@geekmidas/cli 10.0.0-alpha.11 → 10.0.0-alpha.111

package/dist/workspace-BwqQnool.cjs

@@ -0,0 +1,2806 @@
+const require_errors = require("./errors-DMC4Umsb.cjs");
+const require_schemas = require("./schemas-BQ_v0lEX.cjs");
+const require_define = require("./define-crmMcXFS.cjs");
+let node_path = require("node:path");
+let node_net = require("node:net");
+//#region src/compose/dnsConfig.ts
+/**
+* `dns['<root domain>'].records` — how a domain's hosts point at a compose
+* stage's server — checked and read. Pure, and kept apart from the DNS step
+* so the workspace schema checks a config with the same rules and the same
+* named errors the step applies.
+*/
+/** The stage-secret key holding the server's public IPv4 address. */
+const SERVER_IPV4_KEY = "GKM_SERVER_IPV4";
+/** The stage-secret key holding the server's public IPv6 address, if any. */
+const SERVER_IPV6_KEY = "GKM_SERVER_IPV6";
+/**
+* Whether a stage secret is gkm's own — the server's address — and so never
+* written into an app's or a worker's environment.
+*/
+function isReservedStageKey(key) {
+	return key.startsWith("GKM_SERVER_");
+}
+/** A DNS hostname: dot-separated labels of letters, digits and inner '-'. */
+const HOSTNAME = /^(?=.{1,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$/i;
+/** Whether `value` is a DNS hostname with at least two labels. */
+function isHostname(value) {
+	return typeof value === "string" && HOSTNAME.test(value);
+}
+/** A CNAME target that is not a hostname under its own domain. */
+var DnsTargetInvalid = class extends require_errors.GkmError {
+	domain;
+	target;
+	stage;
+	constructor(domain, target, stage) {
+		super(`dns['${domain}'].records.target${stage ? ` for '${stage}'` : ""} is ${JSON.stringify(target)}, which is not a hostname under ${domain}. Every host's CNAME points at it and gkm writes its A record, so it must be a name in the same zone — like 'server.${domain}'.`);
+		this.domain = domain;
+		this.target = target;
+		this.stage = stage;
+		this.name = "DnsTargetInvalid";
+	}
+};
+/** The CNAME target names under one domain, by the stage they are for, checked. */
+function targets(records) {
+	const { target } = records;
+	if (target && typeof target === "object" && !Array.isArray(target)) return Object.entries(target);
+	return [[void 0, target]];
+}
+/**
+* One domain's records mode checked.
+*
+* @throws {DnsTargetInvalid} for a target that is not a hostname under it
+*/
+function checkDnsRecordsMode(domain, records) {
+	if (!records || typeof records !== "object") return;
+	const mode = records;
+	if (mode.mode !== "cname") return;
+	for (const [stage, target] of targets(mode)) {
+		const name = typeof target === "string" ? target.toLowerCase() : target;
+		if (!isHostname(name) || !name.endsWith(`.${domain.toLowerCase()}`)) throw new DnsTargetInvalid(domain, target, stage);
+	}
+}
+/**
+* The CNAME target a domain's hosts point at on `stage`, or `undefined` for
+* A records — including a per-stage map that names no target for it.
+*/
+function cnameTarget(records, stage) {
+	if (!records || records === "a") return void 0;
+	return (typeof records.target === "string" ? records.target : records.target[stage])?.toLowerCase();
+}
+/** Where an `every` schedule is counted from: 02:00 UTC. */
+const EVERY_ANCHOR_SECONDS = 7200;
+/** An `every` that is not an interval, or is shorter than an hour. */
+var BackupIntervalInvalid = class extends require_errors.GkmError {
+	stage;
+	value;
+	reason;
+	constructor(stage, value, reason) {
+		super(`deploy.backups.${stage}.every is '${value}', which ${reason}. Give a number and a unit — '90m', '6h', '1d' — of at least an hour, or a five-field cron expression in UTC: { cron: '0 */6 * * *' }.`);
+		this.stage = stage;
+		this.value = value;
+		this.reason = reason;
+		this.name = "BackupIntervalInvalid";
+	}
+};
+/** A `cron` that is not a five-field expression, or runs more than hourly. */
+var BackupCronInvalid = class extends require_errors.GkmError {
+	stage;
+	value;
+	reason;
+	constructor(stage, value, reason) {
+		super(`deploy.backups.${stage}.cron is '${value}', which ${reason}. Give five fields in UTC — minute hour day-of-month month day-of-week, e.g. '0 */6 * * *' — that run at most once an hour.`);
+		this.stage = stage;
+		this.value = value;
+		this.reason = reason;
+		this.name = "BackupCronInvalid";
+	}
+};
+/** A `keep` that is not a number of days. */
+var BackupRetentionInvalid = class extends require_errors.GkmError {
+	stage;
+	value;
+	constructor(stage, value) {
+		super(`deploy.backups.${stage}.keep is '${value}', which is not a number of days. Give one of at least a day: keep: '30d'.`);
+		this.stage = stage;
+		this.value = value;
+		this.name = "BackupRetentionInvalid";
+	}
+};
+/** An entry that is neither `false` nor `{ every | cron, keep }`. */
+var BackupsEntryInvalid = class extends require_errors.GkmError {
+	stage;
+	value;
+	reason;
+	constructor(stage, value, reason) {
+		super(`deploy.backups.${stage} is ${JSON.stringify(value)}, which ${reason}. It takes { every: '6h', keep: '30d' }, { cron: '0 */6 * * *', keep: '30d' }, or false to take no backups.`);
+		this.stage = stage;
+		this.value = value;
+		this.reason = reason;
+		this.name = "BackupsEntryInvalid";
+	}
+};
+const UNITS = {
+	m: 60,
+	h: 3600,
+	d: 86400
+};
+/** `'6h'` as seconds. */
+function parseInterval(stage, value) {
+	const match = /^(\d+)\s*([mhd])$/.exec(value.trim());
+	if (!match) throw new BackupIntervalInvalid(stage, value, "is not an interval");
+	const seconds = Number(match[1]) * UNITS[match[2]];
+	if (seconds < 3600) throw new BackupIntervalInvalid(stage, value, "is shorter than an hour, the shortest interval backups take");
+	return seconds;
+}
+/** `'30d'` as days. */
+function parseRetention(stage, value) {
+	const match = /^(\d+)\s*d$/.exec(value.trim());
+	const days = match ? Number(match[1]) : 0;
+	if (!match || days < 1) throw new BackupRetentionInvalid(stage, value);
+	return days;
+}
+const CRON_FIELDS = [
+	{
+		name: "minute",
+		min: 0,
+		max: 59
+	},
+	{
+		name: "hour",
+		min: 0,
+		max: 23
+	},
+	{
+		name: "day of month",
+		min: 1,
+		max: 31
+	},
+	{
+		name: "month",
+		min: 1,
+		max: 12
+	},
+	{
+		name: "day of week",
+		min: 0,
+		max: 7
+	}
+];
+/** One cron field's values, or `null` for `*`. */
+function cronField(field, spec) {
+	if (field === "*") return null;
+	const values = /* @__PURE__ */ new Set();
+	for (const part of field.split(",")) {
+		const match = /^(\*|(\d+)(?:-(\d+))?)(?:\/(\d+))?$/.exec(part);
+		if (!match) return `has '${part}' in its ${spec.name} field`;
+		const step = match[4] ? Number(match[4]) : 1;
+		if (step < 1) return `steps by 0 in its ${spec.name} field`;
+		const from = match[1] === "*" ? spec.min : Number(match[2]);
+		const to = match[1] === "*" ? spec.max : match[3] !== void 0 ? Number(match[3]) : match[4] ? spec.max : from;
+		if (from < spec.min || to > spec.max || from > to) return `has '${part}' in its ${spec.name} field, outside ${spec.min}-${spec.max}`;
+		for (let value = from; value <= to; value += step) values.add(value);
+	}
+	return [...values].sort((a, b) => a - b);
+}
+/** A five-field cron expression, expanded. */
+function parseCron(stage, expression) {
+	const fields = expression.trim().split(/\s+/);
+	if (fields.length !== 5) throw new BackupCronInvalid(stage, expression, `has ${fields.length} field${fields.length === 1 ? "" : "s"}, not five`);
+	const parsed = fields.map((field, i) => cronField(field, CRON_FIELDS[i]));
+	const problem = parsed.find((p) => typeof p === "string");
+	if (typeof problem === "string") throw new BackupCronInvalid(stage, expression, problem);
+	const [minutes, hours, days, months, weekdays] = parsed;
+	return {
+		kind: "cron",
+		expression: fields.join(" "),
+		minutes: minutes ?? range(0, 59),
+		hours: hours ?? range(0, 23),
+		days: days ?? null,
+		months: months ?? null,
+		weekdays: weekdays ? [...new Set(weekdays.map((d) => d % 7))].sort((a, b) => a - b) : null
+	};
+}
+function range(from, to) {
+	return Array.from({ length: to - from + 1 }, (_, i) => from + i);
+}
+/** Whether a cron schedule runs on the UTC day of `date`. */
+function cronDay(schedule, date) {
+	if (schedule.months && !schedule.months.includes(date.getUTCMonth() + 1)) return false;
+	const dom = schedule.days?.includes(date.getUTCDate());
+	const dow = schedule.weekdays?.includes(date.getUTCDay());
+	if (schedule.days && schedule.weekdays) return Boolean(dom || dow);
+	if (schedule.days) return Boolean(dom);
+	if (schedule.weekdays) return Boolean(dow);
+	return true;
+}
+/** How far ahead a cron schedule is looked for its next run: four years. */
+const CRON_HORIZON_DAYS = 1464;
+/**
+* The first time after `after` (to the minute) the schedule runs, or `null`
+* when it does not within four years.
+*
+* The container's runner (`runner.ts`) keeps a copy of this, since it ships
+* alone; a test holds the two to the same answers.
+*/
+function nextRun(schedule, after) {
+	const from = Math.floor(after.getTime() / 6e4) * 6e4 + 6e4;
+	if (schedule.kind === "every") {
+		const interval = schedule.seconds * 1e3;
+		const offset = schedule.offset * 1e3;
+		const k = Math.ceil((from - offset) / interval);
+		return new Date(offset + k * interval);
+	}
+	const start = new Date(from);
+	const day = Date.UTC(start.getUTCFullYear(), start.getUTCMonth(), start.getUTCDate());
+	for (let i = 0; i < CRON_HORIZON_DAYS; i++) {
+		const date = new Date(day + i * 864e5);
+		if (!cronDay(schedule, date)) continue;
+		for (const hour of schedule.hours) for (const minute of schedule.minutes) {
+			const at = date.getTime() + hour * 36e5 + minute * 6e4;
+			if (at >= from) return new Date(at);
+		}
+	}
+	return null;
+}
+/**
+* The shortest and longest a schedule goes between two runs, in seconds,
+* over the four years from 2026 — leap days and month ends included — or
+* `null` when it does not run twice in them.
+*/
+function scheduleGaps(schedule) {
+	if (schedule.kind === "every") return {
+		shortest: schedule.seconds,
+		longest: schedule.seconds
+	};
+	const start = Date.UTC(2026, 0, 1);
+	const end = start + CRON_HORIZON_DAYS * 864e5;
+	let previous;
+	let longest = 0;
+	let shortest = Number.POSITIVE_INFINITY;
+	let at = /* @__PURE__ */ new Date(start - 6e4);
+	while (at && at.getTime() < end) {
+		at = nextRun(schedule, at);
+		if (!at) break;
+		if (previous !== void 0) {
+			longest = Math.max(longest, at.getTime() - previous);
+			shortest = Math.min(shortest, at.getTime() - previous);
+			if (shortest < 36e5) break;
+		}
+		previous = at.getTime();
+	}
+	if (longest === 0) return null;
+	return {
+		shortest: shortest / 1e3,
+		longest: longest / 1e3
+	};
+}
+/** `21600` as `6h`, `86400` as `1d`. */
+function duration(seconds) {
+	if (seconds % 86400 === 0) return `${seconds / 86400}d`;
+	if (seconds % 3600 === 0) return `${seconds / 3600}h`;
+	return `${seconds / 60}m`;
+}
+/**
+* One stage's entry, checked and resolved: `false`, or its schedule and
+* retention — the defaults filling what it leaves out.
+*
+* @throws {BackupsEntryInvalid} for an entry of the wrong shape
+* @throws {BackupIntervalInvalid} for an `every` that is not an interval of an hour or more
+* @throws {BackupCronInvalid} for a `cron` that is not five fields, or runs more than hourly
+* @throws {BackupRetentionInvalid} for a `keep` that is not days
+*/
+function checkStageBackups(stage, value) {
+	if (value === false) return false;
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new BackupsEntryInvalid(stage, value, "is not an entry");
+	const entry = value;
+	const unknown = Object.keys(entry).filter((key) => ![
+		"every",
+		"cron",
+		"keep"
+	].includes(key));
+	if (unknown.length > 0) throw new BackupsEntryInvalid(stage, value, `has ${unknown.map((k) => `'${k}'`).join(", ")}, which it does not take`);
+	for (const key of [
+		"every",
+		"cron",
+		"keep"
+	]) if (entry[key] !== void 0 && typeof entry[key] !== "string") throw new BackupsEntryInvalid(stage, value, `has a ${key} that is not text`);
+	if (entry.every !== void 0 && entry.cron !== void 0) throw new BackupsEntryInvalid(stage, value, "gives both every and cron; give one");
+	const keepDays = parseRetention(stage, entry.keep ?? "30d");
+	if (typeof entry.cron === "string") {
+		const schedule = parseCron(stage, entry.cron);
+		const gaps = scheduleGaps(schedule);
+		if (!gaps) throw new BackupCronInvalid(stage, entry.cron, "does not run twice in four years");
+		if (gaps.shortest < 3600) throw new BackupCronInvalid(stage, entry.cron, `runs ${duration(gaps.shortest)} apart at its closest, more often than once an hour`);
+		return {
+			schedule,
+			keepDays,
+			maxGapSeconds: gaps.longest,
+			describe: `cron '${schedule.expression}' (UTC), kept ${keepDays} days`
+		};
+	}
+	const seconds = parseInterval(stage, entry.every ?? "1d");
+	return {
+		schedule: {
+			kind: "every",
+			seconds,
+			offset: EVERY_ANCHOR_SECONDS
+		},
+		keepDays,
+		maxGapSeconds: seconds,
+		describe: `every ${duration(seconds)} from 02:00 UTC, kept ${keepDays} days`
+	};
+}
+//#endregion
+//#region src/secrets/providers.ts
+/**
+* The secrets stores gkm ships, by name — with no imports, so the config
+* loader can check `secrets.store` without loading any store.
