@geekmidas/cli 10.0.0-alpha.61 → 10.0.0-alpha.62

package/dist/{types-Bp1mVxG0.d.mts → types-DIA7Li-J.d.cts}

@@ -1,4 +1,53 @@
 import { ConstructManifest } from "@geekmidas/manifest";
+//#endregion
+//#region src/deploy/identity.d.ts
+/**
+ * Who a deploy is, on a target it shares with other workspaces.
+ *
+ * A Dokploy server is one flat namespace of projects, images and Docker
+ * service names. Deploys used to identify everything they made by the
+ * workspace name alone, so two workspaces called `shop` — or `Shop` and
+ * `shop` — deploying to one server landed in the same project, pushed over
+ * each other's images and redeployed each other's applications. A
+ * `DeployIdentity` is what a deploy names and claims its resources by instead.
+ */
+interface DeployIdentity {
+  /**
+   * Whose deploy this is — an organisation, a team, a repository. Two
+   * workspaces with the same name are told apart by it. Defaults to the
+   * kebab-cased workspace name; set `deploy.namespace` to choose one.
+   */
+  readonly namespace: string;
+  /** The workspace name as the target spells it: lowercase, `[a-z0-9-]`. */
+  readonly project: string;
+  readonly stage: string;
+  /**
+   * `<namespace>/<project>`: what a Dokploy project is claimed by.
+   *
+   * The stage is not part of it because one Dokploy project holds every stage
+   * of a workspace, each as an environment — the key has to be the same from
+   * every stage that deploys into it.
+   */
+  readonly key: string;
+  /**
+   * The prefix every name on the target carries: the project alone in the
+   * default namespace, `<namespace>-<project>` in any other.
+   *
+   * The default adds nothing so that a workspace that never set a namespace
+   * keeps the names it was already deployed under — a Postgres is found by
+   * its name, and a new name would be a new, empty database.
+   */
+  readonly scope: string;
+}
+/** What an identity is derived from: a workspace's name and namespace. */
+interface IdentitySource {
+  name: string;
+  deploy?: {
+    namespace?: string;
+  };
+}
+declare function deployIdentity(workspace: IdentitySource, stage: string): DeployIdentity;
+//#endregion
 //#region src/secrets/types.d.ts
 /** Credentials for a specific service */
 interface ServiceCredentials {
@@ -355,6 +404,545 @@ interface CustomStateConfig {
  * State configuration types.
  */
 type StateConfig = LocalStateConfig | SSMStateConfig | S3StateConfig | CustomStateConfig;
+//#endregion
+//#region src/deploy/credentials.d.ts
+/**
+ * How a deploy gets the credentials it acts with.
+ *
+ * `deploy()` never prompts and never reads a terminal: it asks a
+ * `CredentialProvider` and, when the provider has nothing, stops with
+ * `MissingCredential` naming what it needed and how to supply it. Whether to
+ * ask a person, read a vault or fail is the caller's decision — `gkm deploy`
+ * prompts at a terminal and stores what was typed; a CI job sets the
+ * environment; a host passes its own provider.
+ */
+/**
+ * What each kind of credential is asked for with, and what it is.
+ *
+ * A target that needs a kind the CLI does not know declares it by augmenting
+ * this interface, and lists it in its `credentials`:
+ *
+ * ```ts
+ * declare module '@geekmidas/cli/target' {
+ *   interface CredentialKinds {
+ *     fly: { request: { org: string }; value: { token: string } };
+ *   }
+ * }
+ * ```
+ */
+interface CredentialKinds {
+  /** The Dokploy API a stage deploys through. */
+  dokploy: {
+    /** `deploy.dokploy.endpoint`, when the config names one. */
+    request: {
+      endpoint?: string;
+    };
+    value: {
+      endpoint: string;
+      token: string;
+    };
+  };
+  /**
+   * A container registry login, for Dokploy to pull with. Asked for only when
+   * Dokploy has no registry for `deploy.dokploy.registry` and one has to be
+   * created.
