@geekmidas/cli 10.0.0-alpha.15 → 10.0.0-alpha.17

package/dist/{types-C5ZNpUad.d.cts → types-7R81hu0i.d.mts}

@@ -1,4 +1,81 @@
 import { ConstructManifest } from "@geekmidas/manifest";
+//#region src/secrets/types.d.ts
+/** Credentials for a specific service */
+interface ServiceCredentials {
+  host: string;
+  port: number;
+  username: string;
+  password: string;
+  /** Database name (for postgres) */
+  database?: string;
+  /** Virtual host (for rabbitmq) */
+  vhost?: string;
+  /** Bucket name (for minio) */
+  bucket?: string;
+  /** Access key ID (for localstack) */
+  accessKeyId?: string;
+  /** Region (for localstack) */
+  region?: string;
+}
+/** Stage secrets configuration */
+interface StageSecrets {
+  /** Stage name (e.g., 'production', 'staging') */
+  stage: string;
+  /** ISO timestamp when secrets were created */
+  createdAt: string;
+  /** ISO timestamp when secrets were last updated */
+  updatedAt: string;
+  /** Event backend type (if events are enabled) */
+  eventsBackend?: EventsBackend;
+  /** Service-specific credentials */
+  services: {
+    postgres?: ServiceCredentials;
+    redis?: ServiceCredentials;
+    rabbitmq?: ServiceCredentials;
+    minio?: ServiceCredentials;
+    mailpit?: ServiceCredentials;
+    localstack?: ServiceCredentials;
+    pgboss?: ServiceCredentials;
+  };
+  /** Generated connection URLs */
+  urls: {
+    DATABASE_URL?: string;
+    REDIS_URL?: string;
+    RABBITMQ_URL?: string;
+    STORAGE_ENDPOINT?: string;
+    SMTP_HOST?: string;
+    SMTP_PORT?: string;
+    EVENT_PUBLISHER_CONNECTION_STRING?: string;
+    EVENT_SUBSCRIBER_CONNECTION_STRING?: string;
+  };
+  /** Custom user-defined secrets */
+  custom: Record<string, string>;
+}
+//#endregion
+//#region src/secrets/store.d.ts
+interface SecretsStore {
+  /** The stage's secrets, or null if the store holds none for it. */
+  pull(stage: string): Promise<StageSecrets | null>;
+  /** Replace the stage's secrets in the store. */
+  push(stage: string, secrets: StageSecrets): Promise<void>;
+}
+/** Secrets in SSM Parameter Store, in the account of the active credentials. */
+interface SsmSecretsStoreConfig {
+  provider: 'ssm';
+  region: string;
+}
+/** Any other backend: an object implementing {@link SecretsStore}. */
+interface CustomSecretsStoreConfig {
+  provider: SecretsStore;
+}
+/**
+ * `secrets.store` in gkm.config.ts.
+ *
+ * `'file'` — the default — keeps each stage's secrets in the encrypted
+ * `.gkm/secrets/<stage>.json` beside its key in `~/.gkm/`. It cannot serve a
+ * deploy from CI while `.gkm/` is gitignored; `ssm` or a custom store can.
+ */
+type SecretsStoreConfig = 'file' | SsmSecretsStoreConfig | CustomSecretsStoreConfig;
 //#endregion
 //#region src/deploy/state.d.ts
 /**
@@ -4421,10 +4498,10 @@ declare namespace external_d_exports {
  * Backend framework schema for non-gkm apps.
  */
 declare const BackendFrameworkSchema: ZodEnum<{
-  hono: "hono";
   "better-auth": "better-auth";
   express: "express";
   fastify: "fastify";
+  hono: "hono";
 }>;
 /**
  * Backend framework types for apps that don't use gkm routes.
@@ -4456,8 +4533,8 @@ type BackendFramework = output$1<typeof BackendFrameworkSchema>;
 declare const FrontendFrameworkSchema: ZodEnum<{
   nextjs: "nextjs";
   remix: "remix";
-  vite: "vite";
   "tanstack-start": "tanstack-start";
+  vite: "vite";
 }>;
 /**
  * Frontend framework types. Derived from {@link FrontendFrameworkSchema}.
