@geekmidas/cli 10.0.0-alpha.11 → 10.0.0-alpha.13

package/dist/types-Y3fKQSAK.d.cts

@@ -1,2220 +0,0 @@
-import { ConstructManifest } from "@geekmidas/manifest";
-import { z } from "zod/v4";
-
-//#region src/deploy/state.d.ts
-
-/**
- * Deploy state management for Dokploy deployments
- *
- * Stores resource IDs (applications, services) per stage to avoid
- * re-creating resources on subsequent deploys.
- */
-/**
- * Per-app database credentials
- */
-interface AppDbCredentials {
-  dbUser: string;
-  dbPassword: string;
-}
-/**
- * DNS verification record for a hostname
- */
-interface DnsVerificationRecord {
-  serverIp: string;
-  verifiedAt: string;
-}
-/**
- * A DNS record that was created during deploy
- */
-interface CreatedDnsRecord {
-  /** The domain this record belongs to (e.g., 'example.com') */
-  domain: string;
-  /** Record name/subdomain (e.g., 'api' or '@' for root) */
-  name: string;
-  /** Record type (A, CNAME, etc.) */
-  type: string;
-  /** Record value (IP address, hostname, etc.) */
-  value: string;
-  /** TTL in seconds */
-  ttl: number;
-  /** When this record was created */
-  createdAt: string;
-}
-/**
- * Backup destination state
- */
-interface BackupState {
-  /** S3 bucket name for backups */
-  bucketName: string;
-  /** S3 bucket ARN */
-  bucketArn: string;
-  /** IAM user name created for backup access */
-  iamUserName: string;
-  /** IAM access key ID */
-  iamAccessKeyId: string;
-  /** IAM secret access key */
-  iamSecretAccessKey: string;
-  /** Dokploy destination ID */
-  destinationId: string;
-  /** Dokploy backup schedule ID for postgres (if configured) */
-  postgresBackupId?: string;
-  /** AWS region where bucket was created */
-  region: string;
-  /** Timestamp when backup was configured */
-  createdAt: string;
-}
-/**
- * State for a single stage deployment
- */
-interface DokployStageState {
-  provider: 'dokploy';
-  stage: string;
-  /** Dokploy project ID - created on first deploy */
-  projectId: string;
-  environmentId: string;
-  applications: Record<string, string>;
-  services: {
-    postgresId?: string;
-    redisId?: string;
-  };
-  /** Per-app database credentials for reuse on subsequent deploys */
-  appCredentials?: Record<string, AppDbCredentials>;
-  /** Auto-generated secrets per app (e.g., BETTER_AUTH_SECRET) */
-  generatedSecrets?: Record<string, Record<string, string>>;
-  /** DNS verification state per hostname */
-  dnsVerified?: Record<string, DnsVerificationRecord>;
-  /** DNS records created during deploy (keyed by "name:type", e.g., "api:A") */
-  dnsRecords?: Record<string, CreatedDnsRecord>;
-  /** Backup destination state */
-  backups?: BackupState;
-  lastDeployedAt: string;
-}
-/**
- * Read the deploy state for a stage
- * Returns null if state file doesn't exist
- */
-//#endregion
-//#region src/deploy/StateProvider.d.ts
-/**
- * Interface for deployment state storage providers.
- *
- * Implementations must handle:
- * - Reading state for a stage (returns null if not found)
- * - Writing state for a stage (creates or updates)
- */
-interface StateProvider {
-  /**
-   * Read deployment state for a stage.
-   *
-   * @param stage - The deployment stage (e.g., 'development', 'production')
-   * @returns The state object or null if not found
-   */
-  read(stage: string): Promise<DokployStageState | null>;
-  /**
-   * Write deployment state for a stage.
-   *
-   * @param stage - The deployment stage
-   * @param state - The state object to persist
-   */
-  write(stage: string, state: DokployStageState): Promise<void>;
-}
-/**
- * Valid AWS regions.
- */
-type AwsRegion = 'us-east-1' | 'us-east-2' | 'us-west-1' | 'us-west-2' | 'af-south-1' | 'ap-east-1' | 'ap-south-1' | 'ap-south-2' | 'ap-southeast-1' | 'ap-southeast-2' | 'ap-southeast-3' | 'ap-southeast-4' | 'ap-northeast-1' | 'ap-northeast-2' | 'ap-northeast-3' | 'ca-central-1' | 'eu-central-1' | 'eu-central-2' | 'eu-west-1' | 'eu-west-2' | 'eu-west-3' | 'eu-south-1' | 'eu-south-2' | 'eu-north-1' | 'me-south-1' | 'me-central-1' | 'sa-east-1';
-/**
- * Local state provider config.
- */
-interface LocalStateConfig {
-  provider: 'local';
-}
-/**
- * SSM state provider config (requires region).
- */
-interface SSMStateConfig {
-  provider: 'ssm';
-  /** AWS region (required for SSM provider) */
-  region: AwsRegion;
-  /** AWS profile name (optional - uses default credential chain if not provided) */
-  profile?: string;
-}
-/**
- * Custom state provider config.
- */
-interface CustomStateConfig {
-  /** Custom StateProvider implementation */
-  provider: StateProvider;
-}
-/**
- * State configuration types.
- */
-type StateConfig = LocalStateConfig | SSMStateConfig | CustomStateConfig;
-/**
- * Check if value is a StateProvider implementation.
- */
-//#endregion
-//#region src/workspace/schema.d.ts
-/**
- * Backend framework schema for non-gkm apps.
- */
-declare const BackendFrameworkSchema: z.ZodEnum<{
-  hono: "hono";
-  "better-auth": "better-auth";
-  express: "express";
-  fastify: "fastify";
-}>;
-/**
- * Backend framework types for apps that don't use gkm routes.
- * Derived from {@link BackendFrameworkSchema}.
- *
- * Used with `entry` to specify the framework for proper Docker builds.
- *
- * @example
- * ```ts
- * // Better Auth server
- * {
- *   entry: './src/index.ts',
- *   framework: 'better-auth',
- *   port: 3001,
- * }
- *
- * // Hono app without gkm routes
- * {
- *   entry: './src/server.ts',
- *   framework: 'hono',
- *   port: 3000,
- * }
- * ```
- */
-type BackendFramework = z.infer<typeof BackendFrameworkSchema>;
-/**
- * Frontend framework schema.
- */
-declare const FrontendFrameworkSchema: z.ZodEnum<{
-  nextjs: "nextjs";
-  remix: "remix";
-  vite: "vite";
-  "tanstack-start": "tanstack-start";
-}>;
-/**
- * Frontend framework types. Derived from {@link FrontendFrameworkSchema}.
- *
- * @example
- * ```ts
- * // Next.js app
- * {
- *   type: 'web',
- *   framework: 'nextjs',
- *   port: 3000,
- * }
- *
- * // Vite SPA
- * {
- *   type: 'web',
- *   framework: 'vite',
- *   port: 5173,
- * }
- *
- * // TanStack Start (Vite-based, full-stack)
- * {
- *   type: 'web',
- *   framework: 'tanstack-start',
- *   port: 3000,
- * }
- * ```
- */
-type FrontendFramework = z.infer<typeof FrontendFrameworkSchema>;
-/**
- * Mobile framework schema.
- */
-declare const MobileFrameworkSchema: z.ZodEnum<{
-  expo: "expo";
-}>;
-/**
- * Mobile framework types. Derived from {@link MobileFrameworkSchema}.
- *
- * Mobile apps deploy via their own toolchain (e.g. EAS Build for Expo)
- * rather than Docker/Dokploy. Only build-time public env vars
- * (e.g. `EXPO_PUBLIC_*`) reach the device — server secrets are dropped.
- *
- * @example
- * ```ts
- * {
- *   type: 'mobile',
- *   framework: 'expo',
- *   path: 'apps/mobile',
- *   port: 8081,
- *   dependencies: ['api'],
- * }
- * ```
- */
-type MobileFramework = z.infer<typeof MobileFrameworkSchema>;
-/**
- * Combined framework schema (backend, frontend, or mobile).
- */
-declare const FrameworkSchema: z.ZodUnion<readonly [z.ZodEnum<{
-  hono: "hono";
-  "better-auth": "better-auth";
-  express: "express";
-  fastify: "fastify";
-}>, z.ZodEnum<{
-  nextjs: "nextjs";
-  remix: "remix";
-  vite: "vite";
-  "tanstack-start": "tanstack-start";
-}>, z.ZodEnum<{
-  expo: "expo";
-}>]>;
-/**
- * Any framework value across backend, frontend, or mobile.
- * Derived from {@link FrameworkSchema}.
- */
-type Framework = z.infer<typeof FrameworkSchema>;
-/**
- * Supported deploy targets (Phase 1).
- */
-declare const SUPPORTED_DEPLOY_TARGETS: readonly ["dokploy"];
-/**
- * Phase 2 deploy targets (not yet implemented).
- */
-declare const PHASE_2_DEPLOY_TARGETS: readonly ["vercel", "cloudflare"];
-/**
- * Check if a deploy target is supported.
- */
-declare function isDeployTargetSupported(target: string): boolean;
-/**
- * Check if a deploy target is planned for Phase 2.
- */
-declare function isPhase2DeployTarget(target: string): boolean;
-/**
- * Get error message for unsupported deploy targets.
- */
-declare function getDeployTargetError(target: string, appName?: string): string;
-/**
- * DNS record types supported across providers.
- */
-
-/**
- * Combined DNS config that supports both new multi-domain and legacy single-domain formats.