+   */
+  registry: {
+    /** `deploy.dokploy.registry`. */
+    request: {
+      url: string;
+    };
+    value: {
+      username: string;
+      password: string;
+    };
+  };
+}
+type CredentialKind = keyof CredentialKinds;
+/** What a deploy asks a provider for. */
+type CredentialRequest<K extends CredentialKind = CredentialKind> = { [P in K]: {
+  kind: P;
+} & CredentialKinds[P]['request']; }[K];
+/** What a provider answers with. */
+type Credential<K extends CredentialKind> = CredentialKinds[K]['value'];
+interface CredentialProvider {
+  /**
+   * The credential `request` asks for, or `undefined` when this provider has
+   * none — the deploy then raises {@link MissingCredential}.
+   */
+  get<K extends CredentialKind>(request: CredentialRequest<K>, options?: {
+    signal?: AbortSignal;
+  }): Promise<Credential<K> | undefined>;
+}
+/** A deploy needed a credential, and its provider had none. */
+declare class MissingCredential extends Error {
+  readonly kind: CredentialKind;
+  /** What it was for: the Dokploy endpoint or the registry URL. */
+  readonly target: string | undefined;
+  /** How to supply it. */
+  readonly howToProvide: string;
+  constructor(kind: CredentialKind,
+  /** What it was for: the Dokploy endpoint or the registry URL. */
+  target: string | undefined,
+  /** How to supply it. */
+  howToProvide?: string);
+}
+/** Whatever was asked for, from the first provider that has it. */
+declare function chainCredentials(...providers: CredentialProvider[]): CredentialProvider;
+interface StoredCredentialsOptions {
+  /** Where to read the variables from. Defaults to `process.env`. */
+  env?: NodeJS.ProcessEnv;
+  /**
+   * The CLI's home, whose `credentials.json` holds stored logins. Defaults
+   * to `GKM_HOME`, else `~/.gkm`.
+   */
+  home?: string;
+}
+/**
+ * Credentials from the environment, then from what `gkm login` stored. What
+ * `deploy()` uses when it is handed no provider.
+ *
+ * - Dokploy: `DOKPLOY_API_TOKEN` / `DOKPLOY_ENDPOINT`, each falling back to
+ *   the stored login, and the endpoint finally to `deploy.dokploy.endpoint`.
+ *   Each half is read on its own: a token is a secret and belongs in the
+ *   environment, an endpoint is configuration and belongs in the config.
+ * - Registry: `DOCKER_REGISTRY_USERNAME` / `DOCKER_REGISTRY_PASSWORD`.
+ */
+declare function storedCredentials(options?: StoredCredentialsOptions): CredentialProvider;
+//#endregion
+//#region src/deploy/types.d.ts
+/** Result for a single app deployment in workspace mode */
+interface AppDeployResult {
+  /** App name */
+  appName: string;
+  /** App type */
+  type: 'backend' | 'web' | 'mobile';
+  /** Whether deployment succeeded */
+  success: boolean;
+  /** Dokploy application ID */
+  applicationId?: string;
+  /** Docker image reference */
+  imageRef?: string;
+  /** The registry's digest for the image, `sha256:…`, once pushed */
+  digest?: string;
+  /** Deployment URL */
+  url?: string;
+  /** Error message if failed */
+  error?: string;
+}
+/** Result from workspace deployment */
+interface WorkspaceDeployResult {
+  /** Results for each app */
+  apps: AppDeployResult[];
+  /** Dokploy project ID */
+  projectId: string;
+  /** Total number of successful deployments */
+  successCount: number;
+  /** Total number of failed deployments */
+  failedCount: number;
+}
+/**
+ * What a deploy did — or, for a dry run, would do. Plain JSON, so it can be
+ * written out as is (`gkm deploy --json` ends with it).
+ */
+interface DeployResult extends WorkspaceDeployResult {
+  stage: string;
+  /** `<namespace>/<project>`. */
+  identity: string;
+  /** The image tag every app was built with. */
+  tag: string;
+  /** Whether this was a dry run: nothing was created, built or pushed. */
+  dryRun: boolean;
+  /** Dokploy's environment for the stage; empty when a dry run would create it. */
+  environmentId: string;
+  /** Apps left out, and why — a mobile app, another deploy target. */
+  skipped: {
+    app: string;
+    reason: string;
+  }[];
+  /** Each deployed app's public URL. */
+  urls: Record<string, string>;
+  /**
+   * Every resource the run touched, in order: what it applied, or for a dry
+   * run, what it would.