@@ -4516,15 +4593,15 @@ type MobileFramework = output$1<typeof MobileFrameworkSchema>;
  * Combined framework schema (backend, frontend, or mobile).
  */
 declare const FrameworkSchema: ZodUnion<readonly [ZodEnum<{
-  hono: "hono";
   "better-auth": "better-auth";
   express: "express";
   fastify: "fastify";
+  hono: "hono";
 }>, ZodEnum<{
   nextjs: "nextjs";
   remix: "remix";
-  vite: "vite";
   "tanstack-start": "tanstack-start";
+  vite: "vite";
 }>, ZodEnum<{
   expo: "expo";
 }>]>;
@@ -4536,11 +4613,11 @@ type Framework = output$1<typeof FrameworkSchema>;
 /**
  * Supported deploy targets (Phase 1).
  */
-declare const SUPPORTED_DEPLOY_TARGETS: readonly ["dokploy"];
+declare const SUPPORTED_DEPLOY_TARGETS: readonly ['dokploy'];
 /**
  * Phase 2 deploy targets (not yet implemented).
  */
-declare const PHASE_2_DEPLOY_TARGETS: readonly ["vercel", "cloudflare"];
+declare const PHASE_2_DEPLOY_TARGETS: readonly ['vercel', 'cloudflare'];
 /**
  * Check if a deploy target is supported.
  */
@@ -4562,33 +4639,33 @@ declare const DnsConfigWithLegacySchema: ZodUnion<readonly [ZodRecord<ZodString,
 }, $strip>, ZodObject<{
   provider: ZodLiteral<"route53">;
   region: ZodOptional<ZodEnum<{
-    "us-east-1": "us-east-1";
-    "us-east-2": "us-east-2";
-    "us-west-1": "us-west-1";
-    "us-west-2": "us-west-2";
     "af-south-1": "af-south-1";
     "ap-east-1": "ap-east-1";
+    "ap-northeast-1": "ap-northeast-1";
+    "ap-northeast-2": "ap-northeast-2";
+    "ap-northeast-3": "ap-northeast-3";
     "ap-south-1": "ap-south-1";
     "ap-south-2": "ap-south-2";
     "ap-southeast-1": "ap-southeast-1";
     "ap-southeast-2": "ap-southeast-2";
     "ap-southeast-3": "ap-southeast-3";
     "ap-southeast-4": "ap-southeast-4";
-    "ap-northeast-1": "ap-northeast-1";
-    "ap-northeast-2": "ap-northeast-2";
-    "ap-northeast-3": "ap-northeast-3";
     "ca-central-1": "ca-central-1";
     "eu-central-1": "eu-central-1";
     "eu-central-2": "eu-central-2";
+    "eu-north-1": "eu-north-1";
+    "eu-south-1": "eu-south-1";
+    "eu-south-2": "eu-south-2";
     "eu-west-1": "eu-west-1";
     "eu-west-2": "eu-west-2";
     "eu-west-3": "eu-west-3";
-    "eu-south-1": "eu-south-1";
-    "eu-south-2": "eu-south-2";
-    "eu-north-1": "eu-north-1";
-    "me-south-1": "me-south-1";
     "me-central-1": "me-central-1";
+    "me-south-1": "me-south-1";
     "sa-east-1": "sa-east-1";
+    "us-east-1": "us-east-1";
+    "us-east-2": "us-east-2";
+    "us-west-1": "us-west-1";
+    "us-west-2": "us-west-2";
   }>>;
   profile: ZodOptional<ZodString>;
   hostedZoneId: ZodOptional<ZodString>;
@@ -4616,33 +4693,33 @@ declare const DnsConfigWithLegacySchema: ZodUnion<readonly [ZodRecord<ZodString,
 }, $strip>, ZodObject<{
   provider: ZodLiteral<"route53">;
   region: ZodOptional<ZodEnum<{
-    "us-east-1": "us-east-1";
-    "us-east-2": "us-east-2";
-    "us-west-1": "us-west-1";
-    "us-west-2": "us-west-2";
     "af-south-1": "af-south-1";
     "ap-east-1": "ap-east-1";
+    "ap-northeast-1": "ap-northeast-1";
+    "ap-northeast-2": "ap-northeast-2";
+    "ap-northeast-3": "ap-northeast-3";
     "ap-south-1": "ap-south-1";
