@geekmidas/cli 10.0.0-alpha.9 → 10.0.0-alpha.91

package/dist/workspace-CJ0lKFq-.mjs

@@ -0,0 +1,1979 @@
+import { n as __require } from "./rolldown-runtime-BhDjJH2R.mjs";
+import { a as discriminatedUnion, d as record, f as string, g as url, h as unknown, i as custom, l as number, m as union, n as array, p as tuple, r as boolean, s as literal, t as _enum, u as object } from "./schemas-D-xeKJDD.mjs";
+import { n as isDeployTarget, o as builtinTarget, r as BUILTIN_TARGETS, s as configurableBuiltins } from "./define-DR8xGYfL.mjs";
+import { basename, isAbsolute, join, resolve } from "node:path";
+import { isIP } from "node:net";
+//#region src/secrets/providers.ts
+/**
+* The secrets stores gkm ships, by name — with no imports, so the config
+* loader can check `secrets.store` without loading any store.
+*/
+/** The stores this package ships, by the name `secrets.store` gives them. */
+const SECRETS_STORE_PROVIDERS = [
+	"file",
+	"ssm",
+	"secrets-manager"
+];
+/**
+* `secrets.store` names a provider this package does not ship — a typo such
+* as `'secretsmanager'` or `'ssm-parameter'`. Refused rather than read as the
+* file, which would leave a deployed stage's secrets on one machine.
+*/
+var UnknownSecretsStoreProvider = class extends Error {
+	provider;
+	constructor(provider) {
+		super(`secrets.store names the provider ${JSON.stringify(provider)}, which is not one gkm ships. Use 'file', { provider: 'ssm', region }, { provider: 'secrets-manager', region }, or { provider: <an object with name, read() and write()> } in gkm.config.ts.`);
+		this.provider = provider;
+		this.name = "UnknownSecretsStoreProvider";
+	}
+};
+/**
+* Refuse a `secrets.store` naming a provider that is not one, before the
+* schema reduces it to a generic validation failure.
+*/
+function assertKnownSecretsStore(store) {
+	if (store === void 0) return;
+	const provider = typeof store === "object" && store !== null && "provider" in store ? store.provider : store;
+	if (typeof provider === "string" && !SECRETS_STORE_PROVIDERS.includes(provider)) throw new UnknownSecretsStoreProvider(provider);
+}
+//#endregion
+//#region src/compose/dnsConfig.ts
+/**
+* `dns['<root domain>'].records` — how a domain's hosts point at a compose
+* stage's server — checked and read. Pure, and kept apart from the DNS step
+* so the workspace schema checks a config with the same rules and the same
+* named errors the step applies.
+*/
+/** The stage-secret key holding the server's public IPv4 address. */
+const SERVER_IPV4_KEY = "GKM_SERVER_IPV4";
+/** The stage-secret key holding the server's public IPv6 address, if any. */
+const SERVER_IPV6_KEY = "GKM_SERVER_IPV6";
+/**
+* Whether a stage secret is gkm's own — the server's address — and so never
+* written into an app's or a worker's environment.
+*/
+function isReservedStageKey(key) {
+	return key.startsWith("GKM_SERVER_");
+}
+/** A DNS hostname: dot-separated labels of letters, digits and inner '-'. */
+const HOSTNAME = /^(?=.{1,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$/i;
+/** Whether `value` is a DNS hostname with at least two labels. */
+function isHostname(value) {
+	return typeof value === "string" && HOSTNAME.test(value);
+}
+/** A CNAME target that is not a hostname under its own domain. */
+var DnsTargetInvalid = class extends Error {
+	domain;
+	target;
+	stage;
+	constructor(domain, target, stage) {
+		super(`dns['${domain}'].records.target${stage ? ` for '${stage}'` : ""} is ${JSON.stringify(target)}, which is not a hostname under ${domain}. Every host's CNAME points at it and gkm writes its A record, so it must be a name in the same zone — like 'server.${domain}'.`);
+		this.domain = domain;
+		this.target = target;
+		this.stage = stage;
+		this.name = "DnsTargetInvalid";
+	}
+};
+/** The CNAME target names under one domain, by the stage they are for, checked. */
+function targets(records) {
+	const { target } = records;
+	if (target && typeof target === "object" && !Array.isArray(target)) return Object.entries(target);
+	return [[void 0, target]];
+}
+/**
+* One domain's records mode checked.