- */
-declare const DnsConfigWithLegacySchema: z.ZodUnion<readonly [z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
-  provider: z.ZodLiteral<"hostinger">;
-  ttl: z.ZodOptional<z.ZodNumber>;
-}, z.core.$strip>, z.ZodObject<{
-  provider: z.ZodLiteral<"route53">;
-  region: z.ZodOptional<z.ZodEnum<{
-    "us-east-1": "us-east-1";
-    "us-east-2": "us-east-2";
-    "us-west-1": "us-west-1";
-    "us-west-2": "us-west-2";
-    "af-south-1": "af-south-1";
-    "ap-east-1": "ap-east-1";
-    "ap-south-1": "ap-south-1";
-    "ap-south-2": "ap-south-2";
-    "ap-southeast-1": "ap-southeast-1";
-    "ap-southeast-2": "ap-southeast-2";
-    "ap-southeast-3": "ap-southeast-3";
-    "ap-southeast-4": "ap-southeast-4";
-    "ap-northeast-1": "ap-northeast-1";
-    "ap-northeast-2": "ap-northeast-2";
-    "ap-northeast-3": "ap-northeast-3";
-    "ca-central-1": "ca-central-1";
-    "eu-central-1": "eu-central-1";
-    "eu-central-2": "eu-central-2";
-    "eu-west-1": "eu-west-1";
-    "eu-west-2": "eu-west-2";
-    "eu-west-3": "eu-west-3";
-    "eu-south-1": "eu-south-1";
-    "eu-south-2": "eu-south-2";
-    "eu-north-1": "eu-north-1";
-    "me-south-1": "me-south-1";
-    "me-central-1": "me-central-1";
-    "sa-east-1": "sa-east-1";
-  }>>;
-  profile: z.ZodOptional<z.ZodString>;
-  hostedZoneId: z.ZodOptional<z.ZodString>;
-  ttl: z.ZodOptional<z.ZodNumber>;
-}, z.core.$strip>, z.ZodObject<{
-  provider: z.ZodLiteral<"cloudflare">;
-  ttl: z.ZodOptional<z.ZodNumber>;
-}, z.core.$strip>, z.ZodObject<{
-  provider: z.ZodLiteral<"manual">;
-}, z.core.$strip>], "provider">, z.ZodObject<{
-  provider: z.ZodCustom<{
-    name: string;
-    getRecords: Function;
-    upsertRecords: Function;
-  }, {
-    name: string;
-    getRecords: Function;
-    upsertRecords: Function;
-  }>;
-  ttl: z.ZodOptional<z.ZodNumber>;
-}, z.core.$strip>]>>, z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
-  provider: z.ZodLiteral<"hostinger">;
-  ttl: z.ZodOptional<z.ZodNumber>;
-  domain: z.ZodString;
-}, z.core.$strip>, z.ZodObject<{
-  provider: z.ZodLiteral<"route53">;
-  region: z.ZodOptional<z.ZodEnum<{
-    "us-east-1": "us-east-1";
-    "us-east-2": "us-east-2";
-    "us-west-1": "us-west-1";
-    "us-west-2": "us-west-2";
-    "af-south-1": "af-south-1";
-    "ap-east-1": "ap-east-1";
-    "ap-south-1": "ap-south-1";
-    "ap-south-2": "ap-south-2";
-    "ap-southeast-1": "ap-southeast-1";
-    "ap-southeast-2": "ap-southeast-2";
-    "ap-southeast-3": "ap-southeast-3";
-    "ap-southeast-4": "ap-southeast-4";
-    "ap-northeast-1": "ap-northeast-1";
-    "ap-northeast-2": "ap-northeast-2";
-    "ap-northeast-3": "ap-northeast-3";
-    "ca-central-1": "ca-central-1";
-    "eu-central-1": "eu-central-1";
-    "eu-central-2": "eu-central-2";
-    "eu-west-1": "eu-west-1";
-    "eu-west-2": "eu-west-2";
-    "eu-west-3": "eu-west-3";
-    "eu-south-1": "eu-south-1";
-    "eu-south-2": "eu-south-2";
-    "eu-north-1": "eu-north-1";
-    "me-south-1": "me-south-1";
-    "me-central-1": "me-central-1";
-    "sa-east-1": "sa-east-1";
-  }>>;
-  profile: z.ZodOptional<z.ZodString>;
-  hostedZoneId: z.ZodOptional<z.ZodString>;
-  ttl: z.ZodOptional<z.ZodNumber>;
-  domain: z.ZodString;
-}, z.core.$strip>, z.ZodObject<{
-  provider: z.ZodLiteral<"cloudflare">;
-  ttl: z.ZodOptional<z.ZodNumber>;
-  domain: z.ZodString;
-}, z.core.$strip>, z.ZodObject<{
-  provider: z.ZodLiteral<"manual">;
-  domain: z.ZodString;
-}, z.core.$strip>], "provider">, z.ZodObject<{
-  provider: z.ZodCustom<{
-    name: string;
-    getRecords: Function;
-    upsertRecords: Function;
-  }, {
-    name: string;
-    getRecords: Function;
-    upsertRecords: Function;
-  }>;
-  ttl: z.ZodOptional<z.ZodNumber>;
-  domain: z.ZodString;
-}, z.core.$strip>]>]>;
-type DnsConfig = z.infer<typeof DnsConfigWithLegacySchema>;
-/**
- * Backups configuration schema.
- *
- * Configures automatic backup destinations for database services.
- * On first deploy, creates S3 bucket with unique name and IAM credentials.
- */
-declare const BackupsConfigSchema: z.ZodObject<{
-  type: z.ZodLiteral<"s3">;
-  profile: z.ZodOptional<z.ZodString>;
-  region: z.ZodEnum<{
-    "us-east-1": "us-east-1";
-    "us-east-2": "us-east-2";
-    "us-west-1": "us-west-1";
-    "us-west-2": "us-west-2";
-    "af-south-1": "af-south-1";
-    "ap-east-1": "ap-east-1";
-    "ap-south-1": "ap-south-1";
-    "ap-south-2": "ap-south-2";
-    "ap-southeast-1": "ap-southeast-1";
-    "ap-southeast-2": "ap-southeast-2";
-    "ap-southeast-3": "ap-southeast-3";
-    "ap-southeast-4": "ap-southeast-4";
-    "ap-northeast-1": "ap-northeast-1";
-    "ap-northeast-2": "ap-northeast-2";
-    "ap-northeast-3": "ap-northeast-3";
-    "ca-central-1": "ca-central-1";
-    "eu-central-1": "eu-central-1";
-    "eu-central-2": "eu-central-2";
-    "eu-west-1": "eu-west-1";
-    "eu-west-2": "eu-west-2";
-    "eu-west-3": "eu-west-3";
-    "eu-south-1": "eu-south-1";
-    "eu-south-2": "eu-south-2";
-    "eu-north-1": "eu-north-1";
-    "me-south-1": "me-south-1";
-    "me-central-1": "me-central-1";
-    "sa-east-1": "sa-east-1";
-  }>;
-  schedule: z.ZodOptional<z.ZodString>;
-  retention: z.ZodOptional<z.ZodNumber>;
-}, z.core.$strip>;
-type BackupsConfig = z.infer<typeof BackupsConfigSchema>;
-/**
- * Workspace configuration schema.
- */
-declare const WorkspaceConfigSchema: z.ZodObject<{
-  name: z.ZodOptional<z.ZodString>;
-  constructs: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodObject<{
-    paths: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
-    partition: z.ZodCustom<(filepath: string) => string, (filepath: string) => string>;
-  }, z.core.$strip>]>>;
-  apps: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-    type: z.ZodDefault<z.ZodOptional<z.ZodEnum<{
-      backend: "backend";
-      web: "web";
-      mobile: "mobile";
-    }>>>;
-    path: z.ZodString;
-    port: z.ZodNumber;
-    dependencies: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    deploy: z.ZodOptional<z.ZodEnum<{
-      dokploy: "dokploy";
-      vercel: "vercel";
-      cloudflare: "cloudflare";
-    }>>;
-    constructs: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodObject<{
-      paths: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
-      partition: z.ZodCustom<(filepath: string) => string, (filepath: string) => string>;
-    }, z.core.$strip>]>>;
-    routes: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodObject<{
-      paths: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
-      partition: z.ZodCustom<(filepath: string) => string, (filepath: string) => string>;
-    }, z.core.$strip>]>>;
-    functions: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodObject<{
-      paths: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
-      partition: z.ZodCustom<(filepath: string) => string, (filepath: string) => string>;
-    }, z.core.$strip>]>>;
-    crons: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodObject<{
-      paths: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
-      partition: z.ZodCustom<(filepath: string) => string, (filepath: string) => string>;
-    }, z.core.$strip>]>>;
-    queues: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodObject<{
-      paths: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
-      partition: z.ZodCustom<(filepath: string) => string, (filepath: string) => string>;
-    }, z.core.$strip>]>>;
-    topics: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodObject<{
-      paths: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
-      partition: z.ZodCustom<(filepath: string) => string, (filepath: string) => string>;
-    }, z.core.$strip>]>>;
-    subscribers: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodObject<{
-      paths: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
-      partition: z.ZodCustom<(filepath: string) => string, (filepath: string) => string>;
-    }, z.core.$strip>]>>;
-    envParser: z.ZodOptional<z.ZodString>;
-    logger: z.ZodOptional<z.ZodString>;
-    hooks: z.ZodOptional<z.ZodObject<{
-      server: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>>;
-    telescope: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodBoolean, z.ZodObject<{
-      enabled: z.ZodOptional<z.ZodBoolean>;
-      port: z.ZodOptional<z.ZodNumber>;
-      path: z.ZodOptional<z.ZodString>;
-      ignore: z.ZodOptional<z.ZodArray<z.ZodString>>;
-      recordBody: z.ZodOptional<z.ZodBoolean>;
-      maxEntries: z.ZodOptional<z.ZodNumber>;
-      websocket: z.ZodOptional<z.ZodBoolean>;
-    }, z.core.$strip>]>>;
-    studio: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodBoolean, z.ZodObject<{
-      enabled: z.ZodOptional<z.ZodBoolean>;
-      path: z.ZodOptional<z.ZodString>;
-      schema: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>]>>;
-    openapi: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
-      enabled: z.ZodOptional<z.ZodBoolean>;
-      title: z.ZodOptional<z.ZodString>;
-      version: z.ZodOptional<z.ZodString>;
-      description: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>]>>;
-    runtime: z.ZodOptional<z.ZodEnum<{
-      node: "node";
-      bun: "bun";
-    }>>;
-    env: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
-    entry: z.ZodOptional<z.ZodString>;
-    framework: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
-      hono: "hono";
-      "better-auth": "better-auth";
-      express: "express";
-      fastify: "fastify";
-    }>, z.ZodEnum<{
-      nextjs: "nextjs";
-      remix: "remix";
-      vite: "vite";
-      "tanstack-start": "tanstack-start";
-    }>, z.ZodEnum<{
-      expo: "expo";
-    }>]>>;
-    config: z.ZodOptional<z.ZodObject<{
-      client: z.ZodOptional<z.ZodString>;
-      server: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>>;
