare requires a readable dist/manifest.json with a workerd slice, the generated Worker entry and dist/wrangler.jsonc. Bay requires a readable manifest with a Node entry or a static public directory. Missing or unsuitable artifacts fail before transport with build/full-deploy guidance. External adapters can use source context and are not forced to have local dist/.

--json is accepted here but currently adds no CLI summary or synthesized URL; adapter output remains the deploy output. Root alepha deploy --json emits status, project, env, urls and an optional controlled domain.

This is a boundary on local orchestration, not remote behavior: Bay still packs/uploads and its host provisions resources and runs startup migrations. An external Lore adapter may still invoke remote latest-build and secret attachment behavior. Those policies are unchanged.

alepha infra deploy --env production

#db

Operations against the deployed database. They live under infra (not core alepha db) because they need the environment config, adapter, and resource naming.

# Run database migrations on the deployed database
alepha infra db migrate --env production

# Pull the deployed database into a local snapshot (defaults to the dev DB path)
alepha infra db export --env production
alepha infra db export --output ./snapshot.db --keepSql

# Record the baseline migration as already applied on a deployed D1 database,
# without executing it (D1 only; --reset replaces an existing history)
alepha infra db baseline mark --env production

#Placeholder blobs

An export copies rows, not objects. The file table arrives intact while the blobs it names stay in remote storage, so a local dev server would answer 404 for every image it is asked to serve - once per row.

db export therefore writes a stand-in blob for each file row, into the directory LocalFileStorageProvider reads. Images become a grey PLACEHOLDER square in their own format, so they render rather than breaking; other types get a minimal valid file. Existing blobs are never overwritten, so anything uploaded locally survives a re-export.

This never runs against production: the files are written by the CLI, to disk, at export time. Serving a stand-in when a blob is missing would need a development-only guard, and a guard that fails open would hide real data loss.

alepha infra db export --env production --skipPlaceholders   # leave the blobs missing

Placeholders are also skipped when --output points somewhere other than the dev database, since the storage directory only serves the dev server.

#secrets

Sync secrets from .env.{env} to an external CI secret store - currently GitHub Actions environments via the gh CLI. This is separate from the runtime secrets pushed during alepha deploy. Alias: alepha infra sec.

alepha infra secrets list           # list remote secret names (--format=gha for a ready-to-paste env: block)
alepha infra secrets diff           # compare local .env.{env} keys against the remote store
alepha infra secrets apply          # push local secrets (upsert; never deletes) - --dry-run to preview

Configure the store in infra():

#Cloudflare Adapter

The Cloudflare adapter deploys your application as a Cloudflare Worker. It uses the Cloudflare REST API for resource provisioning and the Wrangler CLI for login, deployment, D1 migrations, and secret management.

#Prerequisites

• A Cloudflare account
• wrangler is installed automatically if missing

On first run, alepha deploy opens the Wrangler OAuth flow in your browser. The token is validated on every run (re-login is triggered automatically if it expired); account resolution is cached for 4 hours. In CI, set CLOUDFLARE_API_TOKEN instead.

#Resource Mapping

Alepha detects primitives in your code and maps them to Cloudflare resources:

D1, Hyperdrive, R2, KV, and Queue are provisioned via the Cloudflare REST API during the provision step. Cron triggers are written into wrangler.jsonc during the build step.

All provisioning is idempotent. If a resource already exists with the expected name, it is reused.

#Database: D1 vs Hyperdrive

The adapter chooses the database strategy based on DATABASE_URL in .env.{env}:

D1 (default) - If no DATABASE_URL is set, or it does not start with postgres:, the adapter provisions a Cloudflare D1 database (SQLite at the edge). Migrations are applied file by file with wrangler d1 execute --file, never wrangler d1 migrations apply, whose transaction wrapper cascade-deletes child rows on a table rebuild (see the Migrations guide).