     "ap-south-2": "ap-south-2";
     "ap-southeast-1": "ap-southeast-1";
     "ap-southeast-2": "ap-southeast-2";
     "ap-southeast-3": "ap-southeast-3";
     "ap-southeast-4": "ap-southeast-4";
-    "ap-northeast-1": "ap-northeast-1";
-    "ap-northeast-2": "ap-northeast-2";
-    "ap-northeast-3": "ap-northeast-3";
     "ca-central-1": "ca-central-1";
     "eu-central-1": "eu-central-1";
     "eu-central-2": "eu-central-2";
+    "eu-north-1": "eu-north-1";
+    "eu-south-1": "eu-south-1";
+    "eu-south-2": "eu-south-2";
     "eu-west-1": "eu-west-1";
     "eu-west-2": "eu-west-2";
     "eu-west-3": "eu-west-3";
-    "eu-south-1": "eu-south-1";
-    "eu-south-2": "eu-south-2";
-    "eu-north-1": "eu-north-1";
-    "me-south-1": "me-south-1";
     "me-central-1": "me-central-1";
+    "me-south-1": "me-south-1";
     "sa-east-1": "sa-east-1";
+    "us-east-1": "us-east-1";
+    "us-east-2": "us-east-2";
+    "us-west-1": "us-west-1";
+    "us-west-2": "us-west-2";
   }>>;
   profile: ZodOptional<ZodString>;
   hostedZoneId: ZodOptional<ZodString>;
@@ -4679,33 +4756,33 @@ declare const BackupsConfigSchema: ZodObject<{
   type: ZodLiteral<"s3">;
   profile: ZodOptional<ZodString>;
   region: ZodEnum<{
-    "us-east-1": "us-east-1";
-    "us-east-2": "us-east-2";
-    "us-west-1": "us-west-1";
-    "us-west-2": "us-west-2";
     "af-south-1": "af-south-1";
     "ap-east-1": "ap-east-1";
+    "ap-northeast-1": "ap-northeast-1";
+    "ap-northeast-2": "ap-northeast-2";
+    "ap-northeast-3": "ap-northeast-3";
     "ap-south-1": "ap-south-1";
     "ap-south-2": "ap-south-2";
     "ap-southeast-1": "ap-southeast-1";
     "ap-southeast-2": "ap-southeast-2";
     "ap-southeast-3": "ap-southeast-3";
     "ap-southeast-4": "ap-southeast-4";
-    "ap-northeast-1": "ap-northeast-1";
-    "ap-northeast-2": "ap-northeast-2";
-    "ap-northeast-3": "ap-northeast-3";
     "ca-central-1": "ca-central-1";
     "eu-central-1": "eu-central-1";
     "eu-central-2": "eu-central-2";
+    "eu-north-1": "eu-north-1";
+    "eu-south-1": "eu-south-1";
+    "eu-south-2": "eu-south-2";
     "eu-west-1": "eu-west-1";
     "eu-west-2": "eu-west-2";
     "eu-west-3": "eu-west-3";
-    "eu-south-1": "eu-south-1";
-    "eu-south-2": "eu-south-2";
-    "eu-north-1": "eu-north-1";
-    "me-south-1": "me-south-1";
     "me-central-1": "me-central-1";
+    "me-south-1": "me-south-1";
     "sa-east-1": "sa-east-1";
+    "us-east-1": "us-east-1";
+    "us-east-2": "us-east-2";
+    "us-west-1": "us-west-1";
+    "us-west-2": "us-west-2";
   }>;
   schedule: ZodOptional<ZodString>;
   retention: ZodOptional<ZodNumber>;
@@ -4723,16 +4800,16 @@ declare const WorkspaceConfigSchema: ZodObject<{
   apps: ZodOptional<ZodRecord<ZodString, ZodObject<{
     type: ZodDefault<ZodOptional<ZodEnum<{
       backend: "backend";
-      web: "web";
       mobile: "mobile";
+      web: "web";
     }>>>;
     path: ZodString;
     port: ZodNumber;
     dependencies: ZodOptional<ZodArray<ZodString>>;
     deploy: ZodOptional<ZodEnum<{
+      cloudflare: "cloudflare";
       dokploy: "dokploy";
       vercel: "vercel";
-      cloudflare: "cloudflare";