+*/
+/** The stores this package ships, by the name `secrets.store` gives them. */
+const SECRETS_STORE_PROVIDERS = [
+	"file",
+	"ssm",
+	"secrets-manager",
+	"s3"
+];
+/**
+* `secrets.store` names a provider this package does not ship — a typo such
+* as `'secretsmanager'` or `'ssm-parameter'`. Refused rather than read as the
+* file, which would leave a deployed stage's secrets on one machine.
+*/
+var UnknownSecretsStoreProvider = class extends require_errors.GkmError {
+	provider;
+	constructor(provider) {
+		super(`secrets.store names the provider ${JSON.stringify(provider)}, which is not one gkm ships. Use 'file', { provider: 's3' }, { provider: 'ssm', region }, { provider: 'secrets-manager', region }, or { provider: <an object with name, read() and write()> } in gkm.config.ts.`);
+		this.provider = provider;
+		this.name = "UnknownSecretsStoreProvider";
+	}
+};
+/**
+* Refuse a `secrets.store` naming a provider that is not one, before the
+* schema reduces it to a generic validation failure.
+*/
+function assertKnownSecretsStore(store) {
+	if (store === void 0) return;
+	const provider = typeof store === "object" && store !== null && "provider" in store ? store.provider : store;
+	if (typeof provider === "string" && !SECRETS_STORE_PROVIDERS.includes(provider)) throw new UnknownSecretsStoreProvider(provider);
+}
+/**
+* An `s3` secrets store names no region, and the deploy state is not in S3 to
+* take one from.
+*/
+var S3SecretsStoreNeedsRegion = class extends require_errors.GkmError {
+	constructor() {
+		super("secrets.store is { provider: 's3' } with no region, and the deploy state is not in S3 to take one from. Name it — secrets: { store: { provider: 's3', region: '<region>' } } — or keep the state beside it: state: { provider: 's3', region: '<region>' }.");
+		this.name = "S3SecretsStoreNeedsRegion";
+	}
+};
+/**
+* Where an `s3` store keeps a stage's secrets. With no bucket named it is the
+* project bucket, beside the deploy state; region and prefix default to the
+* state's when that is in S3 too, so the two are written once.
+*
+* @throws {S3SecretsStoreNeedsRegion} when no region is named or inherited
+*/
+function s3SecretsLocation(store, state) {
+	const s3State = typeof state === "object" && state !== null && state.provider === "s3" ? state : void 0;
+	const region = store.region ?? s3State?.region;
+	if (!region) throw new S3SecretsStoreNeedsRegion();
+	return {
+		bucket: store.bucket,
+		region,
+		prefix: (store.prefix ?? s3State?.prefix ?? "gkm").replace(/\/+$/, "")
+	};
+}
+/** The key a stage's secrets are kept at: `<prefix>/<project>/<stage>/secrets.json`. */
+function s3SecretsKey(prefix, project, stage) {
+	const path = `${project}/${stage}/secrets.json`;
+	return prefix ? `${prefix}/${path}` : path;
+}
+//#endregion
+//#region src/compose/proxy.ts
+/**
+* Which proxy a stage's stack is served by, and with whose certificate —
+* `deploy.compose.proxy` and `deploy.compose.tls`, resolved for one stage.
+*
+* Pure, and kept apart from the stack so the workspace schema can check a
+* config with the same rules — and the same named errors — the stack applies.
+*/
+/** A per-stage setting keyed by a stage the workspace does not have. */
+var ComposeStageUnknown = class extends require_errors.GkmError {
+	setting;
+	stage;
+	stages;
+	constructor(setting, stage, stages) {
+		super(`deploy.compose.${setting} names the stage '${stage}', which is not one of this workspace's (${stages.join(", ")}). Use a stage from stages.local or stages.deployed.`);
+		this.setting = setting;
+		this.stage = stage;
+		this.stages = stages;
+		this.name = "ComposeStageUnknown";
+	}
+};
+/**
+* A certificate for the local stage, whose certificates are always Caddy's
+* own CA — the one `gkm trust` installs.
+*/
+var ComposeTlsOnLocalStage = class extends require_errors.GkmError {
+	stage;
+	constructor(stage) {
+		super(`deploy.compose.tls sets a certificate for '${stage}', the local stage, whose certificates always come from Caddy's local CA (\`gkm trust\` installs it). Remove it, or set it for a deployed stage.`);
+		this.stage = stage;
+		this.name = "ComposeTlsOnLocalStage";
+	}
+};
+/**
+* A server for the local stage, which always runs on this machine's Docker.
+*/
+var ComposeServerOnLocalStage = class extends require_errors.GkmError {
+	stage;
+	constructor(stage) {
+		super(`deploy.compose.server names '${stage}', the local stage, which always runs on this machine's Docker. Remove it, or set it for a deployed stage.`);
+		this.stage = stage;
+		this.name = "ComposeServerOnLocalStage";
+	}
+};
+/** The stage's certificate or key file is not there to read. */
+var ComposeTlsFileMissing = class extends require_errors.GkmError {
+	stage;
+	file;
+	constructor(stage, file) {
+		super(`deploy.compose.tls for '${stage}' names ${file}, and there is no file there. Point certFile and keyFile at the PEM certificate (with its chain) and key — relative to the workspace root, or absolute.`);
+		this.stage = stage;
+		this.file = file;
+		this.name = "ComposeTlsFileMissing";
+	}
+};
+/**
+* The proxy a stage's stack is served by. The local stage is always Caddy —
+* its internal CA and `gkm trust` — whatever is configured.
+*/
+function proxyFor(config, stage, local) {
+	if (local) return "caddy";
+	const proxy = config?.proxy;
+	if (!proxy) return "caddy";
+	if (typeof proxy === "string") return proxy;
+	return proxy[stage] ?? "caddy";
+}
+/** A deployed stage's own certificate, its paths absolute, when it sets one. */
+function certificateFor(config, stage, root) {
+	const tls = config?.tls?.[stage];
+	if (!tls) return void 0;
+	const absolute = (file) => (0, node_path.isAbsolute)(file) ? file : (0, node_path.resolve)(root, file);
+	return {
+		certFile: absolute(tls.certFile),
+		keyFile: absolute(tls.keyFile)
+	};
+}
+/**
+* Throws the named error for the first thing wrong with the per-stage
+* settings: a stage the workspace does not have, or a certificate for the
+* local stage.
+*/
+function checkComposeStages(config, stages) {
+	const known = [stages.local, ...stages.deployed];
+	if (config?.proxy && typeof config.proxy === "object") {
+		for (const stage of Object.keys(config.proxy)) if (!known.includes(stage)) throw new ComposeStageUnknown("proxy", stage, known);
+	}
+	for (const stage of Object.keys(config?.tls ?? {})) {
+		if (stage === stages.local) throw new ComposeTlsOnLocalStage(stage);
+		if (!known.includes(stage)) throw new ComposeStageUnknown("tls", stage, known);
+	}
+	for (const stage of Object.keys(config?.server ?? {})) {
+		if (stage === stages.local) throw new ComposeServerOnLocalStage(stage);
+		if (!known.includes(stage)) throw new ComposeStageUnknown("server", stage, known);
+	}
+}
+//#endregion
+//#region src/providers/s3/errors.ts
+/** What the `s3` provider refuses, and how each is put right. */
+/** An `objects` entry for `s3` with a field it does not take or cannot use. */
+var S3ProviderConfigInvalid = class extends require_errors.GkmError {
+	stage;
+	field;
+	value;
+	expected;
+	constructor(stage, field, value, expected) {
+		super(`deploy.objects.${stage}.${field} is ${JSON.stringify(value)}; ${expected}.`);
+		this.stage = stage;
+		this.field = field;
+		this.value = value;
+		this.expected = expected;
+		this.name = "S3ProviderConfigInvalid";
+	}
+};
+/** No region anywhere to create the stage's buckets in. */
+var S3RegionRequired = class extends require_errors.GkmError {
+	stage;
+	constructor(stage) {
+		super(`The s3 provider has no region for the stage '${stage}'. Name one in gkm.config.ts: deploy: { objects: { ${stage}: { provider: 's3', region: 'eu-west-1' } } } — or set AWS_REGION.`);
+		this.stage = stage;
+		this.name = "S3RegionRequired";
+	}
+};
+/** The good name and every suffixed one are taken by other accounts. */
+var BucketNameUnavailable = class extends require_errors.GkmError {
+	id;
+	tried;
+	constructor(id, tried) {
+		super(`Every name tried for the bucket '${id}' is taken by another AWS account: ${tried.join(", ")}. Set deploy.namespace in gkm.config.ts to something more particular to you, and run the provision again.`);
+		this.id = id;
+		this.tried = tried;
+		this.name = "BucketNameUnavailable";
+	}
+};
+/** A bucket in this account carries another project's tag. */
+var BucketOwnedByAnotherProject = class extends require_errors.GkmError {
+	bucket;
+	owner;
+	project;
+	constructor(bucket, owner, project) {
+		super(`The bucket '${bucket}' is in this account and tagged gkm:project=${owner}, not ${project}: another project's. gkm never adopts it. Set deploy.namespace in gkm.config.ts so this project names its buckets differently.`);
+		this.bucket = bucket;
+		this.owner = owner;
+		this.project = project;
+		this.name = "BucketOwnedByAnotherProject";
+	}
+};
+/** The bucket the stage's state names exists, and this account cannot reach it. */
+var RecordedBucketUnreachable = class extends require_errors.GkmError {
+	id;
+	bucket;
+	constructor(id, bucket) {
+		super(`The stage's state records '${bucket}' as the bucket for '${id}', and this account cannot reach it — it is in another account, or the credentials are not the stage account's. Run with the account that created it (--profile).`);
+		this.id = id;
+		this.bucket = bucket;
+		this.name = "RecordedBucketUnreachable";
+	}
+};
+/** An IAM user by gkm's name exists, and gkm did not create it for this stage. */
+var IamUserNotOwned = class extends require_errors.GkmError {
+	user;
+	project;
+	stage;
+	constructor(user, project, stage) {
+		super(`The IAM user '${user}' exists and is not tagged gkm:project=${project}, gkm:stage=${stage}, so gkm leaves it alone. Rename or delete it, or set deploy.namespace in gkm.config.ts so gkm names its users differently.`);
+		this.user = user;
+		this.project = project;
+		this.stage = stage;
+		this.name = "IamUserNotOwned";
+	}
+};
+/** The user already has the two access keys IAM allows. */
+var AccessKeyLimit = class extends require_errors.GkmError {
+	user;
+	keys;
+	constructor(user, keys) {
+		super(`The IAM user '${user}' already has two access keys (${keys.join(", ")}), the most IAM allows, and gkm needs to issue one. Delete the one the stage does not use (aws iam delete-access-key --user-name ${user} --access-key-id …), then run the provision again.`);
+		this.user = user;
+		this.keys = keys;
+		this.name = "AccessKeyLimit";
+	}
+};
+/** `--rotate-keys` while the last rotation's old key is still active. */
+var RotationInProgress = class extends require_errors.GkmError {
+	id;
+	previous;
+	stage;
+	constructor(id, previous, stage) {
+		super(`The bucket '${id}' is mid-rotation: its old key ${previous} is still active until '${stage}' is deployed with the new one: deploy it (gkm deploy --stage ${stage}) — the next deploy after that deletes the old key — or pass --retire-old-keys to delete it now, before rotating again.`);
+		this.id = id;
+		this.previous = previous;
+		this.stage = stage;
+		this.name = "RotationInProgress";
+	}
+};
+/** The stage's secrets point the bucket's key at a bucket gkm did not provision. */
+var BucketKeySetElsewhere = class extends require_errors.GkmError {
+	key;
+	bucket;
+	found;
+	stage;
+	constructor(key, bucket, found, stage) {
+		super(`${key} in the stage '${stage}' points at the bucket '${found}', and the s3 provider manages '${bucket}' for it. Remove the key (gkm secrets:unset ${key} --stage ${stage}) to have the provider write its own, or set deploy.objects.${stage} to 'external' to keep yours.`);
+		this.key = key;
+		this.bucket = bucket;
+		this.found = found;
+		this.stage = stage;
+		this.name = "BucketKeySetElsewhere";
+	}
+};
+/** `verify()`: a provisioned bucket the stage's key cannot reach. */
+var ProvisionedBucketUnreachable = class extends require_errors.GkmError {
+	id;
+	bucket;
+	stage;
+	reason;
+	constructor(id, bucket, stage, reason) {
+		super(`The bucket '${bucket}' (${id}) cannot be reached with the key in the stage '${stage}''s secrets: ${reason}. Deploy '${stage}' with the stage account's credentials (gkm deploy --stage ${stage}), which creates or repairs it.`);
+		this.id = id;
+		this.bucket = bucket;
+		this.stage = stage;
+		this.reason = reason;
+		this.name = "ProvisionedBucketUnreachable";
+	}
+};
+/**
+* `verify()`: the bucket answers from another region than the one its URL
+* names — S3 redirects (301) or refuses the signature (400) and says where
+* the bucket is.