+   */
+  changes: ResourceChange[];
+}
+//#endregion
+//#region src/deploy/events.d.ts
+/**
+ * The stretch of a deploy an event belongs to.
+ *
+ * - `validate`: the config, the target, the stage, the apps, the lock, the
+ *   stage's secrets and what each app reads from its environment
+ * - `plan`: a dry run's lookups — what would be created and what reused
+ * - `provision`: what the apps run on — for Dokploy the project, environment
+ *   and registry — and the declared constructs
+ * - `build`: each app's artifact, built without changing anything live
+ * - `release`: the artifacts put live. Dokploy builds and pushes each image
+ *   here, beside its application, because a site's build args are resolved
+ *   per app
+ * - `verify`: what was released answers — for Dokploy, DNS records and its
+ *   domain validation
+ * - `rollback`: the previous release restored, after `release` or `verify`
+ *   failed, on a target that can
+ */
+type DeployPhase = 'validate' | 'plan' | 'provision' | 'build' | 'release' | 'verify' | 'rollback';
+/** An error, as an event carries it. */
+interface DeployEventError {
+  /** The error's class name — `MissingCredential`, `StateLocked`. */
+  name: string;
+  message: string;
+}
+/**
+ * How a resource came to be used:
+ * - `recorded`: the id the stage's state holds still resolves
+ * - `resumed`: a run that died after creating it is picked up
+ * - `found`: it existed and was looked up
+ * - `created`: this run created it
+ */
+type ResourceVia = 'recorded' | 'resumed' | 'found' | 'created';
+/** One resource a deploy touches, planned or applied. */
+interface ResourceChange {
+  /** `<type>:<name>`, unique within the stage — `application:api`. */
+  key: string;
+  /** `project`, `environment`, `registry`, `application`, `domain`, `image`, or a construct's kind. */
+  resourceType: string;
+  /**
+   * For a plan: whether the run would create it, reuse what exists, or
+   * ensure it (look it up, and create it if missing). For an applied change:
+   * what was done.
+   */
+  action: 'create' | 'reuse' | 'ensure' | 'build';
+  /** The target's id, once there is one. */
+  id?: string;
+}
+type DeployEvent = {
+  type: 'deploy.started';
+  stage: string;
+  /** The target the run deploys through, by the name it was given. */
+  target: string;
+  /** `<namespace>/<project>`. */
+  identity: string;
+  tag: string;
+  /** The apps this run deploys, in order. */
+  apps: string[];
+  dryRun: boolean;
+} | {
+  type: 'phase.started';
+  phase: DeployPhase;
+} | {
+  type: 'phase.finished';
+  phase: DeployPhase;
+} |
+/** A phase threw; `deploy.failed` follows (after a rollback, if any). */
+{
+  type: 'phase.failed';
+  phase: DeployPhase;
+  error: DeployEventError;
+} |
+/**
+ * A progress line, exactly as `gkm deploy` prints it — leading newline and
+ * indentation included, so a terminal renderer prints `message` as is.
+ */
+{
+  type: 'log';
+  level: 'info' | 'warn' | 'error';
+  message: string;
+} | {
+  type: 'app.skipped';
+  app: string;
+  reason: string;
+} | ({
+  type: 'resource.planned';
+} & ResourceChange) | ({
+  type: 'resource.applied';
+  via: ResourceVia;
+} & ResourceChange & {
+  id: string;
+}) | {
+  type: 'artifact.built';
+  app: string;
+  imageRef: string;
+  /** The registry's digest, `sha256:…`, once pushed. */
+  digest?: string;
+} | {
+  type: 'app.deployed';
+  app: string;
+  applicationId: string;
+  imageRef: string;
+  url: string;
+} | {
+  type: 'app.failed';
+  app: string;
+  error: DeployEventError;
+} |
+/** One check of whether a released app answers. */
+{
+  type: 'health.checked';
+  app: string;
+  /** What was asked: a URL, or the target's own status check. */
+  url: string;
+  healthy: boolean;
+  /** The HTTP status, when the check was a request. */
+  status?: number;
+  /** 1 for the first check of the app in this run. */
+  attempt: number;
+} | {
+  type: 'deploy.finished';
+  result: DeployResult;
+} | {
+  type: 'deploy.failed';
+  error: DeployEventError;
+};
+/** Every `type` a deploy event can have. */
+type DeployEventType = DeployEvent['type'];
+//#endregion
+//#region src/target/types.d.ts
+/**
+ * Which family of defaults a target's deploys belong to.