+*
+* @throws {DnsTargetInvalid} for a target that is not a hostname under it
+*/
+function checkDnsRecordsMode(domain, records) {
+	if (!records || typeof records !== "object") return;
+	const mode = records;
+	if (mode.mode !== "cname") return;
+	for (const [stage, target] of targets(mode)) {
+		const name = typeof target === "string" ? target.toLowerCase() : target;
+		if (!isHostname(name) || !name.endsWith(`.${domain.toLowerCase()}`)) throw new DnsTargetInvalid(domain, target, stage);
+	}
+}
+/**
+* The CNAME target a domain's hosts point at on `stage`, or `undefined` for
+* A records — including a per-stage map that names no target for it.
+*/
+function cnameTarget(records, stage) {
+	if (!records || records === "a") return void 0;
+	return (typeof records.target === "string" ? records.target : records.target[stage])?.toLowerCase();
+}
+//#endregion
+//#region src/compose/proxy.ts
+/**
+* Which proxy a stage's stack is served by, and with whose certificate —
+* `deploy.compose.proxy` and `deploy.compose.tls`, resolved for one stage.
+*
+* Pure, and kept apart from the stack so the workspace schema can check a
+* config with the same rules — and the same named errors — the stack applies.
+*/
+/** A per-stage setting keyed by a stage the workspace does not have. */
+var ComposeStageUnknown = class extends Error {
+	setting;
+	stage;
+	stages;
+	constructor(setting, stage, stages) {
+		super(`deploy.compose.${setting} names the stage '${stage}', which is not one of this workspace's (${stages.join(", ")}). Use a stage from stages.local or stages.deployed.`);
+		this.setting = setting;
+		this.stage = stage;
+		this.stages = stages;
+		this.name = "ComposeStageUnknown";
+	}
+};
+/**
+* A certificate for the local stage, whose certificates are always Caddy's
+* own CA — the one `gkm trust` installs.
+*/
+var ComposeTlsOnLocalStage = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`deploy.compose.tls sets a certificate for '${stage}', the local stage, whose certificates always come from Caddy's local CA (\`gkm trust\` installs it). Remove it, or set it for a deployed stage.`);
+		this.stage = stage;
+		this.name = "ComposeTlsOnLocalStage";
+	}
+};
+/** The stage's certificate or key file is not there to read. */
+var ComposeTlsFileMissing = class extends Error {
+	stage;
+	file;
+	constructor(stage, file) {
+		super(`deploy.compose.tls for '${stage}' names ${file}, and there is no file there. Point certFile and keyFile at the PEM certificate (with its chain) and key — relative to the workspace root, or absolute.`);
+		this.stage = stage;
+		this.file = file;
+		this.name = "ComposeTlsFileMissing";
+	}
+};
+/**
+* The proxy a stage's stack is served by. The local stage is always Caddy —
+* its internal CA and `gkm trust` — whatever is configured.
+*/
+function proxyFor(config, stage, local) {
+	if (local) return "caddy";
+	const proxy = config?.proxy;
+	if (!proxy) return "caddy";
+	if (typeof proxy === "string") return proxy;
+	return proxy[stage] ?? "caddy";
+}
+/** A deployed stage's own certificate, its paths absolute, when it sets one. */
+function certificateFor(config, stage, root) {
+	const tls = config?.tls?.[stage];
+	if (!tls) return void 0;
+	const absolute = (file) => isAbsolute(file) ? file : resolve(root, file);
+	return {
+		certFile: absolute(tls.certFile),
+		keyFile: absolute(tls.keyFile)
+	};
+}
+/**
+* Throws the named error for the first thing wrong with the per-stage
+* settings: a stage the workspace does not have, or a certificate for the
+* local stage.