+*/
+var BucketRegionMismatch = class extends require_errors.GkmError {
+	id;
+	bucket;
+	stage;
+	key;
+	bucketRegion;
+	urlRegion;
+	askedRegion;
+	answer;
+	constructor(id, bucket, stage, key, bucketRegion, urlRegion, askedRegion, answer) {
+		const says = urlRegion ? `says ${urlRegion}` : `names no region, so ${askedRegion} was asked`;
+		super(`The bucket '${bucket}' (${id}) is in ${bucketRegion}, but ${key} in the stage '${stage}''s secrets ${says} (${answer}). Deploy '${stage}' with the stage account's credentials (gkm deploy --stage ${stage}): the s3 provider reads the bucket's region and rewrites ${key} with it. Set deploy.objects.${stage}.region to '${bucketRegion}' in gkm.config.ts so the stage's config says where its buckets are.`);
+		this.id = id;
+		this.bucket = bucket;
+		this.stage = stage;
+		this.key = key;
+		this.bucketRegion = bucketRegion;
+		this.urlRegion = urlRegion;
+		this.askedRegion = askedRegion;
+		this.answer = answer;
+		this.name = "BucketRegionMismatch";
+	}
+};
+/** Neither `HeadBucket` nor `GetBucketLocation` says where a bucket is. */
+var BucketRegionUnknown = class extends require_errors.GkmError {
+	bucket;
+	head;
+	location;
+	constructor(bucket, head, location) {
+		super(`gkm cannot tell which region the bucket '${bucket}' is in: HeadBucket answered ${head}, and GetBucketLocation ${location}. Check that the provisioning credentials are the stage account's and may call s3:GetBucketLocation on it, then run the deploy again.`);
+		this.bucket = bucket;
+		this.head = head;
+		this.location = location;
+		this.name = "BucketRegionUnknown";
+	}
+};
+/** `HeadBucket` answered neither yes, no, nor "another account's". */
+var BucketProbeFailed = class extends require_errors.GkmError {
+	bucket;
+	answer;
+	constructor(bucket, answer) {
+		super(`gkm asked S3 whether the bucket '${bucket}' exists and got ${answer}. Check the provisioning credentials and the stage's region, then run the deploy again.`);
+		this.bucket = bucket;
+		this.answer = answer;
+		this.name = "BucketProbeFailed";
+	}
+};
+//#endregion
+//#region src/providers/s3/config.ts
+const FIELDS = [
+	"provider",
+	"region",
+	"versioning"
+];
+/** An AWS region code: `eu-west-1`, `us-gov-west-1`, `ap-southeast-4`. */
+const REGION = /^[a-z]{2}(-[a-z]+)+-\d+$/;
+function checkS3Config(stage, config) {
+	const entry = config;
+	for (const field of Object.keys(entry)) if (!FIELDS.includes(field)) throw new S3ProviderConfigInvalid(stage, field, entry[field], `the s3 provider takes ${FIELDS.slice(1).join(" and ")} only`);
+	if (entry.region !== void 0) {
+		if (typeof entry.region !== "string" || !REGION.test(entry.region)) throw new S3ProviderConfigInvalid(stage, "region", entry.region, "set it to an AWS region code, like 'eu-west-1'");
+	}
+	if (entry.versioning !== void 0 && typeof entry.versioning !== "boolean") throw new S3ProviderConfigInvalid(stage, "versioning", entry.versioning, "set it to true to keep previous versions of every object, or leave it out");
+	return entry;
+}
+/** How the s3 provider's provisioning credentials are supplied. */
+const S3_PROVISIONING = {
+	env: [
+		"AWS_PROFILE",
+		"AWS_ACCESS_KEY_ID",
+		"AWS_SECRET_ACCESS_KEY",
+		"AWS_SESSION_TOKEN"
+	],
+	describe: "the stage's AWS account — AWS_PROFILE, or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY (in CI, what aws-actions/configure-aws-credentials exports)"
+};
+//#endregion
+//#region src/providers/config.ts
+/**
+* `deploy.<kind>.<stage>`, read: what backs one kind of construct on a stage.
+*
+* Kept free of the providers themselves — of the AWS SDK and the graph — so
+* the workspace schema can check an entry with the words a deploy would use,
+* the way `checkStageTelemetry` does for `deploy.telemetry`.
+*/
+/** Each provider's config check, by kind and name. */
+const CHECKS = { objects: { s3: checkS3Config } };
+/** How each provider's provisioning credentials are supplied, by kind and name. */
+const PROVISIONING = { objects: { s3: S3_PROVISIONING } };
+/** How `name`'s provisioning credentials are supplied, for messages. */
+function provisioningOf(kind, name) {
+	return Object.hasOwn(PROVISIONING[kind], name) ? PROVISIONING[kind][name] : void 0;
+}
+/** The `provider:` names a kind accepts. */
+function providerNamesOf(kind) {
+	return Object.keys(CHECKS[kind]).sort();
+}
+/** What `deploy.<kind>.<stage>` may be, for messages. */
+function accepted(kind) {
+	return [
+		"'external'",
+		...providerNamesOf(kind).map((name) => `{ provider: '${name}' }`),
+		"false"
+	].join(", ");
+}
+/** An entry that names no provider gkm has, or is not an entry at all. */
+var UnknownStageProvider = class extends require_errors.GkmError {
+	kind;
+	stage;
+	value;
+	constructor(kind, stage, value) {
+		super(`deploy.${kind}.${stage} is ${JSON.stringify(value)}, which is not a provider gkm has for ${kind}. It takes ${accepted(kind)}.`);
+		this.kind = kind;
+		this.stage = stage;
+		this.value = value;
+		this.name = "UnknownStageProvider";
+	}
+};
+/**
+* One stage's entry checked: `'external'`, `false`, or a provider's object
+* that its own check accepts.
+*
+* @throws {UnknownStageProvider} for anything else — `'minio'` included
+*/
+function checkStageProvider(kind, stage, value) {
+	if (value === "external" || value === false) return value;
+	if (value && typeof value === "object" && !Array.isArray(value)) {
+		const name = value.provider;
+		const check = typeof name === "string" && Object.hasOwn(CHECKS[kind], name) ? CHECKS[kind][name] : void 0;
+		if (check) return check(stage, value);
+	}
+	throw new UnknownStageProvider(kind, stage, value);
+}
+/**
+* What backs `kind` on `stage`: the local stage is always `external` here —
+* `gkm dev` runs its own — and a deployed stage that names nothing is too.
+*/
+function stageProvider(workspace, kind, stage) {
+	if (stage === workspace.stages?.local) return { mode: "external" };
+	const value = workspace.deploy?.[kind]?.[stage];
+	if (value === void 0) return { mode: "external" };
+	const entry = checkStageProvider(kind, stage, value);
+	if (entry === "external") return { mode: "external" };
+	if (entry === false) return { mode: "none" };
+	return {
+		mode: "provider",
+		name: entry.provider,
+		config: entry
+	};
+}
+//#endregion
+//#region src/compose/logsConfig.ts
+/**
+* The self-hosted telemetry provider's options, read: how the stack's
+* OpenObserve is run and reached — `deploy.telemetry.<stage>` with
+* `provider: 'self-hosted'`.
+*
+* Kept apart from the stack so the workspace schema can check a config with
+* the same rules — and the same named errors — the stack applies.
+*/
+/** The port OpenObserve listens on, and the one it is published on by default. */
+const LOGS_PORT = 5080;
+/** `public` with no address to allow: nobody could reach it. */
+var LogsAllowEmpty = class extends require_errors.GkmError {
+	stage;
+	constructor(stage) {
+		super(`deploy.telemetry.${stage}.public.allow is empty, so the logs site would answer every request with 403. List the addresses that may reach it (public: { allow: ['203.0.113.7', '10.0.0.0/8'] }), or remove public and reach it through an SSH tunnel.`);
+		this.stage = stage;
+		this.name = "LogsAllowEmpty";
+	}
+};
+/** An `allow` entry that is not an IP address or a CIDR range. */
+var LogsAllowEntryInvalid = class extends require_errors.GkmError {
+	stage;
+	entry;
+	constructor(stage, entry) {
+		super(`deploy.telemetry.${stage}.public.allow has '${entry}', which is not an IP address or a CIDR range. Write one like '203.0.113.7', '10.0.0.0/8' or '2001:db8::/32'.`);
+		this.stage = stage;
+		this.entry = entry;
+		this.name = "LogsAllowEntryInvalid";
+	}
+};
+/** A retention OpenObserve would refuse to start with. */
+var LogsRetentionInvalid = class extends require_errors.GkmError {
+	stage;
+	retentionDays;
+	constructor(stage, retentionDays) {
+		super(`deploy.telemetry.${stage}.retentionDays is ${String(retentionDays)}; it must be a whole number of days, at least 3 — OpenObserve refuses to start with fewer. Leave it out for 30.`);
+		this.stage = stage;
+		this.retentionDays = retentionDays;
+		this.name = "LogsRetentionInvalid";
+	}
+};
+/** A port that is not one. */
+var LogsPortInvalid = class extends require_errors.GkmError {
+	stage;
+	port;
+	constructor(stage, port) {
+		super(`deploy.telemetry.${stage}.port is ${String(port)}; set it to a number between 1 and 65535, or leave it out for ${LOGS_PORT}.`);
+		this.stage = stage;
+		this.port = port;
+		this.name = "LogsPortInvalid";
+	}
+};
+/** Whether `entry` is an IP address, or an address and a prefix length. */
+function isAddressOrRange(entry) {
+	const [address = "", prefix, ...rest] = entry.split("/");
+	if (rest.length > 0) return false;
+	const family = (0, node_net.isIP)(address);
+	if (family === 0) return false;
+	if (prefix === void 0) return true;
+	if (!/^\d{1,3}$/.test(prefix)) return false;
+	return Number(prefix) <= (family === 4 ? 32 : 128);
+}
+/**
+* The self-hosted provider's options with their defaults — `{}` for all of
+* them. Throws the named error for the first thing wrong with them.
+*/
+function resolveSelfHosted(config, stage) {
+	const port = config.port ?? 5080;
+	if (!Number.isInteger(port) || port < 1 || port > 65535) throw new LogsPortInvalid(stage, config.port);
+	const retentionDays = config.retentionDays ?? 30;
+	if (!Number.isInteger(retentionDays) || retentionDays < 3) throw new LogsRetentionInvalid(stage, config.retentionDays);
+	if (config.public) {
+		const allow = config.public.allow ?? [];
+		if (allow.length === 0) throw new LogsAllowEmpty(stage);
+		for (const entry of allow) if (!isAddressOrRange(entry)) throw new LogsAllowEntryInvalid(stage, entry);
+		return {
+			port,
+			retentionDays,
+			public: { allow: [...allow] }
+		};
+	}
+	return {
+		port,
+		retentionDays
+	};
+}
+//#endregion
+//#region src/telemetry/config.ts
+/**
+* `deploy.telemetry`, read: where one stage's telemetry goes, and how much.
+*
+* The application says what it emits (the `Telemetry` construct). This says
+* where it is sent, per stage, and is the only place that does:
+*
+* - **self-hosted** — the target runs OpenObserve beside the apps (#189's
+*   stack service). A server target that can run it uses it when a stage
+*   names nothing.
+* - **otlp** — any OTLP/HTTP endpoint, with its headers.
+* - **false** — nothing is sent.
+*
+* Vendor presets (a known endpoint and header shape, with the stage secret
+* `TELEMETRY_CREDENTIALS`) are one more entry in {@link PROVIDERS}: a
+* resolver from the stage's config to a {@link ResolvedTelemetry}, which
+* every target already consumes through {@link telemetryEnv}.
+*
+* The local stage ignores all of it: `gkm dev` and `gkm compose` on it run
+* OpenObserve and keep every trace.
+*/
+/** A deployed stage uses telemetry and its target cannot choose for it. */
+var TelemetryProviderRequired = class extends require_errors.GkmError {
+	stage;
+	target;
+	constructor(stage, target) {
+		super(`The stage '${stage}' deploys through ${target}, which cannot run telemetry itself, and a process uses a Telemetry construct. Say where it goes in gkm.config.ts: deploy: { telemetry: { ${stage}: { provider: 'otlp', endpoint: 'https://…' } } } — or deploy: { telemetry: { ${stage}: false } } to send nothing.`);
+		this.stage = stage;
+		this.target = target;
+		this.name = "TelemetryProviderRequired";
+	}
+};
+/** A stage asks for the self-hosted provider on a target that cannot run it. */
+var SelfHostedTelemetryUnavailable = class extends require_errors.GkmError {
+	stage;
+	target;
+	constructor(stage, target) {
+		super(`deploy.telemetry.${stage} is 'self-hosted', and ${target} does not run OpenObserve beside the apps — the compose target does. Deploy '${stage}' through compose, or send its telemetry elsewhere: deploy: { telemetry: { ${stage}: { provider: 'otlp', endpoint: 'https://…' } } }.`);
+		this.stage = stage;
+		this.target = target;
+		this.name = "SelfHostedTelemetryUnavailable";
+	}
+};
+/** A sample rate that is not a fraction. */
+var TelemetrySampleRateInvalid = class extends require_errors.GkmError {
+	stage;
+	sampleRate;
+	constructor(stage, sampleRate) {
+		super(`deploy.telemetry.${stage}.sampleRate is ${String(sampleRate)}; set it to a number from 0 to 1 — the fraction of traces kept — or leave it out to keep every one.`);
+		this.stage = stage;
+		this.sampleRate = sampleRate;
+		this.name = "TelemetrySampleRateInvalid";
+	}
+};
+/** An OTLP endpoint that is not an http(s) URL. */
+var TelemetryEndpointInvalid = class extends require_errors.GkmError {
+	stage;
+	endpoint;
+	constructor(stage, endpoint) {
+		super(`deploy.telemetry.${stage}.endpoint is ${JSON.stringify(endpoint)}; set it to the collector's OTLP/HTTP base URL, like 'https://otlp.example.com' — /v1/traces and /v1/logs are added to it.`);
+		this.stage = stage;
+		this.endpoint = endpoint;
+		this.name = "TelemetryEndpointInvalid";
+	}
+};
+/** The sample rate a stage keeps, checked. */
+function sampleRateOf(stage, sampleRate) {
+	const rate = sampleRate ?? 1;
+	if (!Number.isFinite(rate) || rate < 0 || rate > 1) throw new TelemetrySampleRateInvalid(stage, sampleRate);
+	return rate;
+}
+/**
+* Each provider's resolver: a stage's config to what the targets consume.