-  }, z.core.$strip>>>;
-  shared: z.ZodOptional<z.ZodObject<{
-    packages: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    models: z.ZodOptional<z.ZodObject<{
-      path: z.ZodOptional<z.ZodString>;
-      schema: z.ZodOptional<z.ZodEnum<{
-        zod: "zod";
-      }>>;
-    }, z.core.$strip>>;
-  }, z.core.$strip>>;
-  deploy: z.ZodOptional<z.ZodObject<{
-    default: z.ZodOptional<z.ZodEnum<{
-      dokploy: "dokploy";
-      vercel: "vercel";
-      cloudflare: "cloudflare";
-    }>>;
-    dokploy: z.ZodOptional<z.ZodObject<{
-      endpoint: z.ZodOptional<z.ZodURL>;
-      endpoints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodURL>>;
-      registry: z.ZodOptional<z.ZodString>;
-      registryId: z.ZodOptional<z.ZodString>;
-      domains: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    }, z.core.$strip>>;
-    dns: z.ZodOptional<z.ZodUnion<readonly [z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
-      provider: z.ZodLiteral<"hostinger">;
-      ttl: z.ZodOptional<z.ZodNumber>;
-    }, z.core.$strip>, z.ZodObject<{
-      provider: z.ZodLiteral<"route53">;
-      region: z.ZodOptional<z.ZodEnum<{
-        "us-east-1": "us-east-1";
-        "us-east-2": "us-east-2";
-        "us-west-1": "us-west-1";
-        "us-west-2": "us-west-2";
-        "af-south-1": "af-south-1";
-        "ap-east-1": "ap-east-1";
-        "ap-south-1": "ap-south-1";
-        "ap-south-2": "ap-south-2";
-        "ap-southeast-1": "ap-southeast-1";
-        "ap-southeast-2": "ap-southeast-2";
-        "ap-southeast-3": "ap-southeast-3";
-        "ap-southeast-4": "ap-southeast-4";
-        "ap-northeast-1": "ap-northeast-1";
-        "ap-northeast-2": "ap-northeast-2";
-        "ap-northeast-3": "ap-northeast-3";
-        "ca-central-1": "ca-central-1";
-        "eu-central-1": "eu-central-1";
-        "eu-central-2": "eu-central-2";
-        "eu-west-1": "eu-west-1";
-        "eu-west-2": "eu-west-2";
-        "eu-west-3": "eu-west-3";
-        "eu-south-1": "eu-south-1";
-        "eu-south-2": "eu-south-2";
-        "eu-north-1": "eu-north-1";
-        "me-south-1": "me-south-1";
-        "me-central-1": "me-central-1";
-        "sa-east-1": "sa-east-1";
-      }>>;
-      profile: z.ZodOptional<z.ZodString>;
-      hostedZoneId: z.ZodOptional<z.ZodString>;
-      ttl: z.ZodOptional<z.ZodNumber>;
-    }, z.core.$strip>, z.ZodObject<{
-      provider: z.ZodLiteral<"cloudflare">;
-      ttl: z.ZodOptional<z.ZodNumber>;
-    }, z.core.$strip>, z.ZodObject<{
-      provider: z.ZodLiteral<"manual">;
-    }, z.core.$strip>], "provider">, z.ZodObject<{
-      provider: z.ZodCustom<{
-        name: string;
-        getRecords: Function;
-        upsertRecords: Function;
-      }, {
-        name: string;
-        getRecords: Function;
-        upsertRecords: Function;
-      }>;
-      ttl: z.ZodOptional<z.ZodNumber>;
-    }, z.core.$strip>]>>, z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
-      provider: z.ZodLiteral<"hostinger">;
-      ttl: z.ZodOptional<z.ZodNumber>;
-      domain: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      provider: z.ZodLiteral<"route53">;
-      region: z.ZodOptional<z.ZodEnum<{
-        "us-east-1": "us-east-1";
-        "us-east-2": "us-east-2";
-        "us-west-1": "us-west-1";
-        "us-west-2": "us-west-2";
-        "af-south-1": "af-south-1";
-        "ap-east-1": "ap-east-1";
-        "ap-south-1": "ap-south-1";
-        "ap-south-2": "ap-south-2";
-        "ap-southeast-1": "ap-southeast-1";
-        "ap-southeast-2": "ap-southeast-2";
-        "ap-southeast-3": "ap-southeast-3";
-        "ap-southeast-4": "ap-southeast-4";
-        "ap-northeast-1": "ap-northeast-1";
-        "ap-northeast-2": "ap-northeast-2";
-        "ap-northeast-3": "ap-northeast-3";
-        "ca-central-1": "ca-central-1";
-        "eu-central-1": "eu-central-1";
-        "eu-central-2": "eu-central-2";
-        "eu-west-1": "eu-west-1";
-        "eu-west-2": "eu-west-2";
-        "eu-west-3": "eu-west-3";
-        "eu-south-1": "eu-south-1";
-        "eu-south-2": "eu-south-2";
-        "eu-north-1": "eu-north-1";
-        "me-south-1": "me-south-1";
-        "me-central-1": "me-central-1";
-        "sa-east-1": "sa-east-1";
-      }>>;
-      profile: z.ZodOptional<z.ZodString>;
-      hostedZoneId: z.ZodOptional<z.ZodString>;
-      ttl: z.ZodOptional<z.ZodNumber>;
-      domain: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      provider: z.ZodLiteral<"cloudflare">;
-      ttl: z.ZodOptional<z.ZodNumber>;
-      domain: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      provider: z.ZodLiteral<"manual">;
-      domain: z.ZodString;
-    }, z.core.$strip>], "provider">, z.ZodObject<{
-      provider: z.ZodCustom<{
-        name: string;
-        getRecords: Function;
-        upsertRecords: Function;
-      }, {
-        name: string;
-        getRecords: Function;
-        upsertRecords: Function;
-      }>;
-      ttl: z.ZodOptional<z.ZodNumber>;
-      domain: z.ZodString;
-    }, z.core.$strip>]>]>>;
-    backups: z.ZodOptional<z.ZodObject<{
-      type: z.ZodLiteral<"s3">;
-      profile: z.ZodOptional<z.ZodString>;
-      region: z.ZodEnum<{
-        "us-east-1": "us-east-1";
-        "us-east-2": "us-east-2";
-        "us-west-1": "us-west-1";
-        "us-west-2": "us-west-2";
-        "af-south-1": "af-south-1";
-        "ap-east-1": "ap-east-1";
-        "ap-south-1": "ap-south-1";
-        "ap-south-2": "ap-south-2";
-        "ap-southeast-1": "ap-southeast-1";
-        "ap-southeast-2": "ap-southeast-2";
-        "ap-southeast-3": "ap-southeast-3";
-        "ap-southeast-4": "ap-southeast-4";
-        "ap-northeast-1": "ap-northeast-1";
-        "ap-northeast-2": "ap-northeast-2";
-        "ap-northeast-3": "ap-northeast-3";
-        "ca-central-1": "ca-central-1";
-        "eu-central-1": "eu-central-1";
-        "eu-central-2": "eu-central-2";
-        "eu-west-1": "eu-west-1";
-        "eu-west-2": "eu-west-2";
-        "eu-west-3": "eu-west-3";
-        "eu-south-1": "eu-south-1";
-        "eu-south-2": "eu-south-2";
-        "eu-north-1": "eu-north-1";
-        "me-south-1": "me-south-1";
-        "me-central-1": "me-central-1";
-        "sa-east-1": "sa-east-1";
-      }>;
-      schedule: z.ZodOptional<z.ZodString>;
-      retention: z.ZodOptional<z.ZodNumber>;
-    }, z.core.$strip>>;
-  }, z.core.$strip>>;
-  services: z.ZodOptional<z.ZodObject<{
-    db: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
-      version: z.ZodOptional<z.ZodString>;
-      image: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>]>>;
-    cache: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
-      version: z.ZodOptional<z.ZodString>;
-      image: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>, z.ZodEnum<{
-      upstash: "upstash";
-      elasticache: "elasticache";
-      db: "db";
-    }>]>>;
-    mail: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
-      version: z.ZodOptional<z.ZodString>;
-      image: z.ZodOptional<z.ZodString>;
-      smtp: z.ZodOptional<z.ZodObject<{
-        host: z.ZodString;
-        port: z.ZodNumber;
-        user: z.ZodOptional<z.ZodString>;
-        pass: z.ZodOptional<z.ZodString>;
-      }, z.core.$strip>>;
-    }, z.core.$strip>, z.ZodEnum<{
-      resend: "resend";
-      ses: "ses";
-      smtp: "smtp";
-    }>]>>;
-    storage: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
-      version: z.ZodOptional<z.ZodString>;
-      image: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>, z.ZodEnum<{
-      minio: "minio";
-      s3: "s3";
-      r2: "r2";
-    }>]>>;
-    events: z.ZodOptional<z.ZodEnum<{
-      pgboss: "pgboss";
-      sns: "sns";
-      rabbitmq: "rabbitmq";
-    }>>;
-    trustLocalCa: z.ZodOptional<z.ZodBoolean>;
-  }, z.core.$strip>>;
-  stages: z.ZodObject<{
-    local: z.ZodString;
-    deployed: z.ZodArray<z.ZodString>;
-    protected: z.ZodOptional<z.ZodArray<z.ZodString>>;
-  }, z.core.$strip>;
-  secrets: z.ZodOptional<z.ZodObject<{
-    enabled: z.ZodOptional<z.ZodBoolean>;
-    algorithm: z.ZodOptional<z.ZodString>;
-    kdf: z.ZodOptional<z.ZodEnum<{
-      scrypt: "scrypt";
-      pbkdf2: "pbkdf2";
-    }>>;
-  }, z.core.$strip>>;
-  state: z.ZodOptional<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
-    provider: z.ZodLiteral<"local">;
-  }, z.core.$strip>, z.ZodObject<{
-    provider: z.ZodLiteral<"ssm">;
-    region: z.ZodEnum<{
-      "us-east-1": "us-east-1";
-      "us-east-2": "us-east-2";
-      "us-west-1": "us-west-1";
-      "us-west-2": "us-west-2";
-      "af-south-1": "af-south-1";
-      "ap-east-1": "ap-east-1";
-      "ap-south-1": "ap-south-1";
-      "ap-south-2": "ap-south-2";
-      "ap-southeast-1": "ap-southeast-1";
-      "ap-southeast-2": "ap-southeast-2";
-      "ap-southeast-3": "ap-southeast-3";
-      "ap-southeast-4": "ap-southeast-4";
-      "ap-northeast-1": "ap-northeast-1";
-      "ap-northeast-2": "ap-northeast-2";
-      "ap-northeast-3": "ap-northeast-3";
-      "ca-central-1": "ca-central-1";
-      "eu-central-1": "eu-central-1";
-      "eu-central-2": "eu-central-2";
-      "eu-west-1": "eu-west-1";
-      "eu-west-2": "eu-west-2";
-      "eu-west-3": "eu-west-3";
-      "eu-south-1": "eu-south-1";
-      "eu-south-2": "eu-south-2";
-      "eu-north-1": "eu-north-1";
-      "me-south-1": "me-south-1";
-      "me-central-1": "me-central-1";
-      "sa-east-1": "sa-east-1";
-    }>;
-    profile: z.ZodOptional<z.ZodString>;
-  }, z.core.$strip>], "provider">, z.ZodObject<{
-    provider: z.ZodCustom<{
-      read: Function;
-      write: Function;
-    }, {
-      read: Function;
-      write: Function;
-    }>;
-  }, z.core.$strip>]>>;
-}, z.core.$strip>;
-/**
- * Validate workspace configuration.