+*/
+function checkComposeStages(config, stages) {
+	const known = [stages.local, ...stages.deployed];
+	if (config?.proxy && typeof config.proxy === "object") {
+		for (const stage of Object.keys(config.proxy)) if (!known.includes(stage)) throw new ComposeStageUnknown("proxy", stage, known);
+	}
+	for (const stage of Object.keys(config?.tls ?? {})) {
+		if (stage === stages.local) throw new ComposeTlsOnLocalStage(stage);
+		if (!known.includes(stage)) throw new ComposeStageUnknown("tls", stage, known);
+	}
+}
+//#endregion
+//#region src/providers/s3/errors.ts
+/** What the `s3` provider refuses, and how each is put right. */
+/** An `objects` entry for `s3` with a field it does not take or cannot use. */
+var S3ProviderConfigInvalid = class extends Error {
+	stage;
+	field;
+	value;
+	expected;
+	constructor(stage, field, value, expected) {
+		super(`deploy.objects.${stage}.${field} is ${JSON.stringify(value)}; ${expected}.`);
+		this.stage = stage;
+		this.field = field;
+		this.value = value;
+		this.expected = expected;
+		this.name = "S3ProviderConfigInvalid";
+	}
+};
+/** No region anywhere to create the stage's buckets in. */
+var S3RegionRequired = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`The s3 provider has no region for the stage '${stage}'. Name one in gkm.config.ts: deploy: { objects: { ${stage}: { provider: 's3', region: 'eu-west-1' } } } — or set AWS_REGION.`);
+		this.stage = stage;
+		this.name = "S3RegionRequired";
+	}
+};
+/** The good name and every suffixed one are taken by other accounts. */
+var BucketNameUnavailable = class extends Error {
+	id;
+	tried;
+	constructor(id, tried) {
+		super(`Every name tried for the bucket '${id}' is taken by another AWS account: ${tried.join(", ")}. Set deploy.namespace in gkm.config.ts to something more particular to you, and run the provision again.`);
+		this.id = id;
+		this.tried = tried;
+		this.name = "BucketNameUnavailable";
+	}
+};
+/** A bucket in this account carries another project's tag. */
+var BucketOwnedByAnotherProject = class extends Error {
+	bucket;
+	owner;
+	project;
+	constructor(bucket, owner, project) {
+		super(`The bucket '${bucket}' is in this account and tagged gkm:project=${owner}, not ${project}: another project's. gkm never adopts it. Set deploy.namespace in gkm.config.ts so this project names its buckets differently.`);
+		this.bucket = bucket;
+		this.owner = owner;
+		this.project = project;
+		this.name = "BucketOwnedByAnotherProject";
+	}
+};
+/** The bucket the stage's state names exists, and this account cannot reach it. */
+var RecordedBucketUnreachable = class extends Error {
+	id;
+	bucket;
+	constructor(id, bucket) {
+		super(`The stage's state records '${bucket}' as the bucket for '${id}', and this account cannot reach it — it is in another account, or the credentials are not the stage account's. Run with the account that created it (--profile).`);
+		this.id = id;
+		this.bucket = bucket;
+		this.name = "RecordedBucketUnreachable";
+	}
+};
+/** An IAM user by gkm's name exists, and gkm did not create it for this stage. */
+var IamUserNotOwned = class extends Error {
+	user;
+	project;
+	stage;
+	constructor(user, project, stage) {
+		super(`The IAM user '${user}' exists and is not tagged gkm:project=${project}, gkm:stage=${stage}, so gkm leaves it alone. Rename or delete it, or set deploy.namespace in gkm.config.ts so gkm names its users differently.`);
+		this.user = user;
+		this.project = project;
+		this.stage = stage;
+		this.name = "IamUserNotOwned";
+	}
+};
+/** The user already has the two access keys IAM allows. */
+var AccessKeyLimit = class extends Error {
+	user;
+	keys;
+	constructor(user, keys) {