+* A vendor preset is one more entry here.
+*/
+const PROVIDERS = {
+	"self-hosted": (config, stage) => {
+		const { provider: _, sampleRate, ...options } = config;
+		return {
+			provider: "self-hosted",
+			selfHosted: resolveSelfHosted(options, stage),
+			sampleRate: sampleRateOf(stage, sampleRate)
+		};
+	},
+	otlp: (config, stage) => {
+		if (typeof config.endpoint !== "string" || !isHttpUrl(config.endpoint)) throw new TelemetryEndpointInvalid(stage, config.endpoint);
+		return {
+			provider: "otlp",
+			endpoint: config.endpoint.replace(/\/+$/, ""),
+			headers: { ...config.headers },
+			sampleRate: sampleRateOf(stage, config.sampleRate)
+		};
+	}
+};
+function isHttpUrl(value) {
+	try {
+		const url = new URL(value);
+		return url.protocol === "http:" || url.protocol === "https:";
+	} catch {
+		return false;
+	}
+}
+/**
+* One stage's entry, checked on its own — what the workspace schema runs, so
+* a bad config fails to load with the words a deploy would fail with.
+*/
+function checkStageTelemetry(stage, config) {
+	if (config === false) return void 0;
+	const entry = config === "self-hosted" ? { provider: "self-hosted" } : config;
+	const resolve = PROVIDERS[entry.provider];
+	return resolve(entry, stage);
+}
+/**
+* Where a stage's telemetry goes, or undefined when nothing is sent — no
+* process uses a `Telemetry` node, or the stage opted out with `false`.
+*
+* The local stage always runs the self-hosted provider with its defaults and
+* keeps every trace, whatever `deploy.telemetry` says. A deployed stage that
+* names nothing gets the self-hosted provider where its target runs one, and
+* {@link TelemetryProviderRequired} where it cannot — AWS has none.
+*/
+function resolveStageTelemetry(input) {
+	const { stage } = input;
+	if (!input.used) return void 0;
+	if (input.local) return {
+		provider: "self-hosted",
+		selfHosted: resolveSelfHosted({}, stage),
+		sampleRate: 1
+	};
+	const config = input.telemetry?.[stage];
+	if (config === void 0) {
+		if (input.runtime === "server" && input.selfHosted) return checkStageTelemetry(stage, "self-hosted");
+		throw new TelemetryProviderRequired(stage, input.target);
+	}
+	const resolved = checkStageTelemetry(stage, config);
+	if (resolved?.provider === "self-hosted" && !input.selfHosted) throw new SelfHostedTelemetryUnavailable(stage, input.target);
+	return resolved;
+}
+/** The sampler every process with the edge runs, per the stage's rate. */
+const TRACES_SAMPLER = "parentbased_traceidratio";
+/**
+* `OTEL_EXPORTER_OTLP_HEADERS` for a set of headers: `key=value` pairs,
+* comma-separated, each value percent-encoded — the W3C baggage format the
+* SDK parses.
+*/
+function otlpHeaderString(headers) {
+	return Object.entries(headers).map(([key, value]) => `${key}=${encodeURIComponent(value)}`).join(",");
+}
+/**
+* The `OTEL_*` values a stage resolves for its `Telemetry` node, before any
+* one process is named: where to export, how to sign, and how much to keep.
+* `OTEL_SERVICE_NAME` is each process's own — see `scopeTelemetryEnv`.
+*/
+function telemetryEnv(destination, sampleRate) {
+	return {
+		OTEL_EXPORTER_OTLP_ENDPOINT: destination.endpoint,
+		...destination.headers ? { OTEL_EXPORTER_OTLP_HEADERS: destination.headers } : {},
+		OTEL_TRACES_SAMPLER: TRACES_SAMPLER,
+		OTEL_TRACES_SAMPLER_ARG: String(sampleRate)
+	};
+}
+/** What an `otlp` stage resolves, for every process with the edge. */
+function otlpTelemetryEnv(resolved) {
+	const headers = otlpHeaderString(resolved.headers);
+	return telemetryEnv({
+		endpoint: resolved.endpoint,
+		...headers ? { headers } : {}
+	}, resolved.sampleRate);
+}
+/**
+* The sample rate a stage's browsers trace page views at — a public value,
+* the same rate its servers sample at — or undefined when the stage sends no
+* telemetry. The local stage keeps every trace.
+*
+* Lenient where `resolveStageTelemetry` is strict: a site's client is built
+* before, and apart from, the deploy that refuses a stage with no provider.
+*/
+function stageSampleRate(telemetry, stage, local) {
+	if (local) return 1;
+	const config = telemetry?.[stage];
+	if (config === false) return void 0;
+	if (config === void 0 || config === "self-hosted") return 1;
+	return sampleRateOf(stage, config.sampleRate);
+}
+//#endregion
+//#region src/workspace/stages.ts
+/**
+* What `gkm test` runs as. The CLI's own, so no project stage may take it:
+* its containers are torn down and rebuilt between runs.
+*/
+const TEST_STAGE = "test";
+/** A stage becomes part of every physical name, so it has to fit in one. */
+const STAGE_NAME = /^[a-z][a-z0-9-]*$/;
+/** Everything wrong with one stage name, or nothing. */
+function nameProblems(name) {
+	const problems = [];
+	if (!STAGE_NAME.test(name)) problems.push(`stage "${name}" must be lowercase letters, digits and hyphens, starting with a letter`);
+	if (name === "test") problems.push(`stage "${TEST_STAGE}" is reserved for gkm test`);
+	return problems;
+}
+/** Everything wrong with a list of deployed stages on its own. */
+function deployedProblems(deployed) {
+	const problems = deployed.flatMap(nameProblems);
+	const seen = /* @__PURE__ */ new Set();
+	for (const name of deployed) {
+		if (seen.has(name)) problems.push(`stage "${name}" is listed twice`);
+		seen.add(name);
+	}
+	return problems;
+}
+/** Everything wrong with a stages block, or nothing. */
+function stageProblems(stages) {
+	if (!stages) return ["`stages` is required, e.g. stages: { local: 'dev', deployed: ['prod'] }"];
+	const { local, deployed, protected: kept = [] } = stages;
+	const problems = [...nameProblems(local), ...deployedProblems(deployed)];
+	if (deployed.includes(local)) problems.push(`"${local}" is both the local stage and a deployed one; they would share secrets`);
+	for (const name of kept) if (!deployed.includes(name)) problems.push(`protected stage "${name}" is not a deployed stage`);
+	return problems;
+}
+/** The stages block, or an error naming everything wrong with it. */
+function validateStages(stages) {
+	const problems = stageProblems(stages);
+	if (problems.length) throw new InvalidStages(problems);
+	return stages;
+}
+/** Refuses a stage the project does not deploy to. */
+function assertDeployedStage(stages, stage) {
+	if (!stages.deployed.includes(stage)) throw new UndeclaredStage(stage, stages.deployed);
+}
+/** A stages block — in gkm.config.ts or from `gkm init`'s flags — that breaks a rule. */
+var InvalidStages = class extends require_errors.GkmError {
+	problems;
+	constructor(problems) {
+		super(`Invalid stages:\n  ${problems.join("\n  ")}`);
+		this.problems = problems;
+		this.name = "InvalidStages";
+	}
+};
+/**
+* A stage the project does not deploy to. Refused before anything is
+* provisioned, so a typo does not become a second environment.
+*/
+var UndeclaredStage = class extends require_errors.GkmError {
+	stage;
+	deployed;
+	constructor(stage, deployed) {
+		super(`"${stage}" is not a deployed stage. gkm.config.ts deploys to: ${deployed.join(", ") || "nothing yet"}.`);
+		this.stage = stage;
+		this.deployed = deployed;
+		this.name = "UndeclaredStage";
+	}
+};
+/**
+* A per-stage setting keyed by a stage the workspace does not deploy: a typo,
+* a stage since removed, or the local stage, which none of them apply to.
+*/
+var UnknownStageKey = class extends require_errors.GkmError {
+	setting;
+	stage;
+	deployed;
+	local;
+	constructor(setting, stage, deployed, local) {
+		super(`${setting} names the stage '${stage}', ` + (stage === local ? `the local stage — ${setting} is read for deployed stages only. ` : "which is not one of this workspace's deployed stages. ") + `It takes ${deployed.length > 0 ? deployed.map((s) => `'${s}'`).join(", ") : "no stage: stages.deployed is empty"} — the stages in stages.deployed.`);
+		this.setting = setting;
+		this.stage = stage;
+		this.deployed = deployed;
+		this.local = local;
+		this.name = "UnknownStageKey";
+	}
+};
+/**
+* The first key of a per-stage map that is not a deployed stage.
+*
+* @throws {UnknownStageKey}
+*/
+function assertDeployedStageKeys(setting, map, stages) {
+	if (!map || !stages?.deployed) return;
+	for (const key of Object.keys(map)) if (!stages.deployed.includes(key)) throw new UnknownStageKey(setting, key, stages.deployed, stages.local);
+}
+//#endregion
+//#region src/workspace/schema.ts
+/** Routes are a glob, or a list of them. */
+const RoutesSchema = require_schemas.union([require_schemas.string(), require_schemas.array(require_schemas.string())]);
+/**
+* Telescope configuration schema.
+*/
+const TelescopeConfigSchema = require_schemas.object({
+	enabled: require_schemas.boolean().optional(),
+	port: require_schemas.number().optional(),
+	path: require_schemas.string().optional(),
+	ignore: require_schemas.array(require_schemas.string()).optional(),
+	recordBody: require_schemas.boolean().optional(),
+	maxEntries: require_schemas.number().optional(),
+	websocket: require_schemas.boolean().optional()
+});
+/**
+* OpenAPI configuration schema.
+*/
+const OpenApiConfigSchema = require_schemas.object({
+	enabled: require_schemas.boolean().optional(),
+	title: require_schemas.string().optional(),
+	version: require_schemas.string().optional(),
+	description: require_schemas.string().optional()
+});
+/**
+* Hooks configuration schema.
+*/
+const HooksConfigSchema = require_schemas.object({ server: require_schemas.string().optional() });
+/**
+* Backend framework schema for non-gkm apps.
+*/
+const BackendFrameworkSchema = require_schemas._enum([
+	"hono",
+	"better-auth",
+	"express",
+	"fastify"
+]);
+/**
+* Frontend framework schema.
+*/
+const FrontendFrameworkSchema = require_schemas._enum([
+	"nextjs",
+	"remix",
+	"vite",
+	"tanstack-start"
+]);
+/**
+* Mobile framework schema.
+*/
+const MobileFrameworkSchema = require_schemas._enum(["expo"]);
+/**
+* Combined framework schema (backend, frontend, or mobile).
+*/
+const FrameworkSchema = require_schemas.union([
+	BackendFrameworkSchema,
+	FrontendFrameworkSchema,
+	MobileFrameworkSchema
+]);
+/** Frontend framework values, kept in sync with FrontendFrameworkSchema. */
+const FRONTEND_FRAMEWORKS = [
+	"nextjs",
+	"remix",
+	"vite",
+	"tanstack-start"
+];
+/** Mobile framework values, kept in sync with MobileFrameworkSchema. */
+const MOBILE_FRAMEWORKS = ["expo"];
+/**
+* A deploy target's name. Which names exist is the workspace's to say — the
+* built-ins and its own `deploy.targets` — so it is checked against both
+* once the whole config is read.
+*/
+const DeployTargetSchema = require_schemas.string().min(1);
+/**
+* The built-in targets a config may name, both deployed by `gkm deploy`:
+* `dokploy`, and `sst`, which runs `sst deploy` on the manifest `gkm build`
+* writes.
+*/
+const SUPPORTED_DEPLOY_TARGETS = require_define.configurableBuiltins();
+/** Built-in names reserved for targets that do not exist yet. */
+const PHASE_2_DEPLOY_TARGETS = Object.entries(require_define.BUILTIN_TARGETS).filter(([, target]) => target.status === "planned").map(([name]) => name);
+/**
+* Whether a config may name `target`: a usable built-in, or one of its own
+* `deploy.targets`.
+*/
+function isDeployTargetSupported(target, targets = {}) {
+	return SUPPORTED_DEPLOY_TARGETS.includes(target) || Object.hasOwn(targets, target);
+}
+/**
+* Check if a deploy target is planned for Phase 2.
+*/
+function isPhase2DeployTarget(target) {
+	return PHASE_2_DEPLOY_TARGETS.includes(target);
+}
+/**
+* Get error message for unsupported deploy targets.
+*/
+function getDeployTargetError(target, appName) {
+	if (isPhase2DeployTarget(target)) return `Deploy target "${target}"${appName ? ` for app "${appName}"` : ""} is coming in Phase 2. Currently "dokploy" and "sst" are supported.`;
+	return `Unknown deploy target: ${target}. Built in: ${SUPPORTED_DEPLOY_TARGETS.join(", ")}; any other is named in deploy.targets with the package that provides it. Coming in Phase 2: ${PHASE_2_DEPLOY_TARGETS.join(", ")}.`;
+}
+/**
+* One `deploy.targets` entry: a package name, a target object, or either
+* with options.
+*/
+const DeployTargetEntrySchema = require_schemas.union([
+	require_schemas.string().min(1, "A target package name cannot be empty"),
+	require_schemas.custom((value) => require_define.isDeployTarget(value), { message: "Expected a package name, a target (defineTarget), or [package or target, options]" }),
+	require_schemas.tuple([require_schemas.union([require_schemas.string().min(1), require_schemas.custom((value) => require_define.isDeployTarget(value), { message: "Expected a package name or a target (defineTarget)" })]), require_schemas.unknown()])
+]);
+/**
+* Dokploy workspace configuration schema.
+* Supports either a single endpoint or per-stage endpoints.