+ *
+ * - `server`: the target runs containers the project controls, so a cache can
+ *   live in the database and events go through pg-boss.
+ * - `aws`: the target runs on managed AWS services, so the defaults are
+ *   Upstash, S3 and SNS/SQS.
+ *
+ * `gkm dev` and `gkm build` choose backends by it, which is why a target from
+ * a package declares it in its `package.json` too: they read it without
+ * importing the target.
+ */
+type DeployRuntime = 'server' | 'aws';
+/** What a target can do, beyond the phases every target has. */
+interface DeployTargetCapabilities {
+  /**
+   * Whether `rollback` restores the previous release. When it does, a failed
+   * `release` or `verify` is rolled back before the deploy reports failure.
+   */
+  rollback: boolean;
+  /**
+   * Who applies database migrations: the target, as part of `release`, or
+   * the app itself when it starts.
+   */
+  migrations: 'target' | 'app';
+  /**
+   * Whether the target builds container images — and so needs Docker where
+   * the deploy runs, and a registry to push to.
+   */
+  images: boolean;
+}
+/** A failed validation of a target's options, issue by issue. */
+interface TargetOptionsIssue {
+  readonly message: string;
+  readonly path?: ReadonlyArray<PropertyKey | {
+    readonly key: PropertyKey;
+  }>;
+}
+type TargetOptionsResult<Output> = {
+  readonly value: Output;
+  readonly issues?: undefined;
+} | {
+  readonly issues: ReadonlyArray<TargetOptionsIssue>;
+};
+/**
+ * The schema a target's options are validated with: any Standard Schema —
+ * a Zod, Valibot or ArkType schema is one.
+ *
+ * The interface is the Standard Schema spec's own, copied as the spec asks,
+ * so a target's types do not depend on a package the CLI does not ship.
+ */
+interface TargetOptionsSchema<Output = unknown> {
+  readonly '~standard': {
+    readonly version: 1;
+    readonly vendor: string;
+    readonly validate: (value: unknown) => TargetOptionsResult<Output> | Promise<TargetOptionsResult<Output>>;
+    readonly types?: {
+      readonly input: unknown;
+      readonly output: Output;
+    } | undefined;
+  };
+}
+/**
+ * The stage's secrets, as a target reads and writes them.
+ *
+ * Every secret value read through here is masked: a progress line that
+ * would print one prints `***` instead, in the terminal and in the events.
+ */
+interface DeploySecrets {
+  /** Which kind of store holds them — `'file'`, `'ssm'`, or a custom one's. */
+  readonly store: string;
+  /** The stage's secrets, or null when it has none yet. */
+  read(): Promise<StageSecrets | null>;
+  /** Replace the stage's secrets. */
+  write(secrets: StageSecrets): Promise<void>;
+  /** Mask `value` in everything this run prints or emits from now on. */
+  mask(value: string): void;
+}
+/** Where a target's progress lines go: `log` events of the run. */
+interface DeployTargetLogger {
+  info(message: string): void;
+  warn(message: string): void;
+  error(message: string): void;
+}
+/**
+ * The events a target reports. The run's own — `deploy.*` and `phase.*` —
+ * are the CLI's, which emits them around each phase it calls.