+		super(`The IAM user '${user}' already has two access keys (${keys.join(", ")}), the most IAM allows, and gkm needs to issue one. Delete the one the stage does not use (aws iam delete-access-key --user-name ${user} --access-key-id …), then run the provision again.`);
+		this.user = user;
+		this.keys = keys;
+		this.name = "AccessKeyLimit";
+	}
+};
+/** `--rotate-keys` while the last rotation's old key is still active. */
+var RotationInProgress = class extends Error {
+	id;
+	previous;
+	stage;
+	constructor(id, previous, stage) {
+		super(`The bucket '${id}' is mid-rotation: its old key ${previous} is still active. Deploy '${stage}', then run gkm setup --stage ${stage} — or pass --retire-old-keys to delete it now — before rotating again.`);
+		this.id = id;
+		this.previous = previous;
+		this.stage = stage;
+		this.name = "RotationInProgress";
+	}
+};
+/** The stage's secrets point the bucket's key at a bucket gkm did not provision. */
+var BucketKeySetElsewhere = class extends Error {
+	key;
+	bucket;
+	found;
+	stage;
+	constructor(key, bucket, found, stage) {
+		super(`${key} in the stage '${stage}' points at the bucket '${found}', and the s3 provider manages '${bucket}' for it. Remove the key (gkm secrets:unset ${key} --stage ${stage}) to have the provider write its own, or set deploy.objects.${stage} to 'external' to keep yours.`);
+		this.key = key;
+		this.bucket = bucket;
+		this.found = found;
+		this.stage = stage;
+		this.name = "BucketKeySetElsewhere";
+	}
+};
+/** `verify()`: a provisioned bucket the stage's key cannot reach. */
+var ProvisionedBucketUnreachable = class extends Error {
+	id;
+	bucket;
+	stage;
+	reason;
+	constructor(id, bucket, stage, reason) {
+		super(`The bucket '${bucket}' (${id}) cannot be reached with the key in the stage '${stage}''s secrets: ${reason}. Run gkm setup --stage ${stage} with the stage account's credentials to create or repair it, then deploy again.`);
+		this.id = id;
+		this.bucket = bucket;
+		this.stage = stage;
+		this.reason = reason;
+		this.name = "ProvisionedBucketUnreachable";
+	}
+};
+//#endregion
+//#region src/providers/s3/config.ts
+const FIELDS = [
+	"provider",
+	"region",
+	"versioning"
+];
+/** An AWS region code: `eu-west-1`, `us-gov-west-1`, `ap-southeast-4`. */
+const REGION = /^[a-z]{2}(-[a-z]+)+-\d+$/;
+function checkS3Config(stage, config) {
+	const entry = config;
+	for (const field of Object.keys(entry)) if (!FIELDS.includes(field)) throw new S3ProviderConfigInvalid(stage, field, entry[field], `the s3 provider takes ${FIELDS.slice(1).join(" and ")} only`);
+	if (entry.region !== void 0) {
+		if (typeof entry.region !== "string" || !REGION.test(entry.region)) throw new S3ProviderConfigInvalid(stage, "region", entry.region, "set it to an AWS region code, like 'eu-west-1'");
+	}
+	if (entry.versioning !== void 0 && typeof entry.versioning !== "boolean") throw new S3ProviderConfigInvalid(stage, "versioning", entry.versioning, "set it to true to keep previous versions of every object, or leave it out");
+	return entry;
+}
+/** How the s3 provider's provisioning credentials are supplied. */
+const S3_PROVISIONING = {
+	env: [
+		"AWS_PROFILE",
+		"AWS_ACCESS_KEY_ID",
+		"AWS_SECRET_ACCESS_KEY",
+		"AWS_SESSION_TOKEN"
+	],
+	describe: "the stage's AWS account — --profile <name>, AWS_PROFILE, or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY (in CI, what aws-actions/configure-aws-credentials exports)"
+};
+//#endregion
+//#region src/providers/config.ts
+/**
+* `deploy.<kind>.<stage>`, read: what backs one kind of construct on a stage.
+*
+* Kept free of the providers themselves — of the AWS SDK and the graph — so
+* the workspace schema can check an entry with the words a deploy would use,
+* the way `checkStageTelemetry` does for `deploy.telemetry`.