+*/
+const DokployWorkspaceConfigSchema = require_schemas.object({
+	/** Single endpoint for all stages */
+	endpoint: require_schemas.url("Dokploy endpoint must be a valid URL").optional(),
+	/** Per-stage endpoints (stage name -> endpoint URL) */
+	endpoints: require_schemas.record(require_schemas.string(), require_schemas.url("Endpoint must be a valid URL")).optional(),
+	registryId: require_schemas.string().optional(),
+	/** Dokploy's own backup destination for the stage's Postgres. */
+	backups: require_schemas.lazy(() => DokployBackupsConfigSchema).optional(),
+	verify: require_schemas.object({
+		deploymentTimeoutMs: require_schemas.number().int().positive().optional(),
+		healthCheckPath: require_schemas.string().startsWith("/", "healthCheckPath must start with /").optional(),
+		healthyAfter: require_schemas.number().int().positive().optional(),
+		intervalMs: require_schemas.number().int().positive().optional(),
+		healthTimeoutMs: require_schemas.number().int().positive().optional()
+	}).optional()
+}).refine((data) => data.endpoint || data.endpoints, { message: "Either endpoint or endpoints must be provided" });
+/**
+* Valid AWS regions.
+*/
+const AwsRegionSchema = require_schemas._enum([
+	"us-east-1",
+	"us-east-2",
+	"us-west-1",
+	"us-west-2",
+	"af-south-1",
+	"ap-east-1",
+	"ap-south-1",
+	"ap-south-2",
+	"ap-southeast-1",
+	"ap-southeast-2",
+	"ap-southeast-3",
+	"ap-southeast-4",
+	"ap-northeast-1",
+	"ap-northeast-2",
+	"ap-northeast-3",
+	"ca-central-1",
+	"eu-central-1",
+	"eu-central-2",
+	"eu-west-1",
+	"eu-west-2",
+	"eu-west-3",
+	"eu-south-1",
+	"eu-south-2",
+	"eu-north-1",
+	"me-south-1",
+	"me-central-1",
+	"sa-east-1"
+]);
+/**
+* DNS record types supported across providers.
+*/
+const DnsRecordTypeSchema = require_schemas._enum([
+	"A",
+	"AAAA",
+	"CNAME",
+	"MX",
+	"TXT",
+	"NS",
+	"SRV",
+	"CAA"
+]);
+require_schemas.object({
+	/** Subdomain name (e.g., 'api' for api.example.com, '@' for root) */
+	name: require_schemas.string(),
+	/** Record type */
+	type: DnsRecordTypeSchema,
+	/** TTL in seconds */
+	ttl: require_schemas.number().int().positive(),
+	/** Record values */
+	values: require_schemas.array(require_schemas.string())
+});
+/**
+* A DNS record to create or update.
+*/
+const UpsertDnsRecordSchema = require_schemas.object({
+	/** Subdomain name (e.g., 'api' for api.example.com, '@' for root) */
+	name: require_schemas.string(),
+	/** Record type */
+	type: DnsRecordTypeSchema,
+	/** TTL in seconds */
+	ttl: require_schemas.number().int().positive(),
+	/** Record value (IP address, hostname, etc.) */
+	value: require_schemas.string()
+});
+require_schemas.object({
+	/** The record that was upserted */
+	record: UpsertDnsRecordSchema,
+	/** Whether the record was created (true) or updated (false) */
+	created: require_schemas.boolean(),
+	/** Whether the record already existed with the same value */
+	unchanged: require_schemas.boolean()
+});
+/**
+* How a domain's hosts point at a compose stage's server: an A (and AAAA)
+* record each (`'a'`, the default), or one A record for `target` and a CNAME
+* to it for every other host but the apex. `target` is one name, or one per
+* stage; it must be under the domain.
+*/
+const DnsRecordsModeSchema = require_schemas.union([require_schemas.literal("a"), require_schemas.object({
+	mode: require_schemas.literal("cname"),
+	target: require_schemas.union([require_schemas.string(), require_schemas.record(require_schemas.string(), require_schemas.string())])
+}).strict()]);
+/**
+* Hostinger DNS provider config (without domain - domain is the record key).
+*/
+const HostingerDnsProviderSchema = require_schemas.object({
+	provider: require_schemas.literal("hostinger"),
+	/** How the hosts point at a compose stage's server — see {@link DnsRecordsModeSchema}. */
+	records: DnsRecordsModeSchema.optional(),
+	/** TTL in seconds (default: 300) */
+	ttl: require_schemas.number().int().positive().optional()
+});
+/**
+* Route53 DNS provider config (without domain - domain is the record key).
+*/
+const Route53DnsProviderSchema = require_schemas.object({
+	provider: require_schemas.literal("route53"),
+	/** How the hosts point at a compose stage's server — see {@link DnsRecordsModeSchema}. */
+	records: DnsRecordsModeSchema.optional(),
+	/** AWS region (optional - uses AWS_REGION env var if not provided) */
+	region: AwsRegionSchema.optional(),
+	/** AWS profile name (optional - uses default credential chain if not provided) */
+	profile: require_schemas.string().optional(),
+	/** Hosted zone ID (optional - auto-detected from domain if not provided) */
+	hostedZoneId: require_schemas.string().optional(),
+	/** TTL in seconds (default: 300) */
+	ttl: require_schemas.number().int().positive().optional()
+});
+/**
+* GoDaddy DNS provider config (without domain - domain is the record key).
+*
+* Credentials: `GODADDY_API_TOKEN` (a Personal Access Token scoped to
+* `domains.dns:update`), else `gkm login --provider godaddy`. GoDaddy refuses
+* a TTL under 600 seconds.
+*/
+const GoDaddyDnsProviderSchema = require_schemas.object({
+	provider: require_schemas.literal("godaddy"),
+	/** How the hosts point at a compose stage's server — see {@link DnsRecordsModeSchema}. */
+	records: DnsRecordsModeSchema.optional(),
+	/** TTL in seconds (default and minimum: 600) */
+	ttl: require_schemas.number().int().min(600, "GoDaddy's minimum TTL is 600 seconds").optional()
+});
+/**
+* Cloudflare DNS provider config (placeholder for future).
+*/
+const CloudflareDnsProviderSchema = require_schemas.object({
+	provider: require_schemas.literal("cloudflare"),
+	/** How the hosts point at a compose stage's server — see {@link DnsRecordsModeSchema}. */
+	records: DnsRecordsModeSchema.optional(),
+	/** TTL in seconds (default: 300) */
+	ttl: require_schemas.number().int().positive().optional()
+});
+/**
+* Manual DNS configuration (user handles DNS themselves).
+*/
+const ManualDnsProviderSchema = require_schemas.object({
+	provider: require_schemas.literal("manual"),
+	/** How the hosts point at a compose stage's server — see {@link DnsRecordsModeSchema}. */
+	records: DnsRecordsModeSchema.optional()
+});
+/**
+* Custom DNS provider config (user-provided implementation).
+*/
+const CustomDnsProviderSchema = require_schemas.object({
+	/** Custom DnsProvider implementation */
+	provider: require_schemas.custom((val) => typeof val === "object" && val !== null && typeof val.name === "string" && typeof val.getRecords === "function" && typeof val.upsertRecords === "function", { message: "Custom DNS provider must implement name, getRecords(), and upsertRecords() methods" }),
+	/** How the hosts point at a compose stage's server — see {@link DnsRecordsModeSchema}. */
+	records: DnsRecordsModeSchema.optional(),
+	/** TTL in seconds (default: 300) */
+	ttl: require_schemas.number().int().positive().optional()
+});
+/**
+* Built-in DNS provider config (discriminated union).
+*/
+const BuiltInDnsProviderSchema = require_schemas.discriminatedUnion("provider", [
+	HostingerDnsProviderSchema,
+	Route53DnsProviderSchema,
+	GoDaddyDnsProviderSchema,
+	CloudflareDnsProviderSchema,
+	ManualDnsProviderSchema
+]);
+/**
+* Single DNS provider config (for one domain).
+*/
+const DnsProviderSchema = require_schemas.union([BuiltInDnsProviderSchema, CustomDnsProviderSchema]);
+/**
+* DNS configuration schema.
+*
+* Maps root domains to their DNS provider configuration.
+* Example:
+* ```
+* dns: {
+*   'geekmidas.dev': { provider: 'hostinger' },
+*   'geekmidas.com': { provider: 'route53' },
+* }
+* ```
+*
+* Supported providers:
+* - 'hostinger': Use Hostinger DNS API
+* - 'route53': Use AWS Route53
+* - 'godaddy': Use GoDaddy's v1 DNS API
+* - 'cloudflare': Use Cloudflare DNS API (future)
+* - 'manual': Don't create records, just print required records
+* - Custom: Provide a DnsProvider implementation
+*/
+const DnsConfigSchema = require_schemas.record(require_schemas.string(), DnsProviderSchema);
+const HostingerDnsConfigSchema = HostingerDnsProviderSchema.extend({ domain: require_schemas.string().min(1, "Domain is required") });
+const Route53DnsConfigSchema = Route53DnsProviderSchema.extend({ domain: require_schemas.string().min(1, "Domain is required") });
+const GoDaddyDnsConfigSchema = GoDaddyDnsProviderSchema.extend({ domain: require_schemas.string().min(1, "Domain is required") });
+const CloudflareDnsConfigSchema = CloudflareDnsProviderSchema.extend({ domain: require_schemas.string().min(1, "Domain is required") });
+const ManualDnsConfigSchema = ManualDnsProviderSchema.extend({ domain: require_schemas.string().min(1, "Domain is required") });
+const CustomDnsConfigSchema = CustomDnsProviderSchema.extend({ domain: require_schemas.string().min(1, "Domain is required") });
+const BuiltInDnsConfigSchema = require_schemas.discriminatedUnion("provider", [
+	HostingerDnsConfigSchema,
+	Route53DnsConfigSchema,
+	GoDaddyDnsConfigSchema,
+	CloudflareDnsConfigSchema,
+	ManualDnsConfigSchema
+]);
+const LegacyDnsConfigSchema = require_schemas.union([BuiltInDnsConfigSchema, CustomDnsConfigSchema]);
+require_schemas.union([DnsConfigSchema, LegacyDnsConfigSchema]);
+/**
+* Backups configuration schema.
+*
+* Configures automatic backup destinations for database services.
+* On first deploy, creates S3 bucket with unique name and IAM credentials.
+*/
+const DokployBackupsConfigSchema = require_schemas.object({
+	/** Backup storage type (currently only 's3' supported) */
+	type: require_schemas.literal("s3"),
+	/** AWS profile name for creating bucket/IAM resources */
+	profile: require_schemas.string().optional(),
+	/** AWS region for the backup bucket */
+	region: AwsRegionSchema,
+	/** Cron schedule for backups (default: '0 2 * * *' = 2 AM daily) */
+	schedule: require_schemas.string().optional(),
+	/** Number of backups to retain (default: 30) */
+	retention: require_schemas.number().optional()
+});
+/**
+* `deploy.backups` — when each deployed compose stage's databases are backed
+* up, and how long a backup is kept. The rules are `checkStageBackups`', so
+* the schema and a deploy refuse the same entries with the same words.
+*/
+const BackupsConfigSchema = require_schemas.record(require_schemas.string(), require_schemas.unknown()).superRefine((entries, ctx) => {
+	for (const [stage, value] of Object.entries(entries)) try {
+		checkStageBackups(stage, value);
+	} catch (error) {
+		ctx.addIssue({
+			code: "custom",
+			message: error instanceof Error ? error.message : String(error),
+			path: [stage]
+		});
+	}
+});
+/** `deploy.compose` — what the compose target runs beside the apps. */
+const ComposeWorkspaceConfigSchema = require_schemas.object({
+	proxy: require_schemas.union([require_schemas._enum(["caddy", "traefik"]), require_schemas.record(require_schemas.string(), require_schemas._enum(["caddy", "traefik"]))]).optional(),
+	tls: require_schemas.record(require_schemas.string(), require_schemas.object({
+		certFile: require_schemas.string().min(1),
+		keyFile: require_schemas.string().min(1)
+	}).strict()).optional(),
+	server: require_schemas.record(require_schemas.string(), require_schemas.object({
+		user: require_schemas.string().min(1),
+		host: require_schemas.string().min(1).optional(),
+		port: require_schemas.number().int().min(1).max(65535).optional()
+	}).strict()).optional()
+}).strict();
+const TelemetrySampleRate = require_schemas.number().optional();
+/**
+* `deploy.telemetry` — where each stage's telemetry goes. The rules past the
+* shape are `checkStageTelemetry`'s, so the schema and a deploy refuse the
+* same configs with the same words.
+*/
+const TelemetryConfigSchema = require_schemas.record(require_schemas.string(), require_schemas.union([
+	require_schemas.literal(false),
+	require_schemas.literal("self-hosted"),
+	require_schemas.object({
+		provider: require_schemas.literal("self-hosted"),
+		port: require_schemas.number().optional(),
+		retentionDays: require_schemas.number().optional(),
+		public: require_schemas.object({ allow: require_schemas.array(require_schemas.string()) }).optional(),
+		sampleRate: TelemetrySampleRate
+	}).strict(),
+	require_schemas.object({
+		provider: require_schemas.literal("otlp"),
+		endpoint: require_schemas.string(),
+		headers: require_schemas.record(require_schemas.string(), require_schemas.string()).optional(),
+		sampleRate: TelemetrySampleRate
+	}).strict()
+])).superRefine((telemetry, ctx) => {
+	for (const [stage, config] of Object.entries(telemetry)) try {
+		checkStageTelemetry(stage, config);
+	} catch (error) {
+		ctx.addIssue({
+			code: "custom",
+			message: error instanceof Error ? error.message : String(error),
+			path: [stage]
+		});
+	}
+});
+/**
+* `deploy.objects` — what backs each deployed stage's buckets. The rules are
+* `checkStageProvider`'s, so the schema and a provision run refuse the same
+* entries with the same words.
+*/
+const ObjectsConfigSchema = require_schemas.record(require_schemas.string(), require_schemas.unknown()).superRefine((entries, ctx) => {
+	for (const [stage, value] of Object.entries(entries)) try {
+		checkStageProvider("objects", stage, value);
+	} catch (error) {
+		ctx.addIssue({
+			code: "custom",
+			message: error instanceof Error ? error.message : String(error),
+			path: [stage]
+		});
+	}
+});
+/**
+* Deploy configuration schema.