+ */
+type TargetEvent = Exclude<DeployEvent, {
+  type: 'deploy.started' | 'deploy.finished' | 'deploy.failed' | 'phase.started' | 'phase.finished' | 'phase.failed';
+}>;
+/** Everything a phase is handed. The same object for every phase of a run. */
+interface DeployPhaseContext<Options = undefined> {
+  /** The name the target was resolved by — `deploy.default`, `--target`. */
+  readonly target: string;
+  /**
+   * The workspace root. Never `process.cwd()`: a host deploys projects
+   * that are not where it runs.
+   */
+  readonly cwd: string;
+  readonly stage: string;
+  /** The image tag, or whatever version label the target releases under. */
+  readonly tag: string;
+  /**
+   * The apps this target deploys, in dependency order: those asked for that
+   * deploy here. Apps that deploy elsewhere are already in `skipped`.
+   */
+  readonly apps: readonly string[];
+  /** The apps the run leaves out, and why. */
+  readonly skipped: readonly {
+    app: string;
+    reason: string;
+  }[];
+  /** Who the deploy is, for naming and claiming what it creates. */
+  readonly identity: DeployIdentity;
+  /** The workspace, with its apps derived from the manifest. */
+  readonly workspace: NormalizedWorkspace;
+  /** What the workspace declares. */
+  readonly manifest: ConstructManifest;
+  /** The target's options, as its `options` schema parsed them. */
+  readonly options: Options;
+  /**
+   * Look everything up and report what would happen — as `resource.planned`
+   * events — without changing anything. Only `validate` and `plan` run.
+   */
+  readonly dryRun: boolean;
+  /** Where every credential comes from. Nothing prompts. */
+  readonly credentials: CredentialProvider;
+  /**
+   * The stage's deploy state. A real run holds the stage's lock for every
+   * phase; a dry run holds none and must write nothing.
+   */
+  readonly state: StateStore;
+  readonly secrets: DeploySecrets;
+  readonly logger: DeployTargetLogger;
+  /** Fires when the run is stopped; every phase stops what it is doing. */
+  readonly signal: AbortSignal;
+  /**
+   * Where the output of what a phase spawns goes: the host's terminal, its
+   * stderr (so stdout carries only events), or nowhere.
+   */
+  readonly childOutput: 'inherit' | 'stderr' | 'ignore';
+  /** Report progress. */
+  emit(event: TargetEvent): void;
+  /** Leave an app out of this run, with the reason a person will read. */
+  skip(app: string, reason: string): void;
+  /**
+   * What a resource is called on the target: scoped by the stage and the
+   * identity exactly as the constructs are — `name('api')` is
+   * `production-shop-api`. Two workspaces, or two stages, never share one.
+   */
+  name(resource: string): string;
+}
+/** Why `rollback` was called: the phase that failed, and its error. */
+interface DeployFailure {
+  readonly phase: 'release' | 'verify';
+  readonly error: unknown;
+}
+/**
+ * A deploy target.
+ *
+ * The CLI calls the phases in order — `validate`, then `plan` for a dry run,
+ * or `provision → build → release → verify` for a real one — emitting
+ * `phase.started`/`phase.finished` around each. Every phase must be safe to
+ * run again: a deploy stopped part way is finished by deploying again, so a
+ * phase finds what an earlier run made (through `state`) before making it.
+ *
+ * `Run` is whatever the target carries from one phase to the next within a
+ * run — `validate` makes it, every later phase is handed it.
+ *
+ * ```ts
+ * import { defineTarget } from '@geekmidas/cli/target';
+ * import { z } from 'zod';
+ *
+ * export default defineTarget({
+ *   name: 'fly',
+ *   runtime: 'server',
+ *   capabilities: { rollback: true, migrations: 'target', images: true },
+ *   options: z.object({ org: z.string(), region: z.string().default('ams') }),
+ *   async validate(ctx) {
+ *     return { org: ctx.options.org, region: ctx.options.region };
+ *   },
+ *   async plan(ctx, run) { … },
+ *   async release(ctx, run) { … },
+ *   async rollback(ctx, run, failure) { … },
+ *   result(ctx, run) { … },
+ * });
+ * ```
+ */
+interface DeployTarget<Options = undefined, Run = unknown> {
+  /** The target's own name, for messages. Config refers to it by its key. */
+  readonly name: string;
+  readonly runtime: DeployRuntime;
+  readonly capabilities: DeployTargetCapabilities;
+  /**
+   * What `deploy.targets` may pass it — `[package, options]` — validated
+   * before any phase runs. Without one, the target takes no options.