+*/
+/** Each provider's config check, by kind and name. */
+const CHECKS = { objects: { s3: checkS3Config } };
+/** How each provider's provisioning credentials are supplied, by kind and name. */
+const PROVISIONING = { objects: { s3: S3_PROVISIONING } };
+/** How `name`'s provisioning credentials are supplied, for messages. */
+function provisioningOf(kind, name) {
+	return Object.hasOwn(PROVISIONING[kind], name) ? PROVISIONING[kind][name] : void 0;
+}
+/** The `provider:` names a kind accepts. */
+function providerNamesOf(kind) {
+	return Object.keys(CHECKS[kind]).sort();
+}
+/** What `deploy.<kind>.<stage>` may be, for messages. */
+function accepted(kind) {
+	return [
+		"'external'",
+		...providerNamesOf(kind).map((name) => `{ provider: '${name}' }`),
+		"false"
+	].join(", ");
+}
+/** An entry that names no provider gkm has, or is not an entry at all. */
+var UnknownStageProvider = class extends Error {
+	kind;
+	stage;
+	value;
+	constructor(kind, stage, value) {
+		super(`deploy.${kind}.${stage} is ${JSON.stringify(value)}, which is not a provider gkm has for ${kind}. It takes ${accepted(kind)}.`);
+		this.kind = kind;
+		this.stage = stage;
+		this.value = value;
+		this.name = "UnknownStageProvider";
+	}
+};
+/**
+* One stage's entry checked: `'external'`, `false`, or a provider's object
+* that its own check accepts.
+*
+* @throws {UnknownStageProvider} for anything else — `'minio'` included
+*/
+function checkStageProvider(kind, stage, value) {
+	if (value === "external" || value === false) return value;
+	if (value && typeof value === "object" && !Array.isArray(value)) {
+		const name = value.provider;
+		const check = typeof name === "string" && Object.hasOwn(CHECKS[kind], name) ? CHECKS[kind][name] : void 0;
+		if (check) return check(stage, value);
+	}
+	throw new UnknownStageProvider(kind, stage, value);
+}
+/**
+* What backs `kind` on `stage`: the local stage is always `external` here —
+* `gkm dev` runs its own — and a deployed stage that names nothing is too.
+*/
+function stageProvider(workspace, kind, stage) {
+	if (stage === workspace.stages?.local) return { mode: "external" };
+	const value = workspace.deploy?.[kind]?.[stage];
+	if (value === void 0) return { mode: "external" };
+	const entry = checkStageProvider(kind, stage, value);
+	if (entry === "external") return { mode: "external" };
+	if (entry === false) return { mode: "none" };
+	return {
+		mode: "provider",
+		name: entry.provider,
+		config: entry
+	};
+}
+//#endregion
+//#region src/compose/logsConfig.ts
+/**
+* The self-hosted telemetry provider's options, read: how the stack's
+* OpenObserve is run and reached — `deploy.telemetry.<stage>` with
+* `provider: 'self-hosted'`.
+*
+* Kept apart from the stack so the workspace schema can check a config with
+* the same rules — and the same named errors — the stack applies.