+*/
+const DeployConfigSchema = require_schemas.object({
+	default: DeployTargetSchema.optional(),
+	targets: require_schemas.record(require_schemas.string(), DeployTargetEntrySchema).superRefine((targets, ctx) => {
+		for (const name of Object.keys(targets)) if (require_define.builtinTarget(name)) ctx.addIssue({
+			code: "custom",
+			message: `"${name}" is a built-in target; give this one a name of its own`,
+			path: [name]
+		});
+	}).optional(),
+	/** Whose deploy this is, on a target shared with other workspaces. */
+	namespace: require_schemas.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "deploy.namespace must be lowercase letters and digits with single '-' between them").optional(),
+	/** Where every target pushes and pulls the apps' images. */
+	registry: require_schemas.string().min(1).optional(),
+	dokploy: DokployWorkspaceConfigSchema.optional(),
+	compose: ComposeWorkspaceConfigSchema.optional(),
+	telemetry: TelemetryConfigSchema.optional(),
+	objects: ObjectsConfigSchema.optional(),
+	backups: BackupsConfigSchema.optional()
+});
+/**
+* Models configuration schema.
+*/
+const ModelsConfigSchema = require_schemas.object({
+	path: require_schemas.string().optional(),
+	schema: require_schemas._enum(["zod"]).optional()
+});
+/**
+* Shared configuration schema.
+*/
+const SharedConfigSchema = require_schemas.object({
+	packages: require_schemas.array(require_schemas.string()).optional(),
+	models: ModelsConfigSchema.optional()
+});
+/**
+* Secrets configuration schema.
+*/
+const StagesConfigSchema = require_schemas.object({
+	local: require_schemas.string(),
+	deployed: require_schemas.array(require_schemas.string()),
+	protected: require_schemas.array(require_schemas.string()).optional()
+}).superRefine((stages, ctx) => {
+	for (const message of stageProblems(stages)) ctx.addIssue({
+		code: "custom",
+		message
+	});
+});
+const SecretsStoreSchema = require_schemas.union([
+	require_schemas.literal("file"),
+	require_schemas.object({
+		provider: require_schemas.literal("s3"),
+		/** A bucket that exists; omitted, the project bucket. */
+		bucket: require_schemas.string().min(1).optional(),
+		/** Omitted, the S3 deploy state's region. */
+		region: AwsRegionSchema.optional(),
+		/** Omitted, the S3 deploy state's prefix, else 'gkm'. */
+		prefix: require_schemas.string().optional()
+	}).strict(),
+	require_schemas.object({
+		provider: require_schemas.literal("ssm"),
+		region: AwsRegionSchema
+	}).strict(),
+	require_schemas.object({
+		provider: require_schemas.literal("secrets-manager"),
+		region: AwsRegionSchema,
+		kmsKeyId: require_schemas.string().min(1).optional()
+	}).strict(),
+	require_schemas.object({ 
+	/** Any backend: an object implementing SecretsStore */
+provider: require_schemas.custom((val) => typeof val === "object" && val !== null && typeof val.name === "string" && typeof val.read === "function" && typeof val.write === "function", { message: "a secrets store has a name, read() and write()" }) })
+]);
+const SecretsConfigSchema = require_schemas.object({
+	enabled: require_schemas.boolean().optional(),
+	store: SecretsStoreSchema.optional(),
+	algorithm: require_schemas.string().optional(),
+	kdf: require_schemas._enum(["scrypt", "pbkdf2"]).optional()
+});
+/**
+* Local state provider config.
+*/
+const LocalStateConfigSchema = require_schemas.object({ provider: require_schemas.literal("local") });
+/**
+* SSM state provider config (requires region).
+*/
+const SSMStateConfigSchema = require_schemas.object({
+	provider: require_schemas.literal("ssm"),
+	/** AWS region (required for SSM provider) */
+	region: AwsRegionSchema,
+	/** AWS profile name (optional - uses default credential chain if not provided) */
+	profile: require_schemas.string().optional()
+});
+/**
+* S3 state provider config: conditional writes and a lock object in a bucket.
+*/
+const S3StateConfigSchema = require_schemas.object({
+	provider: require_schemas.literal("s3"),
+	/**
+	* Bucket the state lives in (must already exist). Omitted, the project
+	* bucket, created by the first deploy.
+	*/
+	bucket: require_schemas.string().min(1).optional(),
+	/** AWS region of the bucket */
+	region: AwsRegionSchema,
+	/** Key prefix inside the bucket (default: 'gkm') */
+	prefix: require_schemas.string().optional(),
+	/** AWS profile name (optional - uses default credential chain if not provided) */
+	profile: require_schemas.string().optional()
+});
+/**
+* Custom state provider config (user-provided implementation).
+*/
+const CustomStateConfigSchema = require_schemas.object({ 
+/** Custom StateProvider implementation */
+provider: require_schemas.custom((val) => typeof val === "object" && val !== null && typeof val.read === "function" && typeof val.write === "function", { message: "Custom provider must implement read() and write() methods" }) });
+/**
+* Built-in state provider config (discriminated union).
+*/
+const BuiltInStateConfigSchema = require_schemas.discriminatedUnion("provider", [
+	LocalStateConfigSchema,
+	SSMStateConfigSchema,
+	S3StateConfigSchema
+]);
+/**
+* State configuration schema.
+*
+* Configures how deployment state is stored.
+* - 'local': Store in .gkm/deploy-{stage}.json (default)
+* - 'ssm': Store in AWS SSM Parameter Store (requires region)
+* - 's3': Store in an S3 bucket with conditional writes (requires region; the
+*   project bucket is created when no bucket is named)
+* - Custom: Provide a StateStore, or a StateProvider with read/write methods
+*/
+const StateConfigSchema = require_schemas.union([BuiltInStateConfigSchema, CustomStateConfigSchema]);
+/**
+* App configuration schema.
+*/
+const AppConfigSchema = require_schemas.object({
+	type: require_schemas._enum([
+		"backend",
+		"web",
+		"mobile"
+	]).optional().default("backend"),
+	path: require_schemas.string().min(1, "App path is required"),
+	port: require_schemas.number().int().positive("Port must be a positive integer"),
+	dependencies: require_schemas.array(require_schemas.string()).optional(),
+	deploy: DeployTargetSchema.optional(),
+	constructs: RoutesSchema.optional(),
+	routes: RoutesSchema.optional(),
+	functions: RoutesSchema.optional(),
+	crons: RoutesSchema.optional(),
+	queues: RoutesSchema.optional(),
+	topics: RoutesSchema.optional(),
+	subscribers: RoutesSchema.optional(),
+	envParser: require_schemas.string().optional(),
+	logger: require_schemas.string().optional(),
+	hooks: HooksConfigSchema.optional(),
+	telescope: require_schemas.union([
+		require_schemas.string(),
+		require_schemas.boolean(),
+		TelescopeConfigSchema
+	]).optional(),
+	openapi: require_schemas.union([require_schemas.boolean(), OpenApiConfigSchema]).optional(),
+	runtime: require_schemas._enum(["node", "bun"]).optional(),
+	env: require_schemas.union([require_schemas.string(), require_schemas.array(require_schemas.string())]).optional(),
+	entry: require_schemas.string().optional(),
+	framework: FrameworkSchema.optional(),
+	config: require_schemas.object({
+		client: require_schemas.string().optional(),
+		server: require_schemas.string().optional()
+	}).optional()
+}).refine((data) => {
+	if (data.type === "web") {
+		if (!data.framework || !FRONTEND_FRAMEWORKS.includes(data.framework)) return false;
+	}
+	return true;
+}, {
+	message: `Web apps must have a valid web framework (${FRONTEND_FRAMEWORKS.join(", ")})`,
+	path: ["framework"]
+}).refine((data) => {
+	if (data.type === "mobile") {
+		if (!data.framework || !MOBILE_FRAMEWORKS.includes(data.framework)) return false;
+	}
+	return true;
+}, {
+	message: `Mobile apps must have a valid mobile framework (${MOBILE_FRAMEWORKS.join(", ")})`,
+	path: ["framework"]
+});
+/** What `gkm test` hands a feature test. */
+const TestConfigSchema = require_schemas.object({ 
+/** The folder of per-database factories; `test/factories` by default. */
+factories: require_schemas.string().optional() }).strict();
+/** How `gkm dev` is reached from outside the apps it runs. */
+const DevConfigSchema = require_schemas.object({
+	/** Browser origins that may read the discovery endpoint. */
+	allowedOrigins: require_schemas.array(require_schemas.url().refine((value) => URL.canParse(value) && new URL(value).origin === value, { message: "An origin is a scheme, host and port only, e.g. https://console.example.com — no path or trailing slash" })).optional(),
+	/** The discovery endpoint's loopback port; 4983 by default. */
+	discoveryPort: require_schemas.number().int().min(0).max(65535).optional()
+}).strict();
+/**
+* Workspace configuration schema.
+*/
+const WorkspaceConfigSchema = require_schemas.object({
+	name: require_schemas.string().optional(),
+	/**
+	* Where the workspace's own constructs live, relative to its root.
+	*
+	* Infrastructure is a fact about the product, not about the process that
+	* happens to import it — so a database two apps share is declared once,
+	* at the top, and both find it. An app-level glob still works and is
+	* additive, for something only one app uses.
+	*/
+	constructs: RoutesSchema.optional(),
+	/**
+	* Apps that nothing declares.
+	*
+	* Optional, and normally absent: a `site` is an app and so is a
+	* `rest-api` that named one, so the list is read off the graph. This is
+	* the escape hatch for what no construct describes — a mobile app, a
+	* process someone runs by hand — and for overriding one field of a
+	* derived app without restating it.
+	*/
+	apps: require_schemas.record(require_schemas.string(), AppConfigSchema).optional(),
+	shared: SharedConfigSchema.optional(),
+	/** Each deployed stage's base domain (stage name -> domain). */
+	domains: require_schemas.record(require_schemas.string(), require_schemas.string()).optional(),
+	/** Each root domain's DNS provider, and how its hosts are pointed. */
+	dns: DnsConfigSchema.optional(),
+	deploy: DeployConfigSchema.optional(),
+	stages: StagesConfigSchema,
+	secrets: SecretsConfigSchema.optional(),
+	state: StateConfigSchema.optional(),
+	test: TestConfigSchema.optional(),
+	dev: DevConfigSchema.optional()
+}).strict().refine((data) => {
+	const appNames = Object.keys(data.apps ?? {});
+	for (const [appName, app] of Object.entries(data.apps ?? {})) for (const dep of app.dependencies ?? []) {
+		if (!appNames.includes(dep)) return false;
+		if (dep === appName) return false;
+	}
+	return true;
+}, { message: "App dependencies must reference existing apps and cannot be self-referential" }).refine((data) => {
+	const appNames = Object.keys(data.apps ?? {});
+	const visited = /* @__PURE__ */ new Set();
+	const recStack = /* @__PURE__ */ new Set();
+	function hasCycle(app) {
+		if (recStack.has(app)) return true;
+		if (visited.has(app)) return false;
+		visited.add(app);
+		recStack.add(app);
+		const deps = data.apps?.[app]?.dependencies ?? [];
+		for (const dep of deps) if (hasCycle(dep)) return true;
+		recStack.delete(app);
+		return false;
+	}
+	for (const app of appNames) {
+		visited.clear();
+		recStack.clear();
+		if (hasCycle(app)) return false;
+	}
+	return true;
+}, { message: "Circular dependencies detected between apps" }).superRefine((data, ctx) => {
+	const defaultTarget = data.deploy?.default;
+	const ownTargets = data.deploy?.targets ?? {};
+	if (defaultTarget && !isDeployTargetSupported(defaultTarget, ownTargets)) {
+		ctx.addIssue({
+			code: "custom",
+			message: getDeployTargetError(defaultTarget),
+			path: ["deploy", "default"]
+		});
+		return;
+	}
+	for (const [appName, app] of Object.entries(data.apps ?? {})) if (app.deploy && !isDeployTargetSupported(app.deploy, ownTargets)) {
+		ctx.addIssue({
+			code: "custom",
+			message: getDeployTargetError(app.deploy, appName),
+			path: [
+				"apps",
+				appName,
+				"deploy"
+			]
+		});
+		return;
+	}
+	const store = data.secrets?.store;
+	if (typeof store === "object" && store.provider === "s3") try {
+		s3SecretsLocation(store, data.state);
+	} catch (error) {
+		ctx.addIssue({
+			code: "custom",
+			message: error instanceof Error ? error.message : String(error),
+			path: ["secrets", "store"]
+		});
+	}
+	try {
+		checkComposeStages(data.deploy?.compose, data.stages);
+	} catch (error) {
+		ctx.addIssue({
+			code: "custom",
+			message: error instanceof Error ? error.message : String(error),
+			path: ["deploy", "compose"]
+		});
+	}
+	const perStage = [
+		[
+			"domains",
+			["domains"],
+			data.domains
+		],
+		[
+			"deploy.objects",
+			["deploy", "objects"],
+			data.deploy?.objects
+		],
+		[
+			"deploy.backups",
+			["deploy", "backups"],
+			data.deploy?.backups
+		],
+		[
+			"deploy.telemetry",
+			["deploy", "telemetry"],
+			data.deploy?.telemetry
+		],
+		...Object.entries(data.dns ?? {}).map(([domain, entry]) => {
+			const records = entry.records;
+			const target = records && typeof records === "object" ? records.target : void 0;
+			return [
+				`dns['${domain}'].records.target`,
+				[
+					"dns",
+					domain,
+					"records",
+					"target"
+				],
+				target && typeof target === "object" ? target : void 0
+			];
+		})
+	];
+	for (const [setting, path, map] of perStage) try {
+		assertDeployedStageKeys(setting, map, data.stages);
+	} catch (error) {
+		ctx.addIssue({
+			code: "custom",
+			message: error instanceof Error ? error.message : String(error),
+			path
+		});
+	}
+	for (const [domain, entry] of Object.entries(data.dns ?? {})) try {
+		checkDnsRecordsMode(domain, entry.records);
+	} catch (error) {
+		ctx.addIssue({
+			code: "custom",
+			message: error instanceof Error ? error.message : String(error),
+			path: [
+				"dns",
+				domain,
+				"records"
+			]
+		});
+	}
+	if (data.state?.provider === "ssm" && !data.name) ctx.addIssue({
+		code: "custom",
+		message: "Workspace name is required when using SSM state provider. Add \"name\" to your gkm.config.ts.",
+		path: ["name"]
+	});
+});
+/**
+* Validate workspace configuration.