Hyperdrive - If DATABASE_URL points to an external PostgreSQL database (postgres://...), the adapter provisions a Hyperdrive config instead. Hyperdrive accelerates connections from Workers to your Postgres database through connection pooling and caching. Migrations run via alepha db migrations apply directly against the database.

# .env.production: D1 (no DATABASE_URL, or d1:// protocol)
# Nothing to set. D1 is created and wired automatically.

# .env.production: Hyperdrive (external Postgres)
DATABASE_URL=postgres://user:pass@db.neon.tech:5432/mydb

#Build

The adapter runs alepha build --runtime workerd with environment variables injected from provisioned resources:

You do not set these manually. CLOUDFLARE_ANALYTICS_DATASET is the one the adapter derives rather than provisions: whenever a $analytics primitive is declared it emits an analytics_engine_datasets binding (bound as ANALYTICS) named <project>-<env>, because Cloudflare creates the dataset on the first data point and there is no id to pair with the name the way KV and D1 need one. An explicit value in .env.{env} overrides the name, and is the only way to get the binding for an app that writes to Workers Analytics Engine without declaring $analytics.

That binding is write-only - env.ANALYTICS.writeDataPoint({...}), which returns nothing and is not awaited. Reading the data back is a different mechanism entirely: POST /accounts/{account_id}/analytics_engine/sql over plain HTTP with a bearer token scoped Account · Account Analytics · Read. Note that permission is account-wide - Cloudflare offers no per-dataset analytics read scope - so think about where that token lives before putting it in a Worker that also serves unauthenticated routes.

#Deploy

Deploys via wrangler deploy using the generated dist/wrangler.jsonc. Returns the live Worker URL.

#Teardown

alepha infra down deletes resources in dependency order:

1. Queue consumers (unbind from worker)
2. Workers
3. Queues
4. KV namespaces
5. R2 buckets (non-empty buckets are wiped via S3 credentials first when available)
6. D1 databases / Hyperdrive configs

#Full Example

 1import { defineConfig } from "alepha/cli/config"; 2import { cloudflare, infra } from "alepha/cli/infra"; 3  4export default defineConfig({ 5  plugins: [ 6    infra({ 7      environments: { 8        production: cloudflare({ 9          domain: "myapp.com",10        }),11      },12    }),13  ],14});

STRIPE_SECRET_KEY=sk_live_...

alepha deploy

This authenticates with Cloudflare, provisions D1 + R2 + KV + Queue (based on your code), builds for Cloudflare Workers, runs D1 migrations, deploys the worker, and pushes STRIPE_SECRET_KEY as a secret.

#Temporary Environments

Prefix an environment name with tmp to create a throwaway deployment. Teardown skips the confirmation prompt.

1environments: {2  production: cloudflare({ domain: "myapp.com" }),3  staging: cloudflare({ domain: "staging.myapp.com" }),4  "tmp-pr-42": cloudflare(),5}

alepha deploy --env tmp-pr-42
# ... test ...
alepha infra down --env tmp-pr-42   # no confirmation

#Writing an adapter

An adapter is a class extending InfraAdapter<TOptions>, with two statics: id, its display name in plan and status, and options, the schema its environment's options are validated against. It reads them from ctx.options.

 1import { $module, z } from "alepha"; 2import { 3  type EnvironmentDescriptor, 4  InfraAdapter, 5  type InfraContext, 6  type InfraState, 7} from "alepha/cli/infra-lib"; 8  9export interface ExampleOptions {10  region: string;11}12 13export class ExampleAdapter extends InfraAdapter<ExampleOptions> {14  static readonly id = "example";15  static readonly options = z.object({ region: z.text() });16 17  async authenticate(ctx: InfraContext<ExampleOptions>): Promise<void> {18    // Implement this adapter's local and CI authentication policy.19  }20 21  async build(ctx: InfraContext<ExampleOptions>): Promise<void> {}22 23  async deploy(ctx: InfraContext<ExampleOptions>): Promise<string | undefined> {24    return `https://${ctx.project}.${ctx.options.region}.example.com`;25  }26 27  async inspect(): Promise<InfraState> {28    return {29      workers: [],30      databases: [],31      buckets: [],32      kvNamespaces: [],33      queues: [],34      secrets: [],35    };36  }37 38  async teardown(): Promise<void> {}39}40 41export const AlephaExampleAdapter = $module({42  name: "example.infra",43  services: [ExampleAdapter],44});45 46export const example = (47  options: ExampleOptions,48): EnvironmentDescriptor<ExampleOptions> => ({49  adapter: ExampleAdapter,50  options,51});