+   */
+  readonly options?: TargetOptionsSchema<Options>;
+  /**
+   * The kinds of credential it asks the run's `CredentialProvider` for, so a
+   * host or `gkm login` can collect them up front.
+   */
+  readonly credentials?: readonly CredentialKind[];
+  /**
+   * Everything the deploy needs, checked before anything changes: the
+   * config, the apps, credentials, the stage's secrets.
+   */
+  validate(ctx: DeployPhaseContext<Options>): Promise<Run>;
+  /** A dry run: emit `resource.planned` for what a real run would do. */
+  plan(ctx: DeployPhaseContext<Options>, run: Run): Promise<void>;
+  /** Create or find what the apps run on, and what they declare. */
+  provision?(ctx: DeployPhaseContext<Options>, run: Run): Promise<void>;
+  /** Build each app's artifact (`artifact.built`), changing nothing live. */
+  build?(ctx: DeployPhaseContext<Options>, run: Run): Promise<void>;
+  /** Put the built artifacts live (`app.deployed`). */
+  release(ctx: DeployPhaseContext<Options>, run: Run): Promise<void>;
+  /** Check what was released answers (`health.checked`). */
+  verify?(ctx: DeployPhaseContext<Options>, run: Run): Promise<void>;
+  /**
+   * Restore the previous release, after `release` or `verify` failed. Called
+   * only when `capabilities.rollback` is true.
+   */
+  rollback?(ctx: DeployPhaseContext<Options>, run: Run, failure: DeployFailure): Promise<void>;
+  /** What the run did, once its last phase has finished. */
+  result(ctx: DeployPhaseContext<Options>, run: Run): DeployResult | Promise<DeployResult>;
+}
+/**
+ * A target of any options and run state — what the CLI holds once a target
+ * is resolved, its types left behind in the config that named it. The phases
+ * are methods, so their parameters are compared bivariantly and every
+ * `DeployTarget<O, R>` is one.
+ */
+type AnyDeployTarget = DeployTarget<unknown, unknown>;
+/** A target's options type, from the target. */
+type TargetOptions<T> = T extends DeployTarget<infer O, infer _Run> ? O : never;
+/**
+ * One `deploy.targets` entry:
+ *
+ * - `'@acme/gkm-target'` — a package, its default export the target
+ * - a target object, from `defineTarget` or a package's factory
+ * - `['@acme/gkm-target', { region: 'ams' }]` — either, with options
+ */
+type DeployTargetEntry = string | AnyDeployTarget | readonly [string | AnyDeployTarget, unknown];
 declare namespace json_schema_d_exports {
   export { ArraySchema, BaseSchema, BooleanSchema, IntegerSchema, JSONSchema, NullSchema, NumberSchema, ObjectSchema, Schema$1 as Schema, SchemaType, StringSchema, _JSONSchema };
 }
@@ -4746,17 +5334,18 @@ declare const FrameworkSchema: ZodUnion<readonly [ZodEnum<{
  */
 type Framework = output$1<typeof FrameworkSchema>;
 /**
- * Supported deploy targets (Phase 1).
+ * The built-in targets a config may name: `dokploy`, deployed by
+ * `gkm deploy`, and `sst`, deployed by `sst deploy` from the manifest
+ * `gkm build` writes.
  */
-declare const SUPPORTED_DEPLOY_TARGETS: readonly ['dokploy', 'sst'];
+declare const SUPPORTED_DEPLOY_TARGETS: string[];
+/** Built-in names reserved for targets that do not exist yet. */
+declare const PHASE_2_DEPLOY_TARGETS: string[];
 /**
- * Phase 2 deploy targets (not yet implemented).
+ * Whether a config may name `target`: a usable built-in, or one of its own
+ * `deploy.targets`.
  */
-declare const PHASE_2_DEPLOY_TARGETS: readonly ['vercel', 'cloudflare'];
-/**
- * Check if a deploy target is supported.