+* Throws ZodError with detailed messages on validation failure.
+*/
+function validateWorkspaceConfig(config) {
+	return WorkspaceConfigSchema.parse(config);
+}
+/**
+* Safe validation that returns result instead of throwing.
+*/
+function safeValidateWorkspaceConfig(config) {
+	const result = WorkspaceConfigSchema.safeParse(config);
+	if (result.success) return {
+		success: true,
+		data: result.data
+	};
+	return {
+		success: false,
+		error: result.error
+	};
+}
+/**
+* Format Zod errors into user-friendly messages.
+*/
+function formatValidationErrors(error) {
+	return `Workspace configuration validation failed:\n${error.issues.map((issue) => {
+		const path = issue.path.join(".");
+		return path ? `  - ${path}: ${issue.message}` : `  - ${issue.message}`;
+	}).join("\n")}`;
+}
+//#endregion
+//#region src/workspace/types.ts
+/**
+* Type guard to check if a config is a WorkspaceConfig.
+*
+* @example
+* ```ts
+* const config = await loadConfig();
+* if (isWorkspaceConfig(config)) {
+*   // config.apps is available
+*   console.log(Object.keys(config.apps));
+* }
+* ```
+*/
+function isWorkspaceConfig(config) {
+	if (typeof config !== "object" || config === null) return false;
+	if ("apps" in config && typeof config.apps === "object") return true;
+	return "constructs" in config && Object.keys(config).every((key) => WORKSPACE_KEYS.has(key));
+}
+/** Every top-level key a workspace config has — see `WorkspaceConfigSchema`. */
+const WORKSPACE_KEYS = /* @__PURE__ */ new Set([
+	"name",
+	"constructs",
+	"apps",
+	"shared",
+	"domains",
+	"dns",
+	"deploy",
+	"stages",
+	"secrets",
+	"state"
+]);
+//#endregion
+//#region src/workspace/publicEnv.ts
+/**
+* All public env-var prefixes the toolbox understands.
+*
+* Used when resolving incoming var names back to a dependency
+* (e.g. `VITE_AUTH_URL` → `auth`). A var matching any of these
+* is considered safe to inline into a client bundle.
+*/
+const PUBLIC_ENV_PREFIXES = [
+	"NEXT_PUBLIC_",
+	"VITE_",
+	"EXPO_PUBLIC_"
+];
+/**
+* Resolve the public env-var prefix that a frontend framework's bundler
+* inlines into client code at build time:
+*
+*  - `nextjs`         → `NEXT_PUBLIC_`
+*  - `vite`           → `VITE_`
+*  - `tanstack-start` → `VITE_` (uses Vite under the hood)
+*  - `expo`           → `EXPO_PUBLIC_`
+*  - `remix`          → `''` (Remix exposes via loaders, no prefix convention)
+*
+* For backend frameworks or unspecified, falls back to `NEXT_PUBLIC_` to
+* preserve the historical default. Backend apps never read these vars
+* from a bundle, so the prefix only affects scaffolding/symmetry.
+*/
+function getPublicEnvPrefix(framework) {
+	switch (framework) {
+		case "vite":
+		case "tanstack-start": return "VITE_";
+		case "expo": return "EXPO_PUBLIC_";
+		case "remix": return "";
+		case "nextjs": return "NEXT_PUBLIC_";
+		default: return "NEXT_PUBLIC_";
+	}
+}
+/**
+* Strip a known public prefix from a var name.
+* Returns the un-prefixed name, or `null` if no prefix matched.
+*/
+function stripPublicPrefix(name) {
+	for (const prefix of PUBLIC_ENV_PREFIXES) if (prefix && name.startsWith(prefix)) return name.slice(prefix.length);
+	return null;
+}
+//#endregion
+//#region src/workspace/index.ts
+/**
+* Validate that all dependencies reference existing apps.
+* Returns the config if valid, throws otherwise.
+*/
+function validateDependencies(apps) {
+	const appNames = new Set(Object.keys(apps));
+	for (const [appName, app] of Object.entries(apps)) for (const dep of app.dependencies ?? []) {
+		if (!appNames.has(dep)) throw new Error(`Invalid dependency: App "${appName}" depends on "${dep}" which does not exist. Valid apps are: ${[...appNames].join(", ")}`);
+		if (dep === appName) throw new Error(`Invalid dependency: App "${appName}" cannot depend on itself.`);
+	}
+}
+/**
+* Define workspace configuration with full TypeScript support and type inference.
+*
+* Uses `const` type parameter to infer literal app names, providing:
+* - Autocomplete for app names in dependencies
+* - Type errors for invalid dependency references
+* - Full type inference for the returned config
+*
+* @example
+* ```ts
+* // gkm.config.ts
+* import { defineWorkspace } from '@geekmidas/cli';
+*
+* export default defineWorkspace({
+*   name: 'my-saas',
+*   apps: {
+*     api: {
+*       type: 'backend',
+*       path: 'apps/api',
+*       port: 3000,
+*       routes: './src/endpoints/**\/*.ts',
+*       envParser: './src/config/env',
+*       logger: './src/logger',
+*     },
+*     web: {
+*       type: 'web',
+*       framework: 'nextjs',
+*       path: 'apps/web',
+*       port: 3001,
+*       dependencies: ['api'], // <- autocomplete shows 'api' | 'web'
+*     },
+*   },
+* });
+*
+* // config.apps.api <- full type inference
+* // config.apps.foo <- TypeScript error
+* ```
+*/
+function defineWorkspace(config) {
+	assertNoMovedDeployKeys(config.deploy);
+	assertKnownSecretsStore(config.secrets?.store);
+	if (config.apps) validateDependencies(config.apps);
+	const result = safeValidateWorkspaceConfig(config);
+	if (!result.success && result.error) throw new Error(formatValidationErrors(result.error));
+	return config;
+}
+/**
+* Get the package name from package.json in the given directory.
+*/
+function getPackageName(cwd) {
+	try {
+		return require(`${cwd}/package.json`).name?.replace(/^@[^/]+\//, "");
+	} catch {
+		return;
+	}
+}
+/**
+* Normalize a workspace configuration with resolved defaults.
+*/
+function normalizeWorkspace(config, cwd) {
+	const name = config.name ?? getPackageName(cwd) ?? (0, node_path.basename)(cwd);
+	const defaultTarget = config.deploy?.default ?? "dokploy";
+	const normalizedApps = {};
+	for (const [appName, app] of Object.entries(config.apps ?? {})) normalizedApps[appName] = normalizeAppConfig(app, defaultTarget);
+	return {
+		name,
+		root: cwd,
+		...config.constructs ? { constructs: config.constructs } : {},
+		apps: normalizedApps,
+		...config.domains ? { domains: config.domains } : {},
+		...config.dns ? { dns: config.dns } : {},
+		deploy: config.deploy ?? { default: "dokploy" },
+		shared: config.shared ?? { packages: ["packages/*"] },
+		stages: validateStages(config.stages),
+		secrets: config.secrets ?? {},
+		state: config.state,
+		test: config.test ?? {},
+		...config.dev ? { dev: config.dev } : {}
+	};
+}
+/**
+* Normalize an app configuration with resolved defaults.
+* @param app - App configuration
+* @param defaultTarget - Default deploy target from workspace config
+*/
+function normalizeAppConfig(app, defaultTarget) {
+	return {
+		...app,
+		type: app.type ?? "backend",
+		port: app.port,
+		path: app.path,
+		dependencies: app.dependencies ?? [],
+		resolvedDeployTarget: app.deploy ?? defaultTarget
+	};
+}
+/**
+* Wrap a single-app GkmConfig as a workspace.
+* This allows existing single-app configs to work seamlessly.
+*/
+function wrapSingleAppAsWorkspace(config, cwd) {
+	return {
+		name: config.name ?? getPackageName(cwd) ?? (0, node_path.basename)(cwd),
+		root: cwd,
+		apps: { api: {
+			type: "backend",
+			path: ".",
+			port: 3e3,
+			dependencies: [],
+			resolvedDeployTarget: config.deploy?.default ?? "dokploy",
+			constructs: config.constructs,
+			hooks: config.hooks,
+			telescope: config.telescope,
+			openapi: config.openapi,
+			runtime: config.runtime,
+			env: config.env
+		} },
+		...config.domains ? { domains: config.domains } : {},
+		...config.dns ? { dns: config.dns } : {},
+		deploy: {
+			default: "dokploy",
+			...config.deploy
+		},
+		shared: { packages: [] },
+		stages: validateStages(config.stages),
+		secrets: config.secrets ?? {},
+		test: config.test ?? {},
+		...config.dev ? { dev: config.dev } : {}
+	};
+}
+/**
+* Process a loaded configuration (either single-app or workspace).
+* Returns a normalized workspace in both cases.
+*/
+/**
+* `deploy.dokploy.registry`, which became `deploy.registry`: every target
+* pushes and pulls through the one registry, so it is not Dokploy's to hold.
+*
+* Refused by name rather than dropped: the schema strips keys it does not
+* know, and a registry silently gone would deploy images under no registry.
+*/
+var DokployRegistryMoved = class extends require_errors.GkmError {
+	registry;
+	constructor(registry) {
+		super(`deploy.dokploy.registry is now deploy.registry, read by every deploy target. In gkm.config.ts, move it up one level: deploy: { registry: ${JSON.stringify(registry)}, dokploy: { … } }.`);
+		this.registry = registry;
+		this.name = "DokployRegistryMoved";
+	}
+};
+/**
+* `deploy.domains`, which became `domains` at the root of the config: a stage's
+* domain is a fact about the product every target and every command reads,
+* not a deploy setting.
+*/
+var DomainsMoved = class extends require_errors.GkmError {
+	domains;
+	constructor(domains) {
+		super(`deploy.domains is now domains, at the root of gkm.config.ts. Move it out of deploy: defineWorkspace({ …, domains: ${JSON.stringify(domains)}, deploy: { … } }).`);
+		this.domains = domains;
+		this.name = "DomainsMoved";
+	}
+};
+/**
+* `deploy.dns`, which became `dns` at the root of the config, keyed by root
+* domain.
+*/
+var DnsMoved = class extends require_errors.GkmError {
+	dns;
+	constructor(dns) {
+		const legacy = dns && typeof dns === "object" && "domain" in dns && "provider" in dns;
+		const { domain, ...rest } = legacy ? dns : {};
+		super(`deploy.dns is now dns, at the root of gkm.config.ts, keyed by root domain. Move it out of deploy: defineWorkspace({ …, dns: ${JSON.stringify(legacy ? { [String(domain)]: rest } : dns)}, deploy: { … } }).`);
+		this.dns = dns;
+		this.name = "DnsMoved";
+	}
+};
+/** Refuse a deploy key that has moved, naming where it lives now. */
+function assertNoMovedDeployKeys(deploy) {
+	const dokploy = deploy?.dokploy;
+	if (dokploy && typeof dokploy === "object" && "registry" in dokploy) throw new DokployRegistryMoved(dokploy.registry);
+	if (deploy && typeof deploy === "object") {
+		if ("domains" in deploy) throw new DomainsMoved(deploy.domains);
+		if ("dns" in deploy) throw new DnsMoved(deploy.dns);
+	}
+}
+function processConfig(config, cwd) {
+	assertNoMovedDeployKeys(config.deploy);
+	if (isWorkspaceConfig(config)) {
+		assertKnownSecretsStore(config.secrets?.store);
+		if (config.stages === void 0) throw new InvalidStages(stageProblems(void 0));
+		const result = safeValidateWorkspaceConfig(config);
+		if (!result.success && result.error) throw new InvalidWorkspaceConfig(formatValidationErrors(result.error));
+		return {
+			type: "workspace",
+			raw: config,
+			workspace: normalizeWorkspace(config, cwd)
+		};
+	}
+	return {
+		type: "single",
+		raw: config,
+		workspace: wrapSingleAppAsWorkspace(config, cwd)
+	};
+}
+/** A workspace config the schema refuses; the message lists every issue. */
+var InvalidWorkspaceConfig = class extends require_errors.GkmError {
+	constructor(message) {
+		super(message);
+		this.name = "InvalidWorkspaceConfig";
+	}
+};
+/**
+* The workspace's own constructs globs, absolute.
+*
+* Infrastructure two apps share is a fact about the product, and declaring it
+* inside one of them makes moving that app a change to the other's database.
+*/
+function workspaceConstructGlobs(workspace) {
+	return constructPatterns(workspace.constructs).map((pattern) => (0, node_path.isAbsolute)(pattern) ? pattern : (0, node_path.join)(workspace.root, pattern));
+}
+/**
+* Every constructs glob an app can see, absolute.
+*
+* The workspace's own first, then the app's. Absolute because the app builds
+* from its own directory while the workspace's constructs live above it —
+* a relative glob resolved from the app would look for the product's
+* infrastructure inside one of its consumers and find nothing.
+*
+* Additive, not overriding: an app that declares its own constructs still sees
+* the ones the workspace declared for everybody.
+*/
+function appConstructGlobs(workspace, appName) {
+	const globs = workspaceConstructGlobs(workspace);
+	const app = workspace.apps[appName];
+	if (app) {
+		const root = (0, node_path.isAbsolute)(app.path) ? app.path : (0, node_path.join)(workspace.root, app.path);
+		for (const pattern of constructPatterns(app.constructs)) globs.push((0, node_path.isAbsolute)(pattern) ? pattern : (0, node_path.join)(root, pattern));
+	}
+	return globs;
+}
+/**
+* Every constructs glob in the workspace: its own, plus each app's.
+*
+* One list, so what a deploy provisions and what an app's entry point
+* registers drivers for are read off the same globs.