- * Throws ZodError with detailed messages on validation failure.
- */
-declare function validateWorkspaceConfig(config: unknown): z.infer<typeof WorkspaceConfigSchema>;
-/**
- * Safe validation that returns result instead of throwing.
- */
-declare function safeValidateWorkspaceConfig(config: unknown): {
-  success: boolean;
-  data?: z.infer<typeof WorkspaceConfigSchema>;
-  error?: z.ZodError;
-};
-/**
- * Format Zod errors into user-friendly messages.
- */
-declare function formatValidationErrors(error: z.ZodError): string;
-//#endregion
-//#region src/workspace/types.d.ts
-/**
- * Deploy target for an app.
- *
- * Specifies where the app will be deployed.
- *
- * @example
- * ```ts
- * // Currently supported
- * deploy: 'dokploy'
- *
- * // Future support (not yet implemented)
- * deploy: 'vercel'
- * deploy: 'cloudflare'
- * ```
- */
-type DeployTarget = 'dokploy' | 'vercel' | 'cloudflare';
-/**
- * Service image configuration for custom Docker images.
- *
- * @example
- * ```ts
- * // Use specific version
- * db: { version: '18-alpine' }
- *
- * // Use custom image
- * db: { image: 'timescale/timescaledb:latest-pg16' }
- * ```
- */
-interface ServiceImageConfig {
-  /** Docker image version/tag (e.g., '18-alpine') */
-  version?: string;
-  /** Full Docker image reference (overrides version) */
-  image?: string;
-}
-/**
- * Mail service configuration.
- *
- * In development, uses Mailpit for email testing.
- * In production, uses SMTP configuration.
- *
- * @example
- * ```ts
- * services: {
- *   mail: {
- *     smtp: {
- *       host: 'smtp.sendgrid.net',
- *       port: 587,
- *       user: 'apikey',
- *       pass: process.env.SENDGRID_API_KEY,
- *     }
- *   }
- * }
- * ```
- */
-interface MailServiceConfig extends ServiceImageConfig {
-  /** SMTP configuration for production */
-  smtp?: {
-    host: string;
-    port: number;
-    user?: string;
-    pass?: string;
-  };
-}
-/**
- * Development services configuration.
- *
- * Configures shared infrastructure services like databases and caches.
- * These are automatically provisioned in Dokploy during deployment.
- *
- * @example
- * ```ts
- * // Enable with defaults
- * services: {
- *   db: true,      // postgres:18-alpine
- *   cache: true,   // redis:8-alpine
- * }
- *
- * // Custom versions
- * services: {
- *   db: { version: '18-alpine' },
- *   cache: { version: '7-alpine' },
- * }
- *
- * // Custom images
- * services: {
- *   db: { image: 'timescale/timescaledb:latest-pg16' },
- * }
- *
- * // With mail service
- * services: {
- *   db: true,
- *   cache: true,
- *   mail: true,  // Mailpit in dev
- * }
- *
- * // With event backend
- * services: {
- *   db: true,
- *   cache: true,
- *   events: 'pgboss',    // reuses postgres (auto-enables db)
- *   // events: 'sns',    // adds LocalStack container
- *   // events: 'rabbitmq', // adds RabbitMQ container
- * }
- * ```
- */
-interface ServicesConfig {
-  /**
-   * Whether to install the local edge's certificate authority automatically.
-   *
-   * A declared `file-server` answers on `https://` locally, which needs a
-   * certificate, which needs an authority this machine trusts. Everything gkm
-   * starts trusts it already — reconcile injects `NODE_EXTRA_CA_CERTS` — but a
-   * *browser* asks the operating system, and until the root is in its store a
-   * local address reads as "not secure".
-   *
-   * Installing it needs `sudo`, so it is never silent by default:
-   *
-   * - unset — `gkm setup` asks once, on a machine that does not trust it yet,
-   *   and remembers a "no" so it stops asking.
-   * - `true` — install without asking. For a team that has decided, and for
-   *   any machine where a prompt has nobody to answer it.
-   * - `false` — never. Correct for CI, and for anyone who only ever reaches
-   *   these addresses from code, which trusts the root without any of this.
-   */
-  trustLocalCa?: boolean;
-  /**
-   * Where a declared cache lives — `'upstash'`, `'elasticache'` or `'db'`.
-   *
-   * A backend name and nothing else. Whether there *is* a cache comes from the
-   * manifest: declaring one implies its container the way declaring a database
-   * implies Postgres, so this only ever answers the second question.
-   *
-   * Defaults by target — see `DEFAULT_CACHE`.
-   */
-  cache?: CacheBackend;
-  /**
-   * Who delivers a declared app's mail — `'ses'`, `'resend'` or `'smtp'`.
-   *
-   * Locally every one of them is Mailpit, because every one speaks SMTP.
-   */
-  mail?: EmailBackend;
-  /** Where a declared bucket lives — `'minio'`, `'s3'` or `'r2'`. */
-  storage?: StorageBackend;
-  /** What carries a declared queue or topic — pgboss, sns or rabbitmq. */
-  events?: EventsBackend;
-  /**
-   * Image pins for the containers the manifest derives.
-   *
-   * Separate from the backend names above, because they answer unrelated
-   * questions: a backend says where a thing lives, a pin says which image runs
-   * locally. They shared one key until `cache: true` meant "start a Redis" —
-   * which was the last way a container could exist because config asked for
-   * it rather than because something declared it.
-   *
-   * ```ts
-   * services: { cache: 'elasticache', images: { redis: 'redis:6-alpine' } }
-   * ```
-   *
-   * Pinning an image for a container nothing declares is a no-op, not an
-   * error: it says which image *would* run, and nothing runs.
-   */
-  images?: Partial<Record<ComposeServiceName, string>>;
-}
-/**
- * Stage-based domain configuration.
- *
- * Maps deployment stages to base domains. The main frontend app
- * gets the base domain, other apps get `{appName}.{baseDomain}`.
- *
- * @example
- * ```ts
- * domains: {
- *   development: 'dev.myapp.com',
- *   staging: 'staging.myapp.com',
- *   production: 'myapp.com',
- * }
- *
- * // Result for production stage:
- * // - web (main frontend): myapp.com
- * // - api: api.myapp.com
- * // - auth: auth.myapp.com
- * ```
- */
-type DokployDomainsConfig = Record<string, string>;
-/**
- * Per-app domain override configuration.
- *
- * Can be a single domain string (used for all stages) or
- * stage-specific domains.
- *
- * @example
- * ```ts
- * // Single domain for all stages
- * domain: 'api.custom.com'
- *
- * // Stage-specific domains
- * domain: {
- *   development: 'api.dev.custom.com',
- *   staging: 'api.staging.custom.com',
- *   production: 'api.custom.com',
- * }
- * ```
- */
-type AppDomainConfig = string | Record<string, string>;
-/**
- * Dokploy workspace deployment configuration.
- *
- * Configures how the workspace is deployed to a Dokploy server.
- * One workspace maps to one Dokploy project with stage-based environments.
- * Project IDs are stored in deploy state (not config) and created on first deploy.