- */
-declare function isDeployTargetSupported(target: string): boolean;
+declare function isDeployTargetSupported(target: string, targets?: Record<string, unknown>): boolean;
 /**
  * Check if a deploy target is planned for Phase 2.
  */
@@ -4938,12 +5527,7 @@ declare const WorkspaceConfigSchema: ZodObject<{
     path: ZodString;
     port: ZodNumber;
     dependencies: ZodOptional<ZodArray<ZodString>>;
-    deploy: ZodOptional<ZodEnum<{
-      cloudflare: "cloudflare";
-      dokploy: "dokploy";
-      sst: "sst";
-      vercel: "vercel";
-    }>>;
+    deploy: ZodOptional<ZodString>;
     constructs: ZodOptional<ZodUnion<readonly [ZodString, ZodArray<ZodString>]>>;
     routes: ZodOptional<ZodUnion<readonly [ZodString, ZodArray<ZodString>]>>;
     functions: ZodOptional<ZodUnion<readonly [ZodString, ZodArray<ZodString>]>>;
@@ -5005,12 +5589,8 @@ declare const WorkspaceConfigSchema: ZodObject<{
     }, $strip>>;
   }, $strip>>;
   deploy: ZodOptional<ZodObject<{
-    default: ZodOptional<ZodEnum<{
-      cloudflare: "cloudflare";
-      dokploy: "dokploy";
-      sst: "sst";
-      vercel: "vercel";
-    }>>;
+    default: ZodOptional<ZodString>;
+    targets: ZodOptional<ZodRecord<ZodString, ZodUnion<readonly [ZodString, ZodCustom<unknown, unknown>, ZodTuple<[ZodUnion<readonly [ZodString, ZodCustom<unknown, unknown>]>, ZodUnknown], null>]>>>;
     namespace: ZodOptional<ZodString>;
     domains: ZodOptional<ZodRecord<ZodString, ZodString>>;
     dokploy: ZodOptional<ZodObject<{
@@ -5327,21 +5907,16 @@ declare function formatValidationErrors(error: ZodError): string;
 //#endregion
 //#region src/workspace/types.d.ts
 /**
- * Deploy target for an app.
- *
- * Specifies where the app will be deployed.
+ * Where a stage — or one app — deploys, by target name: a built-in
+ * (`dokploy`; `sst`, deployed by SST itself) or a key of `deploy.targets`.
  *
  * @example
  * ```ts
- * // Currently supported
  * deploy: 'dokploy'
- *
- * // Future support (not yet implemented)
- * deploy: 'vercel'
- * deploy: 'cloudflare'
+ * deploy: 'acme' // deploy: { targets: { acme: '@acme/gkm-target' } }
  * ```
  */
-type DeployTarget = 'dokploy' | 'sst' | 'vercel' | 'cloudflare';
+type DeployTargetName = 'dokploy' | 'sst' | (string & {});
 /**
  * Each deployed stage's base domain — `deploy.domains`.
  *
@@ -5459,7 +6034,24 @@ interface DokployWorkspaceConfig {
  */
 interface DeployConfig {
   /** Default deploy target for all apps (default: 'dokploy') */
-  default?: DeployTarget;
+  default?: DeployTargetName;
+  /**
+   * Targets that do not ship with the CLI, by the name `default` (or an
+   * app's `deploy`) uses: a package whose default export is the target, a
+   * target object, or either with its options.
+   *
+   * ```ts
+   * targets: {
+   *   acme: '@acme/gkm-target',
+   *   fly: ['@acme/gkm-fly', { org: 'acme' }],
+   *   local: defineTarget({ … }),
+   * }
+   * ```
+   *
+   * A package is never guessed from a name: it is installed and listed here.
+   * A built-in's name cannot be taken.
+   */
+  targets?: Record<string, DeployTargetEntry>;
   /**
    * Whose deploy this is, on a target shared with other workspaces — an
    * organisation or a team, lowercase `[a-z0-9-]`. Two workspaces with the
@@ -5652,7 +6244,7 @@ interface AppConfigBase {
    * Overrides `deploy.default` for this specific app.