     }>>;
     constructs: ZodOptional<ZodUnion<readonly [ZodString, ZodArray<ZodString>, ZodObject<{
       paths: ZodUnion<readonly [ZodString, ZodArray<ZodString>]>;
@@ -4788,21 +4865,21 @@ declare const WorkspaceConfigSchema: ZodObject<{
       description: ZodOptional<ZodString>;
     }, $strip>]>>;
     runtime: ZodOptional<ZodEnum<{
-      node: "node";
       bun: "bun";
+      node: "node";
     }>>;
     env: ZodOptional<ZodUnion<readonly [ZodString, ZodArray<ZodString>]>>;
     entry: ZodOptional<ZodString>;
     framework: ZodOptional<ZodUnion<readonly [ZodEnum<{
-      hono: "hono";
       "better-auth": "better-auth";
       express: "express";
       fastify: "fastify";
+      hono: "hono";
     }>, ZodEnum<{
       nextjs: "nextjs";
       remix: "remix";
-      vite: "vite";
       "tanstack-start": "tanstack-start";
+      vite: "vite";
     }>, ZodEnum<{
       expo: "expo";
     }>]>>;
@@ -4822,9 +4899,9 @@ declare const WorkspaceConfigSchema: ZodObject<{
   }, $strip>>;
   deploy: ZodOptional<ZodObject<{
     default: ZodOptional<ZodEnum<{
+      cloudflare: "cloudflare";
       dokploy: "dokploy";
       vercel: "vercel";
-      cloudflare: "cloudflare";
     }>>;
     dokploy: ZodOptional<ZodObject<{
       endpoint: ZodOptional<ZodURL>;
@@ -4839,33 +4916,33 @@ declare const WorkspaceConfigSchema: ZodObject<{
     }, $strip>, ZodObject<{
       provider: ZodLiteral<"route53">;
       region: ZodOptional<ZodEnum<{
-        "us-east-1": "us-east-1";
-        "us-east-2": "us-east-2";
-        "us-west-1": "us-west-1";
-        "us-west-2": "us-west-2";
         "af-south-1": "af-south-1";
         "ap-east-1": "ap-east-1";
+        "ap-northeast-1": "ap-northeast-1";
+        "ap-northeast-2": "ap-northeast-2";
+        "ap-northeast-3": "ap-northeast-3";
         "ap-south-1": "ap-south-1";
         "ap-south-2": "ap-south-2";
         "ap-southeast-1": "ap-southeast-1";
         "ap-southeast-2": "ap-southeast-2";
         "ap-southeast-3": "ap-southeast-3";
         "ap-southeast-4": "ap-southeast-4";
-        "ap-northeast-1": "ap-northeast-1";
-        "ap-northeast-2": "ap-northeast-2";
-        "ap-northeast-3": "ap-northeast-3";
         "ca-central-1": "ca-central-1";
         "eu-central-1": "eu-central-1";
         "eu-central-2": "eu-central-2";
+        "eu-north-1": "eu-north-1";
+        "eu-south-1": "eu-south-1";
+        "eu-south-2": "eu-south-2";
         "eu-west-1": "eu-west-1";
         "eu-west-2": "eu-west-2";
         "eu-west-3": "eu-west-3";
-        "eu-south-1": "eu-south-1";
-        "eu-south-2": "eu-south-2";
-        "eu-north-1": "eu-north-1";
-        "me-south-1": "me-south-1";
         "me-central-1": "me-central-1";
+        "me-south-1": "me-south-1";
         "sa-east-1": "sa-east-1";
+        "us-east-1": "us-east-1";
+        "us-east-2": "us-east-2";
+        "us-west-1": "us-west-1";
+        "us-west-2": "us-west-2";
       }>>;
       profile: ZodOptional<ZodString>;
       hostedZoneId: ZodOptional<ZodString>;
@@ -4893,33 +4970,33 @@ declare const WorkspaceConfigSchema: ZodObject<{
     }, $strip>, ZodObject<{