- *
- * @example Single endpoint for all stages:
- * ```ts
- * deploy: {
- *   default: 'dokploy',
- *   dokploy: {
- *     endpoint: 'https://dokploy.myserver.com',
- *     registry: 'ghcr.io/myorg',
- *   },
- * }
- * ```
- *
- * @example Per-stage endpoints (different Dokploy servers):
- * ```ts
- * deploy: {
- *   default: 'dokploy',
- *   dokploy: {
- *     endpoints: {
- *       development: 'https://dev-dokploy.myserver.com',
- *       production: 'https://dokploy.myserver.com',
- *     },
- *     registry: 'ghcr.io/myorg',
- *   },
- * }
- * ```
- */
-interface DokployWorkspaceConfig {
-  /** Dokploy API endpoint for all stages */
-  endpoint?: string;
-  /** Per-stage Dokploy API endpoints (overrides endpoint) */
-  endpoints?: Record<string, string>;
-  /** Container registry for Docker images (e.g., 'ghcr.io/myorg') */
-  registry?: string;
-  /** Registry ID in Dokploy (auto-configured) */
-  registryId?: string;
-  /**
-   * Stage-based domain configuration.
-   * The main frontend app gets the base domain.
-   * Other apps get {appName}.{baseDomain} by default.
-   */
-  domains?: DokployDomainsConfig;
-}
-/**
- * DNS provider types for automatic DNS record creation.
- */
-
-/**
- * Deployment configuration for the workspace.
- *
- * @example
- * ```ts
- * // Minimal - just set default target
- * deploy: {
- *   default: 'dokploy',
- * }
- *
- * // Full configuration with DNS and backups
- * deploy: {
- *   default: 'dokploy',
- *   dokploy: {
- *     endpoint: 'https://dokploy.myserver.com',
- *     projectId: 'proj_abc123',
- *     registry: 'ghcr.io/myorg',
- *     domains: {
- *       production: 'myapp.com',
- *     },
- *   },
- *   dns: {
- *     provider: 'hostinger',
- *     domain: 'myapp.com',
- *   },
- *   backups: {
- *     type: 's3',
- *     region: 'us-east-1',
- *   },
- * }
- * ```
- */
-interface DeployConfig {
-  /** Default deploy target for all apps (default: 'dokploy') */
-  default?: DeployTarget;
-  /** Dokploy-specific configuration */
-  dokploy?: DokployWorkspaceConfig;
-  /** DNS configuration for automatic record creation */
-  dns?: DnsConfig;
-  /** Backup destination configuration for database services */
-  backups?: BackupsConfig;
-}
-/**
- * Models package configuration for shared schemas.
- *
- * Configures a shared models package containing Zod schemas
- * that can be used across backend and frontend apps.
- *
- * @example
- * ```ts
- * shared: {
- *   models: {
- *     path: 'packages/models',
- *     schema: 'zod',
- *   },
- * }
- * ```
- */
-interface ModelsConfig {
-  /** Path to models package relative to workspace root (default: 'packages/models') */
-  path?: string;
-  /**
-   * Schema library to use (default: 'zod').
-   * Currently only 'zod' is supported.
-   * Future: any StandardSchema-compatible library
-   */
-  schema?: 'zod';
-}
-/**
- * Shared packages configuration.
- *
- * Configures shared packages in the monorepo that are
- * used by multiple apps.
- *
- * @example
- * ```ts
- * shared: {
- *   packages: ['packages/*', 'libs/*'],
- *   models: {
- *     path: 'packages/models',
- *     schema: 'zod',
- *   },
- * }
- * ```
- */
-interface SharedConfig {
-  /** Glob patterns for shared packages (default: ['packages/*']) */
-  packages?: string[];
-  /** Models package configuration */
-  models?: ModelsConfig;
-}
-/**
- * The project's stages, named by the project.
- *
- * Stage names were literals scattered through the CLI — `gkm dev` ran as
- * `development` and looked for `dev` secrets first, a deploy script said
- * `production` — so a team that called its stages anything else was
- * working against the tool. They are declared once, here, and read.
- *
- * @example
- * ```ts
- * stages: { local: 'dev', deployed: ['staging', 'prod'], protected: ['prod'] }
- * ```
- */
-interface StagesConfig {
-  /**
-   * What `gkm dev`, `exec`, `setup` and `test` run as: the stage whose
-   * secrets are read locally, and whose containers carry no suffix.
-   *
-   * Never also a deployed stage. Secrets are stored per stage name, so a
-   * deployed stage sharing it would share its secrets with every laptop.
-   */
-  local: string;
-  /** The stages `gkm deploy --stage` accepts. */
-  deployed: string[];
-  /**
-   * Deployed stages whose resources outlive the stack that made them —
-   * retained on removal and protected, e.g. the stage users are on.
-   */
-  protected?: string[];
-}
-/**
- * Secrets encryption configuration.
- *
- * Configures how secrets are encrypted for deployment.
- * Secrets are stored encrypted in `.gkm/secrets/{stage}.json`
- * with keys stored separately in `~/.gkm/{project}/{stage}.key`.
- *
- * @example
- * ```ts
- * secrets: {
- *   enabled: true,
- *   algorithm: 'aes-256-gcm',
- *   kdf: 'scrypt',
- * }
- * ```
- */
-interface SecretsConfig {
-  /** Enable encrypted secrets (default: true) */
-  enabled?: boolean;
-  /** Encryption algorithm (default: 'aes-256-gcm') */
-  algorithm?: string;
-  /** Key derivation function (default: 'scrypt') */
-  kdf?: 'scrypt' | 'pbkdf2';
-}
-/**
- * Base app configuration properties (shared between input and normalized).
- *
- * @example
- * ```ts
- * // Backend app with gkm routes
- * api: {
- *   type: 'backend',
- *   path: 'apps/api',
- *   port: 3000,
- *   routes: './src/endpoints/**\/*.ts',
- *   envParser: './src/config/env',
- *   logger: './src/config/logger',
- * }
- *
- * // Backend app with entry point (e.g., Better Auth)
- * auth: {
- *   type: 'backend',
- *   path: 'apps/auth',
- *   port: 3001,
- *   entry: './src/index.ts',
- *   framework: 'better-auth',
- *   requiredEnv: ['DATABASE_URL', 'BETTER_AUTH_SECRET'],
- * }
- *
- * // Frontend app
- * web: {
- *   type: 'web',
- *   path: 'apps/web',
- *   port: 3002,
- *   framework: 'nextjs',
- *   dependencies: ['api', 'auth'],
- * }
- * ```
- */
-interface AppConfigBase {
-  /**
-   * App type.
-   * - 'backend': Server-side app (API, auth service, etc.)
-   * - 'web': Client-side web app (Next.js, Vite, TanStack Start, etc.)
-   * - 'mobile': Native mobile app (Expo). Built/deployed via its own
-   *   toolchain (e.g. EAS Build) — Docker/Dokploy steps are skipped.
-   * @default 'backend'
-   */
-  type?: 'backend' | 'web' | 'mobile';
-  /**
-   * Path to the app relative to workspace root.
-   * @example 'apps/api', 'apps/web', 'services/auth'
-   */
-  path: string;
-  /**
-   * Development server port.
-   * Must be unique across all apps in the workspace.
-   * @example 3000, 3001, 3002
-   */
-  port: number;
-  /**
-   * Per-app deploy target override.
-   * Overrides `deploy.default` for this specific app.
-   * @example 'dokploy', 'vercel'
-   */
-  deploy?: DeployTarget;
-  /**
-   * Constructs glob pattern — one glob, every kind.
-   *
-   * A glob per kind cannot find a resource, because a declared `ObjectStorage`
-   * has no kind to be listed under. This one is what reconcile reads to derive
-   * the containers a stage needs, and it replaces the per-kind globs below.
-   *
-   * @example './src/**\/*.ts'
-   */
-  constructs?: Routes;
-  /**
-   * Routes glob pattern for gkm endpoints.
-   * @example './src/endpoints/**\/*.ts'
-   */
-  routes?: Routes;
-  /**
-   * Functions glob pattern for Lambda functions.
-   * @example './src/functions/**\/*.ts'
-   */
-  functions?: Routes;
-  /**
-   * Crons glob pattern for scheduled tasks.
-   * @example './src/crons/**\/*.ts'
-   */
-  crons?: Routes;
-  /**
-   * Queues glob pattern for point-to-point workers.
-   * @example './src/queues/**\/*.ts'
-   */
-  queues?: Routes;
-  /**
-   * Topics glob pattern for the topics subscribers bind to.
-   * @example './src/topics/**\/*.ts'
-   */
-  topics?: Routes;
-  /**
-   * Subscribers glob pattern for event handlers.
-   * @example './src/subscribers/**\/*.ts'
-   */
-  subscribers?: Routes;
-  /**
-   * Path to environment parser module.
-   * @example './src/config/env'
-   */
-  envParser?: string;
-  /**
-   * Path to logger module.
-   * @example './src/config/logger'
-   */
-  logger?: string;
-  /** Provider configuration (AWS, Docker, etc.) */
-  providers?: ProvidersConfig;
-  /**
-   * Server lifecycle hooks.
-   * @example { beforeSetup: './src/hooks/setup.ts' }
-   */
-  hooks?: HooksConfig;
-  /**
-   * Telescope debugging dashboard configuration.
-   * @example true, './src/config/telescope', { enabled: true, path: '/__telescope' }
-   */
-  telescope?: string | boolean | TelescopeConfig;
-  /**
-   * Studio admin panel configuration.
-   * @example true, './src/config/studio'
-   */
-  studio?: string | boolean | StudioConfig;
-  /**
-   * OpenAPI documentation configuration.
-   * @example true, { output: './src/openapi.ts' }
-   */
-  openapi?: boolean | OpenApiConfig;
-  /**
-   * Runtime environment.
-   * @default 'node'
-   */
-  runtime?: Runtime;
-  /**
-   * Environment file(s) to load during development.
-   * @example '.env', ['.env', '.env.local']
-   */
-  env?: string | string[];
-  /**
-   * Entry file path for apps that don't use gkm routes.
-   *
-   * When specified, the app is run directly with tsx in development
-   * and bundled with esbuild for production Docker builds.
-   *
-   * Use this for:
-   * - Better Auth servers
-   * - Custom Hono/Express apps
-   * - Any backend that doesn't use gkm's endpoint builder
-   *
-   * @example './src/index.ts', './src/server.ts'
-   */
-  entry?: string;
-  /**
-   * Framework for the app.