Three rules keep it a good citizen:

• Its own $module, with no $command. infra() registers each environment's adapter class when the config loads, which registers the module that declares it. A command declared in that module would appear in alepha --help.
• The factory's declared return type is the generic EnvironmentDescriptor, so a published .d.ts names neither the adapter class nor anything it injects.
• Secrets ride the deploy. The pipeline runs deploy then secrets, so an adapter pushes them inside deploy() and leaves secrets() empty, or the new build boots once without them. resolveSecretKeySet and selectSecrets from alepha/cli/infra-lib resolve the same key set every adapter uses.

Override provision, migrate, login, logout or exportDb when the target has one, and set controlsDomain = false when the adapter does not put the environment's domain into effect itself.

#Tips

Start with plan. Run alepha infra plan before your first deploy. It shows what will be created without touching anything.

Use temporary environments for PRs. Name them tmp-pr-<number> and they tear down without confirmation. Great for preview deployments.

Keep secrets in .env.production. The infra plugin reads them automatically. Don't commit this file.

Check status after deploy. Run alepha infra status to verify everything is live and secrets are pushed.

#Breaking migration from the platform API

This is a source-breaking rename with no legacy command aliases or import barrels. Update consumers before installing the new framework. The left column below intentionally documents the removed API.

The old auth and up groups do not exist under infra. Standalone provision and root migrate commands do not exist: provisioning belongs to full deployment, and deployed migrations use infra db migrate.

Adapter factories (cloudflare, bay and external factories such as lore), EnvironmentDescriptor, DetectedResources, ResourceState, WorkerState, SecretState, ExportDbOptions, provider-specific types/classes and the remaining service names keep their names. Only their import path changes where relevant. The library stays command-free; its workerd export remains the same subset, without Node adapters, disk stores or the built-in factories. Node consumers use the Node entry; Worker deploy services use WorkerCloudflareAdapter and explicit descriptors.

Programmatic InfraOrchestrator.up(), auth() and printUpSummary() retain their method names and behavior. Adapter methods, JSON field names and adapter ids also stay unchanged. name, project, default, secrets, the explicit environment map and .env.* files preserve their meanings. Keep configured names to retain existing resources: the examples in this repository remain alepha-docs-production, alepha-ui-production and alepha-shop-production. The internal cache still uses node_modules/.alepha/platform.json; the rename does not invalidate its format or identity.

#External consumers, not shipped by this repository

Lore has runtime imports to migrate, not just prose: its app config and deployment workflow; @alepha/lore's CLI adapter, adapter tests and descriptor types; @lore/deploy's runner, teardown, naming, rollback, asset-cache and secret services; its estate pull controller and rehearsal script. Replace the library imports and the renamed module/atom/classes/types using the table. Its external factory remains lore(); its remote build, secret and provisioning policies do not change because of this rename.

The framework's release and nightly workflows also run the installed @alepha/lore CLI. A release of that CLI still importing the removed library path will fail to start. The owner has reserved Q2607 for this compatibility work after E73; it is not a dependency gate for this epic, and the migration is not claimed as shipped here.

Bay's repository has guide references in its README, installation instructions and introduction. Its Go host has no framework TypeScript imports to rename. Update that prose separately; Bay's host protocol and behavior remain unchanged. Other downstream apps, including Capacity and Mikanda, need their config helper/imports migrated before upgrading.