       provider: ZodLiteral<"route53">;
       region: ZodOptional<ZodEnum<{
-        "us-east-1": "us-east-1";
-        "us-east-2": "us-east-2";
-        "us-west-1": "us-west-1";
-        "us-west-2": "us-west-2";
         "af-south-1": "af-south-1";
         "ap-east-1": "ap-east-1";
+        "ap-northeast-1": "ap-northeast-1";
+        "ap-northeast-2": "ap-northeast-2";
+        "ap-northeast-3": "ap-northeast-3";
         "ap-south-1": "ap-south-1";
         "ap-south-2": "ap-south-2";
         "ap-southeast-1": "ap-southeast-1";
         "ap-southeast-2": "ap-southeast-2";
         "ap-southeast-3": "ap-southeast-3";
         "ap-southeast-4": "ap-southeast-4";
-        "ap-northeast-1": "ap-northeast-1";
-        "ap-northeast-2": "ap-northeast-2";
-        "ap-northeast-3": "ap-northeast-3";
         "ca-central-1": "ca-central-1";
         "eu-central-1": "eu-central-1";
         "eu-central-2": "eu-central-2";
+        "eu-north-1": "eu-north-1";
+        "eu-south-1": "eu-south-1";
+        "eu-south-2": "eu-south-2";
         "eu-west-1": "eu-west-1";
         "eu-west-2": "eu-west-2";
         "eu-west-3": "eu-west-3";
-        "eu-south-1": "eu-south-1";
-        "eu-south-2": "eu-south-2";
-        "eu-north-1": "eu-north-1";
-        "me-south-1": "me-south-1";
         "me-central-1": "me-central-1";
+        "me-south-1": "me-south-1";
         "sa-east-1": "sa-east-1";
+        "us-east-1": "us-east-1";
+        "us-east-2": "us-east-2";
+        "us-west-1": "us-west-1";
+        "us-west-2": "us-west-2";
       }>>;
       profile: ZodOptional<ZodString>;
       hostedZoneId: ZodOptional<ZodString>;
@@ -4949,33 +5026,33 @@ declare const WorkspaceConfigSchema: ZodObject<{
       type: ZodLiteral<"s3">;
       profile: ZodOptional<ZodString>;
       region: ZodEnum<{
-        "us-east-1": "us-east-1";
-        "us-east-2": "us-east-2";
-        "us-west-1": "us-west-1";
-        "us-west-2": "us-west-2";
         "af-south-1": "af-south-1";
         "ap-east-1": "ap-east-1";
+        "ap-northeast-1": "ap-northeast-1";
+        "ap-northeast-2": "ap-northeast-2";
+        "ap-northeast-3": "ap-northeast-3";
         "ap-south-1": "ap-south-1";
         "ap-south-2": "ap-south-2";
         "ap-southeast-1": "ap-southeast-1";
         "ap-southeast-2": "ap-southeast-2";
         "ap-southeast-3": "ap-southeast-3";
         "ap-southeast-4": "ap-southeast-4";
-        "ap-northeast-1": "ap-northeast-1";
-        "ap-northeast-2": "ap-northeast-2";
-        "ap-northeast-3": "ap-northeast-3";
         "ca-central-1": "ca-central-1";
         "eu-central-1": "eu-central-1";
         "eu-central-2": "eu-central-2";
+        "eu-north-1": "eu-north-1";
+        "eu-south-1": "eu-south-1";
+        "eu-south-2": "eu-south-2";
         "eu-west-1": "eu-west-1";
         "eu-west-2": "eu-west-2";
         "eu-west-3": "eu-west-3";
-        "eu-south-1": "eu-south-1";
-        "eu-south-2": "eu-south-2";
-        "eu-north-1": "eu-north-1";
-        "me-south-1": "me-south-1";
         "me-central-1": "me-central-1";
+        "me-south-1": "me-south-1";
         "sa-east-1": "sa-east-1";