-   *
-   * Backend frameworks: 'hono', 'better-auth', 'express', 'fastify'
-   * Frontend frameworks: 'nextjs', 'remix', 'vite', 'tanstack-start'
-   * Mobile frameworks: 'expo'
-   *
-   * @example 'nextjs', 'better-auth', 'hono', 'expo'
-   */
-  framework?: Framework;
-  /**
-   * Config file paths for frontend environment sniffing.
-   *
-   * Points to file(s) that call EnvironmentParser.parse() at import time.
-   * The sniffer imports these files and captures all env vars accessed.
-   *
-   * Dependencies are auto-generated as public-prefixed URL vars based on
-   * the app's framework (e.g. `NEXT_PUBLIC_{DEP}_URL` for Next.js,
-   * `VITE_{DEP}_URL` for Vite/TanStack Start, `EXPO_PUBLIC_{DEP}_URL`
-   * for Expo).
-   *
-   * @example
-   * ```ts
-   * config: {
-   *   client: './src/config/client.ts',  // public-prefixed vars for browser
-   *   server: './src/config/server.ts',  // server-only vars for SSR
-   * }
-   * ```
-   */
-  config?: {
-    /** Client-side config (public-prefixed vars, available in browser/device) */
-    client?: string;
-    /** Server-side config (all env vars, for SSR/API routes) */
-    server?: string;
-  };
-  /**
-   * Override domain for this app.
-   *
-   * By default, apps get `{appName}.{baseDomain}` (or just `{baseDomain}`
-   * for the main frontend). Use this to specify a custom domain.
-   *
-   * @example
-   * ```ts
-   * // Single domain for all stages
-   * domain: 'api.custom.com'
-   *
-   * // Stage-specific domains
-   * domain: {
-   *   production: 'api.custom.com',
-   *   staging: 'api.staging.custom.com',
-   * }
-   * ```
-   */
-  domain?: AppDomainConfig;
-  /**
-   * Required environment variables for entry-based apps.
-   *
-   * Use this instead of envParser for apps that don't use gkm routes.
-   * The deploy command uses this list to filter which secrets to embed
-   * in the Docker image.
-   *
-   * @example ['DATABASE_URL', 'BETTER_AUTH_SECRET', 'REDIS_URL']
-   */
-  requiredEnv?: string[];
-}
-/**
- * App configuration input with type-safe dependencies.
- *
- * @template TAppNames - Union of valid app names in the workspace (auto-inferred)
- *
- * @example
- * ```ts
- * // Dependencies are type-checked against app names
- * apps: {
- *   api: { path: 'apps/api', port: 3000 },
- *   auth: { path: 'apps/auth', port: 3001 },
- *   web: {
- *     path: 'apps/web',
- *     port: 3002,
- *     type: 'web',
- *     dependencies: ['api', 'auth'],  // ✓ Valid
- *     // dependencies: ['invalid'],   // ✗ Type error
- *   },
- * }
- * ```
- */
-interface AppConfigInput<TAppNames extends string = string> extends AppConfigBase {
-  /** Dependencies on other apps in the workspace (type-safe) */
-  dependencies?: TAppNames[];
-}
-/**
- * App configuration (legacy, for backwards compatibility).
- * @deprecated Use AppConfigInput for new code
- */
-interface AppConfig extends AppConfigBase {
-  /** Dependencies on other apps in the workspace */
-  dependencies?: string[];
-}
-/**
- * Base app input type for type inference.
- */
-type AppInput = AppConfigBase & {
-  dependencies?: readonly string[];
-};
-/**
- * Apps record type for workspace configuration.
- */
-type AppsRecord = Record<string, AppInput>;
-/**
- * Constrain apps so dependencies only reference valid app names.
- * Dependencies must be an array of valid app names from the workspace.
- */
-type ConstrainedApps<TApps extends AppsRecord> = { [K in keyof TApps]: Omit<TApps[K], 'dependencies'> & {
-  dependencies?: readonly (keyof TApps & string)[];
-} };
-/**
- * Full workspace input type with constrained dependencies.
- *
- * @example
- * ```ts
- * import { defineWorkspace } from '@geekmidas/cli';
- *
- * export default defineWorkspace({
- *   name: 'my-app',
- *   apps: {
- *     api: {
- *       path: 'apps/api',
- *       port: 3000,
- *       routes: './src/endpoints/**\/*.ts',
- *     },
- *     web: {
- *       type: 'web',
- *       path: 'apps/web',
- *       port: 3001,
- *       framework: 'nextjs',
- *       dependencies: ['api'],
- *     },
- *   },
- *   services: {
- *     db: true,
- *     cache: true,
- *   },
- *   deploy: {
- *     default: 'dokploy',
- *   },
- * });
- * ```
- */
-type WorkspaceInput<TApps extends AppsRecord> = {
-  /**
-   * Where the workspace's own constructs live, relative to its root.
-   *
-   * The product's infrastructure, declared once for every app that consumes
-   * it. Additive with an app's own glob rather than replacing it.
-   */
-  constructs?: Routes;
-  /** Workspace name (defaults to root package.json name) */
-  name?: string;
-  /**
-   * Apps that nothing declares.
-   *
-   * Normally absent: a `site` is an app and so is a `rest-api` that named
-   * one, so the list is read off the graph. This is the escape hatch for what
-   * no construct describes.
-   */
-  apps?: ConstrainedApps<TApps>;
-  /** Shared packages configuration */
-  shared?: SharedConfig;
-  /** Deployment configuration */
-  deploy?: DeployConfig;
-  /** Development services (db, cache, mail, storage, events) */
-  services?: ServicesConfig;
-  /** The project's stages: which one is local, which deploy */
-  stages: StagesConfig;
-  /** Encrypted secrets configuration */
-  secrets?: SecretsConfig;
-  /** State provider configuration (local filesystem by default, or SSM for team collaboration) */
-  state?: StateConfig;
-};
-/**
- * Extract app names from apps record.
- */
-type InferAppNames<TApps extends AppsRecord> = keyof TApps & string;
-/**
- * Inferred workspace config with proper app name types.
- */
-type InferredWorkspaceConfig<TApps extends AppsRecord> = {
-  /**
-   * Where the workspace's own constructs live, relative to its root.
-   *
-   * The product's infrastructure, declared once for every app that consumes
-   * it. Additive with an app's own glob rather than replacing it.
-   */
-  constructs?: Routes;
-  name?: string;
-  apps?: { [K in keyof TApps]: Omit<TApps[K], 'dependencies'> & {
-    dependencies?: InferAppNames<TApps>[];
-  } };
-  shared?: SharedConfig;
-  deploy?: DeployConfig;
-  services?: ServicesConfig;
-  stages: StagesConfig;
-  secrets?: SecretsConfig;
-  state?: StateConfig;
-};
-/** @deprecated Use WorkspaceInput */
-
-/**
- * Workspace configuration for multi-app monorepos.
- *
- * Use `defineWorkspace()` helper for type-safe configuration with
- * auto-completion and dependency validation.
- *
- * @example
- * ```ts
- * // gkm.config.ts
- * import { defineWorkspace } from '@geekmidas/cli';
- *
- * export default defineWorkspace({
- *   name: 'my-saas',
- *
- *   // App definitions
- *   apps: {
- *     // Backend API with gkm routes
- *     api: {
- *       path: 'apps/api',
- *       port: 3000,
- *       routes: './src/endpoints/**\/*.ts',
- *       envParser: './src/config/env',
- *       logger: './src/config/logger',
- *       telescope: true,
- *     },
- *
- *     // Better Auth service
- *     auth: {
- *       path: 'apps/auth',
- *       port: 3001,
- *       entry: './src/index.ts',
- *       framework: 'better-auth',
- *       requiredEnv: ['DATABASE_URL', 'BETTER_AUTH_SECRET'],
- *     },
- *
- *     // Next.js frontend
- *     web: {
- *       type: 'web',
- *       path: 'apps/web',
- *       port: 3002,
- *       framework: 'nextjs',
- *       dependencies: ['api', 'auth'],
- *     },
- *   },
- *
- *   // Infrastructure services
- *   services: {
- *     db: true,      // PostgreSQL
- *     cache: true,   // Redis
- *   },
- *
- *   // Deployment configuration
- *   deploy: {
- *     default: 'dokploy',
- *     dokploy: {
- *       endpoint: 'https://dokploy.myserver.com',
- *       projectId: 'proj_abc123',
- *       registry: 'ghcr.io/myorg',
- *       domains: {
- *         production: 'myapp.com',
- *         staging: 'staging.myapp.com',
- *       },
- *     },
- *   },
- *
- *   // Shared packages
- *   shared: {
- *     packages: ['packages/*'],
- *     models: { path: 'packages/models' },
- *   },
- * });
- * ```
- *
- * @deprecated Use WorkspaceInput with defineWorkspace for type inference
- */
-interface WorkspaceConfig {
-  /**
-   * Where the workspace's own constructs live, relative to its root.
-   *
-   * The product's infrastructure, declared once for every app that consumes
-   * it. Additive with an app's own glob rather than replacing it.
-   */
-  constructs?: Routes;
-  /** Workspace name (defaults to root package.json name) */
-  name?: string;
-  /** Apps that nothing declares. Normally absent — see `WorkspaceInput`. */
-  apps?: Record<string, AppConfig>;
-  /** Shared packages configuration */
-  shared?: SharedConfig;
-  /** Default deployment configuration */
-  deploy?: DeployConfig;
-  /** Development services (db, cache, mail, storage, events) */
-  services?: ServicesConfig;
-  /** The project's stages: which one is local, which deploy */
-  stages: StagesConfig;
-  /** Encrypted secrets configuration */
-  secrets?: SecretsConfig;
-  /** State provider configuration (local filesystem by default, or SSM for team collaboration) */
-  state?: StateConfig;
-}
-/**
- * Normalized app configuration with resolved defaults.
- *
- * This is the internal representation after processing user input.
- * All optional fields have been resolved to their defaults.
- */
-interface NormalizedAppConfig extends Omit<AppConfigBase, 'type'> {
-  /**
-   * Whether the base domain points at this site.