+*/
+/** The port OpenObserve listens on, and the one it is published on by default. */
+const LOGS_PORT = 5080;
+/** `public` with no address to allow: nobody could reach it. */
+var LogsAllowEmpty = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`deploy.telemetry.${stage}.public.allow is empty, so the logs site would answer every request with 403. List the addresses that may reach it (public: { allow: ['203.0.113.7', '10.0.0.0/8'] }), or remove public and reach it through an SSH tunnel.`);
+		this.stage = stage;
+		this.name = "LogsAllowEmpty";
+	}
+};
+/** An `allow` entry that is not an IP address or a CIDR range. */
+var LogsAllowEntryInvalid = class extends Error {
+	stage;
+	entry;
+	constructor(stage, entry) {
+		super(`deploy.telemetry.${stage}.public.allow has '${entry}', which is not an IP address or a CIDR range. Write one like '203.0.113.7', '10.0.0.0/8' or '2001:db8::/32'.`);
+		this.stage = stage;
+		this.entry = entry;
+		this.name = "LogsAllowEntryInvalid";
+	}
+};
+/** A retention OpenObserve would refuse to start with. */
+var LogsRetentionInvalid = class extends Error {
+	stage;
+	retentionDays;
+	constructor(stage, retentionDays) {
+		super(`deploy.telemetry.${stage}.retentionDays is ${String(retentionDays)}; it must be a whole number of days, at least 3 — OpenObserve refuses to start with fewer. Leave it out for 30.`);
+		this.stage = stage;
+		this.retentionDays = retentionDays;
+		this.name = "LogsRetentionInvalid";
+	}
+};
+/** A port that is not one. */
+var LogsPortInvalid = class extends Error {
+	stage;
+	port;
+	constructor(stage, port) {
+		super(`deploy.telemetry.${stage}.port is ${String(port)}; set it to a number between 1 and 65535, or leave it out for ${LOGS_PORT}.`);
+		this.stage = stage;
+		this.port = port;
+		this.name = "LogsPortInvalid";
+	}
+};
+/** Whether `entry` is an IP address, or an address and a prefix length. */
+function isAddressOrRange(entry) {
+	const [address = "", prefix, ...rest] = entry.split("/");
+	if (rest.length > 0) return false;
+	const family = isIP(address);
+	if (family === 0) return false;
+	if (prefix === void 0) return true;
+	if (!/^\d{1,3}$/.test(prefix)) return false;
+	return Number(prefix) <= (family === 4 ? 32 : 128);
+}
+/**
+* The self-hosted provider's options with their defaults — `{}` for all of
+* them. Throws the named error for the first thing wrong with them.
+*/
+function resolveSelfHosted(config, stage) {
+	const port = config.port ?? 5080;
+	if (!Number.isInteger(port) || port < 1 || port > 65535) throw new LogsPortInvalid(stage, config.port);
+	const retentionDays = config.retentionDays ?? 30;
+	if (!Number.isInteger(retentionDays) || retentionDays < 3) throw new LogsRetentionInvalid(stage, config.retentionDays);
+	if (config.public) {
+		const allow = config.public.allow ?? [];
+		if (allow.length === 0) throw new LogsAllowEmpty(stage);
+		for (const entry of allow) if (!isAddressOrRange(entry)) throw new LogsAllowEntryInvalid(stage, entry);
+		return {
+			port,
+			retentionDays,
+			public: { allow: [...allow] }
+		};
+	}
+	return {
+		port,
+		retentionDays
+	};
+}
+//#endregion
+//#region src/telemetry/config.ts
+/**
+* `deploy.telemetry`, read: where one stage's telemetry goes, and how much.
+*
+* The application says what it emits (the `Telemetry` construct). This says
+* where it is sent, per stage, and is the only place that does:
+*
+* - **self-hosted** — the target runs OpenObserve beside the apps (#189's
+*   stack service). A server target that can run it uses it when a stage
+*   names nothing.
+* - **otlp** — any OTLP/HTTP endpoint, with its headers.
+* - **false** — nothing is sent.
+*
+* Vendor presets (a known endpoint and header shape, with the stage secret
+* `TELEMETRY_CREDENTIALS`) are one more entry in {@link PROVIDERS}: a
+* resolver from the stage's config to a {@link ResolvedTelemetry}, which
+* every target already consumes through {@link telemetryEnv}.
+*
+* The local stage ignores all of it: `gkm dev` and `gkm compose` on it run
+* OpenObserve and keep every trace.