    * @example 'dokploy', 'vercel'
    */
-  deploy?: DeployTarget;
+  deploy?: DeployTargetName;
   /**
    * Constructs glob pattern — one glob, every kind.
    *
@@ -6103,7 +6695,7 @@ interface NormalizedAppConfig extends Omit<AppConfigBase, 'type'> {
   /** Resolved dependencies array (empty array if none) */
   dependencies: string[];
   /** Resolved deploy target (app.deploy > deploy.default > 'dokploy') */
-  resolvedDeployTarget: DeployTarget;
+  resolvedDeployTarget: DeployTargetName;
   /** Entry file path for non-gkm apps */
   entry?: string;
   /** Framework for the app */
@@ -6406,5 +6998,5 @@ interface GkmConfig {
   deploy?: DeployConfig;
 }
 //#endregion
-export { PHASE_2_DEPLOY_TARGETS as A, StateVersionConflict as B, WorkspaceConfig as C, Framework as D, BackendFramework as E, isDeployTargetSupported as F, isPhase2DeployTarget as I, safeValidateWorkspaceConfig as L, WorkspaceConfigSchema as M, formatValidationErrors as N, FrontendFramework as O, getDeployTargetError as P, validateWorkspaceConfig as R, SharedConfig as S, isWorkspaceConfig as T, LoadedConfig as _, Routes as a, NormalizedWorkspace as b, AppInput as c, DeployConfig as d, DeployTarget as f, InferredWorkspaceConfig as g, InferAppNames as h, OpenApiConfig as i, SUPPORTED_DEPLOY_TARGETS as j, MobileFramework as k, AppsRecord as l, DokployWorkspaceConfig as m, EmailBackend as n, AppConfig as o, DevConfig as p, GkmConfig as r, AppConfigInput as s, CacheBackend as t, ConstrainedApps as u, ModelsConfig as v, WorkspaceInput as w, SecretsConfig as x, NormalizedAppConfig as y, StateLocked as z };
-//# sourceMappingURL=types-Bp1mVxG0.d.mts.map
+export { DeployEventError as $, PHASE_2_DEPLOY_TARGETS as A, DeployFailure as B, WorkspaceConfig as C, Framework as D, BackendFramework as E, isDeployTargetSupported as F, DeployTargetCapabilities as G, DeployRuntime as H, isPhase2DeployTarget as I, TargetEvent as J, DeployTargetEntry as K, safeValidateWorkspaceConfig as L, WorkspaceConfigSchema as M, formatValidationErrors as N, FrontendFramework as O, getDeployTargetError as P, DeployEvent as Q, validateWorkspaceConfig as R, SharedConfig as S, isWorkspaceConfig as T, DeploySecrets as U, DeployPhaseContext as V, DeployTarget as W, TargetOptionsIssue as X, TargetOptions as Y, TargetOptionsSchema as Z, LoadedConfig as _, StateVersionConflict as _t, Routes as a, DeployResult as at, NormalizedWorkspace as b, deployIdentity as bt, AppInput as c, CredentialKinds as ct, DeployConfig as d, MissingCredential as dt, DeployEventType as et, DeployTargetName as f, StoredCredentialsOptions as ft, InferredWorkspaceConfig as g, StateStore as gt, InferAppNames as h, StateLocked as ht, OpenApiConfig as i, AppDeployResult as it, SUPPORTED_DEPLOY_TARGETS as j, MobileFramework as k, AppsRecord as l, CredentialProvider as lt, DokployWorkspaceConfig as m, storedCredentials as mt, EmailBackend as n, ResourceChange as nt, AppConfig as o, Credential as ot, DevConfig as p, chainCredentials as pt, DeployTargetLogger as q, GkmConfig as r, ResourceVia as rt, AppConfigInput as s, CredentialKind as st, CacheBackend as t, DeployPhase as tt, ConstrainedApps as u, CredentialRequest as ut, ModelsConfig as v, StageSecrets as vt, WorkspaceInput as w, SecretsConfig as x, NormalizedAppConfig as y, DeployIdentity as yt, AnyDeployTarget as z };
+//# sourceMappingURL=types-DIA7Li-J.d.cts.map