+*/
+function allConstructGlobs(workspace) {
+	const globs = [...workspaceConstructGlobs(workspace), ...Object.keys(workspace.apps).flatMap((appName) => appConstructGlobs(workspace, appName))];
+	return [...new Set(globs)];
+}
+/** A `Routes` in any of its accepted shapes, as a flat list of patterns. */
+function constructPatterns(routes) {
+	if (!routes) return [];
+	return typeof routes === "string" ? [routes] : routes;
+}
+/**
+* Get the GkmConfig for a specific app in a workspace.
+* Useful for running existing single-app commands on a specific app.
+*/
+function getAppGkmConfig(workspace, appName) {
+	const app = workspace.apps[appName];
+	if (!app || app.type !== "backend") return;
+	return {
+		...workspace.deploy ? { deploy: workspace.deploy } : {},
+		stages: workspace.stages,
+		constructs: appConstructGlobs(workspace, appName),
+		hooks: app.hooks,
+		telescope: app.telescope,
+		openapi: app.openapi,
+		runtime: app.runtime,
+		env: app.env
+	};
+}
+/**
+* Get topologically sorted app names based on dependencies.
+* Apps with no dependencies come first, then apps that depend on them.
+*/
+function getAppBuildOrder(workspace) {
+	const appNames = Object.keys(workspace.apps);
+	const visited = /* @__PURE__ */ new Set();
+	const result = [];
+	function visit(name) {
+		if (visited.has(name)) return;
+		visited.add(name);
+		const app = workspace.apps[name];
+		if (app) for (const dep of app.dependencies) visit(dep);
+		result.push(name);
+	}
+	for (const name of appNames) visit(name);
+	return result;
+}
+/**
+* Resolve the Dokploy endpoint for a specific stage.
+*
+* Uses per-stage endpoint from `endpoints` if available,
+* otherwise falls back to the global `endpoint`.
+*
+* @param dokployConfig - Dokploy workspace configuration
+* @param stage - Deployment stage (e.g., 'development', 'production')
+* @returns The endpoint URL for the stage, or undefined if not configured
+*
+* @example
+* ```ts
+* // With per-stage endpoints
+* const config = {
+*   endpoints: {
+*     development: 'https://dev.dokploy.example.com:3000',
+*     production: 'https://prod.dokploy.example.com:3000',
+*   },
+* };
+* getEndpointForStage(config, 'production'); // => 'https://prod.dokploy.example.com:3000'
+*
+* // With single endpoint
+* const config = { endpoint: 'https://dokploy.example.com:3000' };
+* getEndpointForStage(config, 'production'); // => 'https://dokploy.example.com:3000'
+* ```
+*/
+function getEndpointForStage(dokployConfig, stage) {
+	if (!dokployConfig) return void 0;
+	if (dokployConfig.endpoints?.[stage]) return dokployConfig.endpoints[stage];
+	return dokployConfig.endpoint;
+}
+//#endregion
+Object.defineProperty(exports, "AccessKeyLimit", {
+	enumerable: true,
+	get: function() {
+		return AccessKeyLimit;
+	}
+});
+Object.defineProperty(exports, "BucketKeySetElsewhere", {
+	enumerable: true,
+	get: function() {
+		return BucketKeySetElsewhere;
+	}
+});
+Object.defineProperty(exports, "BucketNameUnavailable", {
+	enumerable: true,
+	get: function() {
+		return BucketNameUnavailable;
+	}
+});
+Object.defineProperty(exports, "BucketOwnedByAnotherProject", {
+	enumerable: true,
+	get: function() {
+		return BucketOwnedByAnotherProject;
+	}
+});
+Object.defineProperty(exports, "BucketProbeFailed", {
+	enumerable: true,
+	get: function() {
+		return BucketProbeFailed;
+	}
+});
+Object.defineProperty(exports, "BucketRegionMismatch", {
+	enumerable: true,
+	get: function() {
+		return BucketRegionMismatch;
+	}
+});
+Object.defineProperty(exports, "BucketRegionUnknown", {
+	enumerable: true,
+	get: function() {
+		return BucketRegionUnknown;
+	}
+});
+Object.defineProperty(exports, "ComposeTlsFileMissing", {
+	enumerable: true,
+	get: function() {
+		return ComposeTlsFileMissing;
+	}
+});
+Object.defineProperty(exports, "DnsMoved", {
+	enumerable: true,
+	get: function() {
+		return DnsMoved;
+	}
+});
+Object.defineProperty(exports, "DokployRegistryMoved", {
+	enumerable: true,
+	get: function() {
+		return DokployRegistryMoved;
+	}
+});
+Object.defineProperty(exports, "DomainsMoved", {
+	enumerable: true,
+	get: function() {
+		return DomainsMoved;
+	}
+});
+Object.defineProperty(exports, "IamUserNotOwned", {
+	enumerable: true,
+	get: function() {
+		return IamUserNotOwned;
+	}
+});
+Object.defineProperty(exports, "InvalidStages", {
+	enumerable: true,
+	get: function() {
+		return InvalidStages;
+	}
+});
+Object.defineProperty(exports, "InvalidWorkspaceConfig", {
+	enumerable: true,
+	get: function() {
+		return InvalidWorkspaceConfig;
+	}
+});
+Object.defineProperty(exports, "LOGS_PORT", {
+	enumerable: true,
+	get: function() {
+		return LOGS_PORT;
+	}
+});
+Object.defineProperty(exports, "PHASE_2_DEPLOY_TARGETS", {
+	enumerable: true,
+	get: function() {
+		return PHASE_2_DEPLOY_TARGETS;
+	}
+});
+Object.defineProperty(exports, "PUBLIC_ENV_PREFIXES", {
+	enumerable: true,
+	get: function() {
+		return PUBLIC_ENV_PREFIXES;
+	}
+});
+Object.defineProperty(exports, "ProvisionedBucketUnreachable", {
+	enumerable: true,
+	get: function() {
+		return ProvisionedBucketUnreachable;
+	}
+});
+Object.defineProperty(exports, "RecordedBucketUnreachable", {
+	enumerable: true,
+	get: function() {
+		return RecordedBucketUnreachable;
+	}
+});
+Object.defineProperty(exports, "RotationInProgress", {
+	enumerable: true,
+	get: function() {
+		return RotationInProgress;
+	}
+});
+Object.defineProperty(exports, "S3RegionRequired", {
+	enumerable: true,
+	get: function() {
+		return S3RegionRequired;
+	}
+});
+Object.defineProperty(exports, "S3_PROVISIONING", {
+	enumerable: true,
+	get: function() {
+		return S3_PROVISIONING;
+	}
+});
+Object.defineProperty(exports, "SECRETS_STORE_PROVIDERS", {
+	enumerable: true,
+	get: function() {
+		return SECRETS_STORE_PROVIDERS;
+	}
+});
+Object.defineProperty(exports, "SERVER_IPV4_KEY", {
+	enumerable: true,
+	get: function() {
+		return SERVER_IPV4_KEY;
+	}
+});
+Object.defineProperty(exports, "SERVER_IPV6_KEY", {
+	enumerable: true,
+	get: function() {
+		return SERVER_IPV6_KEY;
+	}
+});
+Object.defineProperty(exports, "SUPPORTED_DEPLOY_TARGETS", {
+	enumerable: true,
+	get: function() {
+		return SUPPORTED_DEPLOY_TARGETS;
+	}
+});
+Object.defineProperty(exports, "TEST_STAGE", {
+	enumerable: true,
+	get: function() {
+		return TEST_STAGE;
+	}
+});
+Object.defineProperty(exports, "UndeclaredStage", {
+	enumerable: true,
+	get: function() {
+		return UndeclaredStage;
+	}
+});
+Object.defineProperty(exports, "UnknownSecretsStoreProvider", {
+	enumerable: true,
+	get: function() {
+		return UnknownSecretsStoreProvider;
+	}
+});
+Object.defineProperty(exports, "UnknownStageProvider", {
+	enumerable: true,
+	get: function() {
+		return UnknownStageProvider;
+	}
+});
+Object.defineProperty(exports, "WorkspaceConfigSchema", {
+	enumerable: true,
+	get: function() {
+		return WorkspaceConfigSchema;
+	}
+});
+Object.defineProperty(exports, "allConstructGlobs", {
+	enumerable: true,
+	get: function() {
+		return allConstructGlobs;
+	}
+});
+Object.defineProperty(exports, "appConstructGlobs", {
+	enumerable: true,
+	get: function() {
+		return appConstructGlobs;
+	}
+});
+Object.defineProperty(exports, "assertDeployedStage", {
+	enumerable: true,
+	get: function() {
+		return assertDeployedStage;
+	}
+});
+Object.defineProperty(exports, "assertNoMovedDeployKeys", {
+	enumerable: true,
+	get: function() {
+		return assertNoMovedDeployKeys;
+	}
+});
+Object.defineProperty(exports, "certificateFor", {
+	enumerable: true,
+	get: function() {
+		return certificateFor;
+	}
+});
+Object.defineProperty(exports, "checkS3Config", {
+	enumerable: true,
+	get: function() {
+		return checkS3Config;
+	}
+});
+Object.defineProperty(exports, "checkStageBackups", {
+	enumerable: true,
+	get: function() {
+		return checkStageBackups;
+	}
+});
+Object.defineProperty(exports, "cnameTarget", {
+	enumerable: true,
+	get: function() {
+		return cnameTarget;
+	}
+});
+Object.defineProperty(exports, "constructPatterns", {
+	enumerable: true,
+	get: function() {
+		return constructPatterns;
+	}
+});
+Object.defineProperty(exports, "defineWorkspace", {
+	enumerable: true,
+	get: function() {
+		return defineWorkspace;
+	}
+});
+Object.defineProperty(exports, "deployedProblems", {
+	enumerable: true,
+	get: function() {
+		return deployedProblems;
+	}
+});
+Object.defineProperty(exports, "formatValidationErrors", {
+	enumerable: true,
+	get: function() {
+		return formatValidationErrors;
+	}
+});
+Object.defineProperty(exports, "getAppBuildOrder", {
+	enumerable: true,
+	get: function() {
+		return getAppBuildOrder;
+	}
+});
+Object.defineProperty(exports, "getAppGkmConfig", {
+	enumerable: true,
+	get: function() {
+		return getAppGkmConfig;
+	}
+});
+Object.defineProperty(exports, "getDeployTargetError", {
+	enumerable: true,
+	get: function() {
+		return getDeployTargetError;
+	}
+});
+Object.defineProperty(exports, "getEndpointForStage", {
+	enumerable: true,
+	get: function() {
+		return getEndpointForStage;
+	}
+});
+Object.defineProperty(exports, "getPublicEnvPrefix", {
+	enumerable: true,
+	get: function() {
+		return getPublicEnvPrefix;
+	}
+});
+Object.defineProperty(exports, "isDeployTargetSupported", {
+	enumerable: true,
+	get: function() {
+		return isDeployTargetSupported;
+	}
+});
+Object.defineProperty(exports, "isPhase2DeployTarget", {
+	enumerable: true,
+	get: function() {
+		return isPhase2DeployTarget;
+	}
+});
+Object.defineProperty(exports, "isReservedStageKey", {
+	enumerable: true,
+	get: function() {
+		return isReservedStageKey;
+	}
+});
+Object.defineProperty(exports, "isWorkspaceConfig", {
+	enumerable: true,
+	get: function() {
+		return isWorkspaceConfig;
+	}
+});
+Object.defineProperty(exports, "normalizeWorkspace", {
+	enumerable: true,
+	get: function() {
+		return normalizeWorkspace;
+	}
+});
+Object.defineProperty(exports, "otlpTelemetryEnv", {
+	enumerable: true,
+	get: function() {
+		return otlpTelemetryEnv;
+	}
+});
+Object.defineProperty(exports, "processConfig", {
+	enumerable: true,
+	get: function() {
+		return processConfig;
+	}
+});
+Object.defineProperty(exports, "provisioningOf", {
+	enumerable: true,
+	get: function() {
+		return provisioningOf;
+	}
+});
+Object.defineProperty(exports, "proxyFor", {
+	enumerable: true,
+	get: function() {
+		return proxyFor;
+	}
+});
+Object.defineProperty(exports, "resolveStageTelemetry", {
+	enumerable: true,
+	get: function() {
+		return resolveStageTelemetry;
+	}
+});
+Object.defineProperty(exports, "s3SecretsKey", {
+	enumerable: true,
+	get: function() {
+		return s3SecretsKey;
+	}
+});
+Object.defineProperty(exports, "s3SecretsLocation", {
+	enumerable: true,
+	get: function() {
+		return s3SecretsLocation;
+	}
+});
+Object.defineProperty(exports, "safeValidateWorkspaceConfig", {
+	enumerable: true,
+	get: function() {
+		return safeValidateWorkspaceConfig;
+	}
+});
+Object.defineProperty(exports, "stageProblems", {
+	enumerable: true,
+	get: function() {
+		return stageProblems;
+	}
+});
+Object.defineProperty(exports, "stageProvider", {
+	enumerable: true,
+	get: function() {
+		return stageProvider;
+	}
+});
+Object.defineProperty(exports, "stageSampleRate", {
+	enumerable: true,
+	get: function() {
+		return stageSampleRate;
+	}
+});
+Object.defineProperty(exports, "stripPublicPrefix", {
+	enumerable: true,
+	get: function() {
+		return stripPublicPrefix;
+	}
+});
+Object.defineProperty(exports, "telemetryEnv", {
+	enumerable: true,
+	get: function() {
+		return telemetryEnv;
+	}
+});
+Object.defineProperty(exports, "validateWorkspaceConfig", {
+	enumerable: true,
+	get: function() {
+		return validateWorkspaceConfig;
+	}
+});
+Object.defineProperty(exports, "workspaceConstructGlobs", {
+	enumerable: true,
+	get: function() {
+		return workspaceConstructGlobs;
+	}
+});
+Object.defineProperty(exports, "wrapSingleAppAsWorkspace", {
+	enumerable: true,
+	get: function() {
+		return wrapSingleAppAsWorkspace;
+	}
+});
+
+//# sourceMappingURL=workspace-BwqQnool.cjs.map