+*/
+/** A deployed stage uses telemetry and its target cannot choose for it. */
+var TelemetryProviderRequired = class extends Error {
+	stage;
+	target;
+	constructor(stage, target) {
+		super(`The stage '${stage}' deploys through ${target}, which cannot run telemetry itself, and a process uses a Telemetry construct. Say where it goes in gkm.config.ts: deploy: { telemetry: { ${stage}: { provider: 'otlp', endpoint: 'https://…' } } } — or deploy: { telemetry: { ${stage}: false } } to send nothing.`);
+		this.stage = stage;
+		this.target = target;
+		this.name = "TelemetryProviderRequired";
+	}
+};
+/** A stage asks for the self-hosted provider on a target that cannot run it. */
+var SelfHostedTelemetryUnavailable = class extends Error {
+	stage;
+	target;
+	constructor(stage, target) {
+		super(`deploy.telemetry.${stage} is 'self-hosted', and ${target} does not run OpenObserve beside the apps — the compose target does. Deploy '${stage}' through compose, or send its telemetry elsewhere: deploy: { telemetry: { ${stage}: { provider: 'otlp', endpoint: 'https://…' } } }.`);
+		this.stage = stage;
+		this.target = target;
+		this.name = "SelfHostedTelemetryUnavailable";
+	}
+};
+/** A sample rate that is not a fraction. */
+var TelemetrySampleRateInvalid = class extends Error {
+	stage;
+	sampleRate;
+	constructor(stage, sampleRate) {
+		super(`deploy.telemetry.${stage}.sampleRate is ${String(sampleRate)}; set it to a number from 0 to 1 — the fraction of traces kept — or leave it out to keep every one.`);
+		this.stage = stage;
+		this.sampleRate = sampleRate;
+		this.name = "TelemetrySampleRateInvalid";
+	}
+};
+/** An OTLP endpoint that is not an http(s) URL. */
+var TelemetryEndpointInvalid = class extends Error {
+	stage;
+	endpoint;
+	constructor(stage, endpoint) {
+		super(`deploy.telemetry.${stage}.endpoint is ${JSON.stringify(endpoint)}; set it to the collector's OTLP/HTTP base URL, like 'https://otlp.example.com' — /v1/traces and /v1/logs are added to it.`);
+		this.stage = stage;
+		this.endpoint = endpoint;
+		this.name = "TelemetryEndpointInvalid";
+	}
+};
+/** The sample rate a stage keeps, checked. */
+function sampleRateOf(stage, sampleRate) {
+	const rate = sampleRate ?? 1;
+	if (!Number.isFinite(rate) || rate < 0 || rate > 1) throw new TelemetrySampleRateInvalid(stage, sampleRate);
+	return rate;
+}
+/**
+* Each provider's resolver: a stage's config to what the targets consume.
+* A vendor preset is one more entry here.
+*/
+const PROVIDERS = {
+	"self-hosted": (config, stage) => {
+		const { provider: _, sampleRate, ...options } = config;
+		return {
+			provider: "self-hosted",
+			selfHosted: resolveSelfHosted(options, stage),
+			sampleRate: sampleRateOf(stage, sampleRate)
+		};
+	},
+	otlp: (config, stage) => {
+		if (typeof config.endpoint !== "string" || !isHttpUrl(config.endpoint)) throw new TelemetryEndpointInvalid(stage, config.endpoint);
+		return {
+			provider: "otlp",
+			endpoint: config.endpoint.replace(/\/+$/, ""),
+			headers: { ...config.headers },
+			sampleRate: sampleRateOf(stage, config.sampleRate)
+		};
+	}
+};
+function isHttpUrl(value) {
+	try {
+		const url = new URL(value);
+		return url.protocol === "http:" || url.protocol === "https:";
+	} catch {
+		return false;
+	}
+}
+/**
+* One stage's entry, checked on its own — what the workspace schema runs, so
+* a bad config fails to load with the words a deploy would fail with.
+*/
+function checkStageTelemetry(stage, config) {
+	if (config === false) return void 0;
+	const entry = config === "self-hosted" ? { provider: "self-hosted" } : config;
+	const resolve = PROVIDERS[entry.provider];
+	return resolve(entry, stage);
+}
+/**
+* Where a stage's telemetry goes, or undefined when nothing is sent — no
+* process uses a `Telemetry` node, or the stage opted out with `false`.
+*
+* The local stage always runs the self-hosted provider with its defaults and
+* keeps every trace, whatever `deploy.telemetry` says. A deployed stage that
+* names nothing gets the self-hosted provider where its target runs one, and
+* {@link TelemetryProviderRequired} where it cannot — AWS has none.