+        "us-east-1": "us-east-1";
+        "us-east-2": "us-east-2";
+        "us-west-1": "us-west-1";
+        "us-west-2": "us-west-2";
       }>;
       schedule: ZodOptional<ZodString>;
       retention: ZodOptional<ZodNumber>;
@@ -4988,10 +5065,50 @@ declare const WorkspaceConfigSchema: ZodObject<{
   }, $strip>;
   secrets: ZodOptional<ZodObject<{
     enabled: ZodOptional<ZodBoolean>;
+    store: ZodOptional<ZodUnion<readonly [ZodLiteral<"file">, ZodObject<{
+      provider: ZodLiteral<"ssm">;
+      region: ZodEnum<{
+        "af-south-1": "af-south-1";
+        "ap-east-1": "ap-east-1";
+        "ap-northeast-1": "ap-northeast-1";
+        "ap-northeast-2": "ap-northeast-2";
+        "ap-northeast-3": "ap-northeast-3";
+        "ap-south-1": "ap-south-1";
+        "ap-south-2": "ap-south-2";
+        "ap-southeast-1": "ap-southeast-1";
+        "ap-southeast-2": "ap-southeast-2";
+        "ap-southeast-3": "ap-southeast-3";
+        "ap-southeast-4": "ap-southeast-4";
+        "ca-central-1": "ca-central-1";
+        "eu-central-1": "eu-central-1";
+        "eu-central-2": "eu-central-2";
+        "eu-north-1": "eu-north-1";
+        "eu-south-1": "eu-south-1";
+        "eu-south-2": "eu-south-2";
+        "eu-west-1": "eu-west-1";
+        "eu-west-2": "eu-west-2";
+        "eu-west-3": "eu-west-3";
+        "me-central-1": "me-central-1";
+        "me-south-1": "me-south-1";
+        "sa-east-1": "sa-east-1";
+        "us-east-1": "us-east-1";
+        "us-east-2": "us-east-2";
+        "us-west-1": "us-west-1";
+        "us-west-2": "us-west-2";
+      }>;
+    }, $strict>, ZodObject<{
+      provider: ZodCustom<{
+        pull: Function;
+        push: Function;
+      }, {
+        pull: Function;
+        push: Function;
+      }>;
+    }, $strip>]>>;
     algorithm: ZodOptional<ZodString>;
     kdf: ZodOptional<ZodEnum<{
-      scrypt: "scrypt";
       pbkdf2: "pbkdf2";
+      scrypt: "scrypt";
     }>>;
   }, $strip>>;
   state: ZodOptional<ZodUnion<readonly [ZodDiscriminatedUnion<[ZodObject<{
@@ -4999,33 +5116,33 @@ declare const WorkspaceConfigSchema: ZodObject<{
   }, $strip>, ZodObject<{
     provider: ZodLiteral<"ssm">;
     region: ZodEnum<{
-      "us-east-1": "us-east-1";
-      "us-east-2": "us-east-2";
-      "us-west-1": "us-west-1";
-      "us-west-2": "us-west-2";
       "af-south-1": "af-south-1";
       "ap-east-1": "ap-east-1";
+      "ap-northeast-1": "ap-northeast-1";
+      "ap-northeast-2": "ap-northeast-2";
+      "ap-northeast-3": "ap-northeast-3";
       "ap-south-1": "ap-south-1";
       "ap-south-2": "ap-south-2";
       "ap-southeast-1": "ap-southeast-1";
       "ap-southeast-2": "ap-southeast-2";
       "ap-southeast-3": "ap-southeast-3";
       "ap-southeast-4": "ap-southeast-4";
-      "ap-northeast-1": "ap-northeast-1";
-      "ap-northeast-2": "ap-northeast-2";
-      "ap-northeast-3": "ap-northeast-3";
       "ca-central-1": "ca-central-1";
       "eu-central-1": "eu-central-1";
       "eu-central-2": "eu-central-2";
+      "eu-north-1": "eu-north-1";
+      "eu-south-1": "eu-south-1";
+      "eu-south-2": "eu-south-2";