-   *
-   * Carried from the `site` declaration rather than configured, because which
-   * site is primary is structural — its *hostname* is what varies by stage,
-   * and that is `domain`.
-   */
-  root?: boolean;
-  /** App type (always defined after normalization) */
-  type: 'backend' | 'web' | 'mobile';
-  /** Path to the app */
-  path: string;
-  /** Development server port */
-  port: number;
-  /** Resolved dependencies array (empty array if none) */
-  dependencies: string[];
-  /** Resolved deploy target (app.deploy > deploy.default > 'dokploy') */
-  resolvedDeployTarget: DeployTarget;
-  /** Entry file path for non-gkm apps */
-  entry?: string;
-  /** Framework for the app */
-  framework?: Framework;
-  /** Override domain for this app */
-  domain?: AppDomainConfig;
-  /** Required environment variables for entry-based apps */
-  requiredEnv?: string[];
-}
-/**
- * Normalized workspace configuration with resolved defaults.
- *
- * This is the internal representation after processing user input.
- * All optional fields have been resolved to their defaults.
- */
-interface NormalizedWorkspace {
-  /** Workspace name (resolved from package.json if not specified) */
-  name: string;
-  /** Absolute path to workspace root */
-  root: string;
-  /**
-   * The workspace's own constructs glob, relative to `root`.
-   *
-   * Where the product's shared infrastructure is declared. Additive with each
-   * app's glob, so an app can still declare something only it uses.
-   */
-  constructs?: Routes;
-  /** Normalized app configurations */
-  apps: Record<string, NormalizedAppConfig>;
-  /** Services configuration (empty object if not specified) */
-  services: ServicesConfig;
-  /** Deploy configuration (empty object if not specified) */
-  deploy: DeployConfig;
-  /** Shared packages configuration (empty object if not specified) */
-  shared: SharedConfig;
-  /** The project's stages, as declared */
-  stages: StagesConfig;
-  /** Secrets configuration (empty object if not specified) */
-  secrets: SecretsConfig;
-  /** State provider configuration (undefined = local filesystem) */
-  state?: StateConfig;
-}
-/**
- * Result of loading and processing a configuration.
- */
-interface LoadedConfig {
-  /** Whether this is a single-app or workspace config */
-  type: 'single' | 'workspace';
-  /** The raw configuration as loaded */
-  raw: GkmConfig | WorkspaceConfig;
-  /** Normalized workspace (always available) */
-  workspace: NormalizedWorkspace;
-  /**
-   * What the workspace's constructs declared, when it has any.
-   *
-   * Read once at load, because the apps above are derived from it and a
-   * caller that re-discovers would be answering the same question twice with
-   * two chances to disagree. Absent when the workspace declares no constructs.
-   */
-  manifest?: ConstructManifest;
-}
-/**
- * Type guard to check if a config is a WorkspaceConfig.
- *
- * @example
- * ```ts
- * const config = await loadConfig();
- * if (isWorkspaceConfig(config)) {
- *   // config.apps is available
- *   console.log(Object.keys(config.apps));
- * }
- * ```
- */
-declare function isWorkspaceConfig(config: GkmConfig | WorkspaceConfig): config is WorkspaceConfig;
-//# sourceMappingURL=types.d.ts.map
-//#endregion
-//#region src/types.d.ts
-interface PartitionedRoutes {
-  paths: string | string[];
-  partition: (filepath: string) => string;
-}
-type Routes = string | string[] | PartitionedRoutes;
-interface ProviderConfig {
-  enabled?: boolean;
-  outputDir?: string;
-}
-interface AWSApiGatewayConfig extends ProviderConfig {}
-interface AWSLambdaConfig extends ProviderConfig {}
-interface ProductionConfig {
-  /** Enable production mode (default: false) */
-  enabled?: boolean;
-  /** Bundle server into single file (default: true) */
-  bundle?: boolean;
-  /** Minify bundled output (default: true) */
-  minify?: boolean;
-  /** Health check endpoint path (default: '/health') */
-  healthCheck?: string;
-  /** Enable graceful shutdown handling (default: true) */
-  gracefulShutdown?: boolean;
-  /** Packages to exclude from bundling (default: []) */
-  external?: string[];
-  /** Include subscribers in production build (default: 'exclude' for serverless) */
-  subscribers?: 'include' | 'exclude';
-  /** Include OpenAPI spec in production (default: false) */
-  openapi?: boolean;
-  /**
-   * Enable build-time optimized handler generation (default: true)
-   * Generates specialized handlers based on endpoint tier:
-   * - minimal: Near-raw-Hono performance for simple endpoints
-   * - standard: Optimized handlers for auth/services
-   * - full: Uses HonoEndpoint.addRoutes for complex endpoints
-   */
-  optimizedHandlers?: boolean;
-}
-/** Service-specific configuration for docker-compose */
-interface ServiceConfig {
-  /**
-   * Full Docker image reference (e.g., 'postgis/postgis:16-3.4-alpine').
-   * When specified, overrides the default image entirely.
-   */
-  image?: string;
-  /**
-   * Docker image version/tag (e.g., '15-alpine' for postgres).
-   * Only used when `image` is not specified.
-   */
-  version?: string;
-}
-/**
- * Supported event backend types.
- *
- * - `pgboss`: Reuses PostgreSQL with a dedicated user/schema. Auto-enables db service.
- * - `sns`: Adds LocalStack container with SNS+SQS services.
- * - `rabbitmq`: Adds RabbitMQ container.
- *
- * All backends generate EVENT_PUBLISHER_CONNECTION_STRING and EVENT_SUBSCRIBER_CONNECTION_STRING.
- */
-type EventsBackend = 'pgboss' | 'sns' | 'rabbitmq';
-/**
- * Where a declared cache actually lives.
- *
- * A deployment choice, not an application one — the same code caches into any
- * of these — so it is config here beside `events` rather than a field on the
- * construct. Each backend is consistent between local and deployed, which is
- * the property worth having: a cache that behaves differently in the two places
- * is worse than a slower one.
- *
- * - `upstash` (default) — HTTP with a token. Reachable from a Lambda with no
- *   VPC and no connection pool, which is why it is the default; locally the
- *   `serverless-redis-http` proxy in front of Redis speaks the same protocol.
- * - `elasticache` — the Redis wire protocol, inside a VPC. Locally, plain Redis.
- * - `db` — a table in the database the app already declared. No infrastructure
- *   at all, and the same relationship pg-boss has to Postgres: it creates its
- *   own table on first use and needs a declared database to live in.
- */
-type CacheBackend = 'upstash' | 'elasticache' | 'db';
-/**
- * Where a declared bucket actually lives.
- *
- * The fourth of these selectors and the last to arrive, which is why
- * `UPLOADS_URL` had no answer on a container target: there was nothing to
- * choose with. Like the others it changes no application code — the `s3://`
- * scheme picks the driver, and every one of these speaks it.
- *
- * - `s3` — a real bucket. Nothing is created on the host; the URL is composed
- *   against credentials you already hold, the same way `resend` is an API key
- *   rather than infrastructure.
- * - `r2` — Cloudflare's, reached through the same S3 API and differing only in
- *   its endpoint.
- * - `minio` — a container. Everything the app declares lives on the box, which
- *   is what makes a single-host deploy self-contained, and what makes it a
- *   single disk with no replication. Locally this is what every backend is.
- */
-type StorageBackend = 'minio' | 's3' | 'r2';
-/**
- * The backend a project gets when it says nothing, by where it deploys.
- *
- * Flat defaults could not be right for both: `upstash` on a single box means a
- * SaaS round-trip for a cache the database could have held, and `minio` on AWS
- * means running a bucket beside S3. So the default is a function of the target,
- * and an app that says nothing gets the obvious answer in both places — which
- * is the whole of what "zero config" can mean once there is more than one
- * target.
- *
- * `server` covers Dokploy and a bare host alike: the question these answer is
- * whether the app is next to a managed cloud or next to its own containers, and
- * on that question the two are the same.
- *
- * A per-construct, per-stage override is the layer above this — see
- * `constructs-outstanding.md` — so two buckets in one app can differ. This is
- * only what happens when nobody has said anything at all.
- */
-
-/**
- * Who delivers a declared app's mail.
- *
- * Unlike a cache, this changes *nothing* about the client. Every backend speaks
- * SMTP, so the declaration's `smtp://` URL is true of all of them and only the
- * provisioner differs — which is the same reason the declaration has no
- * `provider` field and there is no `ses://` scheme.
- *
- * - `ses` (default) — the only backend that can be a *chain* of resources: an
- *   identity, a user, an access key, and an SMTP password derived from it,
- *   because SES issues IAM credentials rather than SMTP ones. Hand it a URL and
- *   it uses that instead, which is what you want when the credentials already
- *   exist — provisioning a second set of sending credentials for an identity
- *   that already has them is not a thing to do by default.
- * - `resend` — an API key you hold, composed into an SMTP URL. Nothing to
- *   provision: a SaaS account is not infrastructure.
- * - `smtp` — a URL supplied whole, for a relay somebody else runs.
- *
- * Locally every one of them is Mailpit, because locally none of it matters.
- */
-type EmailBackend = 'resend' | 'ses' | 'smtp';
-/**
- * Who delivers mail when nobody said.
- *
- * Flat, unlike the others, and deliberately: mail is a SaaS on every target.
- * There is no self-hosted preset to default a container deploy to — Mailpit is
- * a development inbox, not a sender — so `server` has no answer of its own to
- * give and would only be `ses` written twice.
- */
-
-/** Supported docker-compose service names */
-type ComposeServiceName = 'postgres' | 'redis' | 'rabbitmq' | 'minio' | 'mailpit' | 'localstack';
-/** Services configuration - can be boolean (use defaults) or object with version */
-type ComposeServicesConfig = { [K in ComposeServiceName]?: boolean | ServiceConfig };
-interface DockerConfig {
-  /** Container registry URL (e.g., 'ghcr.io/myorg') */
-  registry?: string;
-  /** Docker image name (default: derived from package.json name) */
-  imageName?: string;
-  /** Base Docker image (default: 'node:22-alpine') */
-  baseImage?: string;
-  /** Container port (default: 3000) */
-  port?: number;
-  /** docker-compose services to include */
-  compose?: {
-    /**
-     * Services to include in docker-compose.