       "eu-west-1": "eu-west-1";
       "eu-west-2": "eu-west-2";
       "eu-west-3": "eu-west-3";
-      "eu-south-1": "eu-south-1";
-      "eu-south-2": "eu-south-2";
-      "eu-north-1": "eu-north-1";
-      "me-south-1": "me-south-1";
       "me-central-1": "me-central-1";
+      "me-south-1": "me-south-1";
       "sa-east-1": "sa-east-1";
+      "us-east-1": "us-east-1";
+      "us-east-2": "us-east-2";
+      "us-west-1": "us-west-1";
+      "us-west-2": "us-west-2";
     }>;
     profile: ZodOptional<ZodString>;
   }, $strip>], "provider">, ZodObject<{
@@ -5302,6 +5419,14 @@ interface StagesConfig {
 interface SecretsConfig {
   /** Enable encrypted secrets (default: true) */
   enabled?: boolean;
+  /**
+   * Where deployed stages' secrets live, so a deploy can reach them from
+   * anywhere: `'file'` (default — the encrypted `.gkm/secrets/<stage>.json`,
+   * which cannot serve CI while `.gkm/` is gitignored), `{ provider: 'ssm',
+   * region }` (each stage's secrets in its own AWS account), or any object
+   * implementing `SecretsStore`. The local stage always uses the file.
+   */
+  store?: SecretsStoreConfig;
   /** Encryption algorithm (default: 'aes-256-gcm') */
   algorithm?: string;
   /** Key derivation function (default: 'scrypt') */
@@ -5891,6 +6016,16 @@ interface ProductionConfig {
    */
   optimizedHandlers?: boolean;
 }
+/**
+ * Supported event backend types.
+ *
+ * - `pgboss`: Reuses PostgreSQL with a dedicated user/schema. Auto-enables db service.
+ * - `sns`: Adds LocalStack container with SNS+SQS services.
+ * - `rabbitmq`: Adds RabbitMQ container.
+ *
+ * All backends generate EVENT_PUBLISHER_CONNECTION_STRING and EVENT_SUBSCRIBER_CONNECTION_STRING.
+ */
+type EventsBackend = 'pgboss' | 'sns' | 'rabbitmq';
 /**
  * Where a declared cache actually lives.
  *
@@ -6057,6 +6192,8 @@ interface GkmConfig {
   name?: string;
   /** The project's stages: which one is local, which deploy */
   stages: StagesConfig;
+  /** Encrypted secrets, and where deployed stages' secrets are stored */
+  secrets?: SecretsConfig;
   /**
    * Constructs glob pattern — one glob, every kind.
    *
@@ -6162,4 +6299,4 @@ interface GkmConfig {
 }
 //#endregion
 export { SUPPORTED_DEPLOY_TARGETS as A, WorkspaceInput as C, FrontendFramework as D, Framework as E, isPhase2DeployTarget as F, safeValidateWorkspaceConfig as I, validateWorkspaceConfig as L, formatValidationErrors as M, getDeployTargetError as N, MobileFramework as O, isDeployTargetSupported as P, WorkspaceConfig as S, BackendFramework as T, ModelsConfig as _, Routes as a, SecretsConfig as b, AppInput as c, DeployConfig as d, DeployTarget as f, LoadedConfig as g, InferredWorkspaceConfig as h, OpenApiConfig as i, WorkspaceConfigSchema as j, PHASE_2_DEPLOY_TARGETS as k, AppsRecord as l, InferAppNames as m, EmailBackend as n, AppConfig as o, DokployWorkspaceConfig as p, GkmConfig as r, AppConfigInput as s, CacheBackend as t, ConstrainedApps as u, NormalizedAppConfig as v, isWorkspaceConfig as w, SharedConfig as x, NormalizedWorkspace as y };
-//# sourceMappingURL=types-C5ZNpUad.d.cts.map
+//# sourceMappingURL=types-7R81hu0i.d.mts.map