-     * Can be an object with service configs or an array of service names (legacy).
-     *
-     * @example Object format (recommended)
-     * services: {
-     *   postgres: { version: '15-alpine' },
-     *   redis: true,  // use default version
-     * }
-     *
-     * @example Array format (legacy, uses default versions)
-     * services: ['postgres', 'redis']
-     */
-    services?: ComposeServicesConfig | ComposeServiceName[];
-  };
-}
-interface ServerConfig extends ProviderConfig {
-  enableOpenApi?: boolean;
-  port?: number;
-  /** Production build configuration */
-  production?: ProductionConfig;
-}
-type Runtime = 'node' | 'bun';
-interface TelescopeConfig {
-  /** Enable/disable telescope (default: true in development) */
-  enabled?: boolean;
-  /** Port for telescope to use (defaults to server port) */
-  port?: number;
-  /** Path prefix for telescope UI (default: /__telescope) */
-  path?: string;
-  /** Ignore patterns for telescope (e.g., ['/health', '/metrics']) */
-  ignore?: string[];
-  /** Record request/response bodies (default: true) */
-  recordBody?: boolean;
-  /** Maximum entries to keep in memory (default: 1000) */
-  maxEntries?: number;
-  /** Enable WebSocket for real-time updates (default: true, requires @hono/node-ws for Node.js) */
-  websocket?: boolean;
-}
-interface StudioConfig {
-  /** Enable/disable studio (default: true in development) */
-  enabled?: boolean;
-  /** Path prefix for studio UI (default: /__studio) */
-  path?: string;
-  /** Schema to introspect (default: 'public') */
-  schema?: string;
-}
-interface OpenApiConfig {
-  /** Enable OpenAPI generation (default: true) */
-  enabled?: boolean;
-  /** API title */
-  title?: string;
-  /** API version */
-  version?: string;
-  /** API description */
-  description?: string;
-}
-interface HooksConfig {
-  /**
-   * Path to a module exporting server lifecycle hooks.
-   * The module should export `beforeSetup` and/or `afterSetup` functions.
-   *
-   * @example
-   * ```typescript
-   * // src/config/hooks.ts
-   * import type { Hono } from 'hono';
-   * import type { Logger } from '@geekmidas/logger';
-   * import type { EnvironmentParser } from '@geekmidas/envkit';
-   *
-   * // Called BEFORE gkm endpoints are registered
-   * export function beforeSetup(app: Hono, ctx: { envParser: EnvironmentParser; logger: Logger }) {
-   *   app.use('*', cors());
-   *   app.get('/custom/health', (c) => c.json({ status: 'ok' }));
-   * }
-   *
-   * // Called AFTER gkm endpoints are registered
-   * export function afterSetup(app: Hono, ctx: { envParser: EnvironmentParser; logger: Logger }) {
-   *   app.notFound((c) => c.json({ error: 'Not found' }, 404));
-   *   app.onError((err, c) => c.json({ error: err.message }, 500));
-   * }
-   * ```
-   */
-  server?: string;
-}
-/** Dokploy deployment configuration */
-interface DokployProviderConfig {
-  /** Dokploy API endpoint (e.g., 'https://dokploy.example.com') */
-  endpoint: string;
-  /** Project ID in Dokploy */
-  projectId: string;
-  /** Application ID in Dokploy */
-  applicationId: string;
-  /** Container registry (overrides docker.registry if set) */
-  registry?: string;
-  /** Registry ID in Dokploy (recommended for private registries) */
-  registryId?: string;
-}
-interface ProvidersConfig {
-  aws?: {
-    apiGateway?: {
-      v1?: boolean | AWSApiGatewayConfig;
-      v2?: boolean | AWSApiGatewayConfig;
-    };
-    lambda?: {
-      functions?: boolean | AWSLambdaConfig;
-      crons?: boolean | AWSLambdaConfig;
-    };
-  };
-  server?: boolean | ServerConfig;
-  /** Dokploy deployment configuration */
-  dokploy?: boolean | DokployProviderConfig;
-}
-interface GkmConfig {
-  /**
-   * What this app is called, and therefore how everything it declares is named.
-   *
-   * The same field `sst.config.ts` carries, doing the same job: every physical
-   * name is `{stage}-{name}-{construct}`, so `Database` in the `production`
-   * stage of `kitchen-sink` is `production-kitchen-sink-database` on AWS and on
-   * Dokploy alike. One statement, in the config, rather than a rule each
-   * provider restates.
-   *
-   * `defineWorkspace` has always had this. A single-app config did not, so its
-   * names fell back to whatever the directory happened to be called — the
-   * monorepo's package name for the project and the app's for the application,
-   * two accidents of layout standing in for a decision.
-   *
-   * Defaults to the package.json name with any scope stripped, then the
-   * directory name.
-   */
-  name?: string;
-  /** The project's stages: which one is local, which deploy */
-  stages: StagesConfig;
-  /**
-   * Where the things no construct implies live.
-   *
-   * The same block a workspace config carries, and the same split: `db` and
-   * `storage` are derived from the declared `KyselyDatabase` and
-   * `ObjectStorage` and are ignored here, while `cache`, `mail`, and `events`
-   * name a *backend* — where the cache lives, who delivers the mail, which
-   * broker carries events. A single-app project had no way to say any of that
-   * before, so its event backend could only be guessed.
-   */
-  services?: ServicesConfig;
-  /**
-   * Constructs glob pattern — one glob, every kind.
-   *
-   * What reconcile reads to derive the containers a stage needs: a database
-   * implies Postgres, objects imply MinIO, mail implies Mailpit. A glob per
-   * kind cannot find a resource, because a declared `ObjectStorage` has no
-   * kind to be listed under.
-   *
-   * @example './src/**\/*.ts'
-   */
-  constructs: Routes;
-  providers?: ProvidersConfig;
-  /**
-   * Server lifecycle hooks for customizing the Hono app.
-   * Allows adding custom routes, middleware, error handlers, etc.
-   *
-   * @example
-   * hooks: {
-   *   server: './src/config/hooks'
-   * }
-   */
-  hooks?: HooksConfig;
-  /**
-   * Telescope configuration for debugging/monitoring.
-   * Can be:
-   * - A string path to a module that exports a Telescope instance (recommended)
-   * - A boolean to enable/disable with defaults
-   * - A TelescopeConfig object for inline configuration
-   */
-  telescope?: string | boolean | TelescopeConfig;
-  /**
-   * Studio configuration for database browsing.
-   * Can be:
-   * - A string path to a module that exports a Studio instance (recommended)
-   * - A boolean to enable/disable with defaults
-   * - A StudioConfig object for inline configuration
-   *
-   * Requires a database connection configured via services.
-   */
-  studio?: string | boolean | StudioConfig;
-  /**
-   * OpenAPI generation configuration.
-   * Can be:
-   * - A boolean to enable/disable with defaults (output: ./src/api/openapi.ts)
-   * - An OpenApiConfig object for customization
-   *
-   * When enabled, OpenAPI spec is generated on startup and regenerated on route changes.
-   *
-   * @example
-   * openapi: true
-   *
-   * @example
-   * openapi: {
-   *   output: './src/api/openapi.ts',
-   *   title: 'My API',
-   *   version: '1.0.0',
-   * }
-   */
-  openapi?: boolean | OpenApiConfig;
-  /** Runtime to use for dev server (default: 'node') */
-  runtime?: Runtime;
-  /**
-   * Environment file(s) to load for development.
-   * Can be:
-   * - A string path to a single env file (e.g., '.env.local')
-   * - An array of paths to load in order (later files override earlier)
-   * - Defaults to '.env' if not specified
-   *
-   * @example
-   * env: '.env.local'
-   *
-   * @example
-   * env: ['.env', '.env.local']
-   */
-  env?: string | string[];
-  /**
-   * Docker deployment configuration.
-   * Used by `gkm docker` and `gkm prepack` commands.
-   *
-   * @example
-   * docker: {
-   *   registry: 'ghcr.io/myorg',
-   *   imageName: 'my-api',
-   *   compose: {
-   *     services: ['postgres', 'redis']
-   *   }
-   * }
-   */
-  docker?: DockerConfig;
-  /**
-   * Where this app deploys, and what the target needs to know.
-   *
-   * Absent until now, which meant a single-app project could not configure a
-   * Dokploy deploy at all: the wrap that turns one into a workspace hardcoded
-   * `{ default: 'dokploy' }` and dropped everything else, so there was no
-   * endpoint, no registry and no domain — and `resolveHost` failed with "no
-   * domain configured for stage" on a config that had nowhere to put one.
-   *
-   * The same shape a workspace config uses, so moving from one to the other is
-   * a rename rather than a rewrite.
-   */
-  deploy?: DeployConfig;
-}
-//#endregion
-export { AppConfig, AppConfigInput, AppInput, AppsRecord, BackendFramework, CacheBackend, ConstrainedApps, DeployConfig, DeployTarget, DokployWorkspaceConfig, EmailBackend, Framework, FrontendFramework, GkmConfig, InferAppNames, InferredWorkspaceConfig, LoadedConfig, MailServiceConfig, MobileFramework, ModelsConfig, NormalizedAppConfig, NormalizedWorkspace, OpenApiConfig, PHASE_2_DEPLOY_TARGETS, Routes, SUPPORTED_DEPLOY_TARGETS, SecretsConfig, ServiceImageConfig, ServicesConfig, SharedConfig, WorkspaceConfig, WorkspaceConfigSchema, WorkspaceInput, formatValidationErrors, getDeployTargetError, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, safeValidateWorkspaceConfig, validateWorkspaceConfig };
-//# sourceMappingURL=types-Y3fKQSAK.d.cts.map