+*/
+function resolveStageTelemetry(input) {
+	const { stage } = input;
+	if (!input.used) return void 0;
+	if (input.local) return {
+		provider: "self-hosted",
+		selfHosted: resolveSelfHosted({}, stage),
+		sampleRate: 1
+	};
+	const config = input.telemetry?.[stage];
+	if (config === void 0) {
+		if (input.runtime === "server" && input.selfHosted) return checkStageTelemetry(stage, "self-hosted");
+		throw new TelemetryProviderRequired(stage, input.target);
+	}
+	const resolved = checkStageTelemetry(stage, config);
+	if (resolved?.provider === "self-hosted" && !input.selfHosted) throw new SelfHostedTelemetryUnavailable(stage, input.target);
+	return resolved;
+}
+/** The sampler every process with the edge runs, per the stage's rate. */
+const TRACES_SAMPLER = "parentbased_traceidratio";
+/**
+* `OTEL_EXPORTER_OTLP_HEADERS` for a set of headers: `key=value` pairs,
+* comma-separated, each value percent-encoded — the W3C baggage format the
+* SDK parses.
+*/
+function otlpHeaderString(headers) {
+	return Object.entries(headers).map(([key, value]) => `${key}=${encodeURIComponent(value)}`).join(",");
+}
+/**
+* The `OTEL_*` values a stage resolves for its `Telemetry` node, before any
+* one process is named: where to export, how to sign, and how much to keep.
+* `OTEL_SERVICE_NAME` is each process's own — see `scopeTelemetryEnv`.
+*/
+function telemetryEnv(destination, sampleRate) {
+	return {
+		OTEL_EXPORTER_OTLP_ENDPOINT: destination.endpoint,
+		...destination.headers ? { OTEL_EXPORTER_OTLP_HEADERS: destination.headers } : {},
+		OTEL_TRACES_SAMPLER: TRACES_SAMPLER,
+		OTEL_TRACES_SAMPLER_ARG: String(sampleRate)
+	};
+}
+/** What an `otlp` stage resolves, for every process with the edge. */
+function otlpTelemetryEnv(resolved) {
+	const headers = otlpHeaderString(resolved.headers);
+	return telemetryEnv({
+		endpoint: resolved.endpoint,
+		...headers ? { headers } : {}
+	}, resolved.sampleRate);
+}
+/**
+* The sample rate a stage's browsers trace page views at — a public value,
+* the same rate its servers sample at — or undefined when the stage sends no
+* telemetry. The local stage keeps every trace.
+*
+* Lenient where `resolveStageTelemetry` is strict: a site's client is built
+* before, and apart from, the deploy that refuses a stage with no provider.
+*/
+function stageSampleRate(telemetry, stage, local) {
+	if (local) return 1;
+	const config = telemetry?.[stage];
+	if (config === false) return void 0;
+	if (config === void 0 || config === "self-hosted") return 1;
+	return sampleRateOf(stage, config.sampleRate);
+}
+//#endregion
+//#region src/workspace/stages.ts
+/**
+* What `gkm test` runs as. The CLI's own, so no project stage may take it:
+* its containers are torn down and rebuilt between runs.
+*/
+const TEST_STAGE = "test";
+/** A stage becomes part of every physical name, so it has to fit in one. */
+const STAGE_NAME = /^[a-z][a-z0-9-]*$/;
+/** Everything wrong with one stage name, or nothing. */
+function nameProblems(name) {
+	const problems = [];
+	if (!STAGE_NAME.test(name)) problems.push(`stage "${name}" must be lowercase letters, digits and hyphens, starting with a letter`);
+	if (name === "test") problems.push(`stage "${TEST_STAGE}" is reserved for gkm test`);
+	return problems;
+}
+/** Everything wrong with a list of deployed stages on its own. */
+function deployedProblems(deployed) {
+	const problems = deployed.flatMap(nameProblems);
+	const seen = /* @__PURE__ */ new Set();
+	for (const name of deployed) {
+		if (seen.has(name)) problems.push(`stage "${name}" is listed twice`);
+		seen.add(name);
+	}
+	return problems;
+}
+/** Everything wrong with a stages block, or nothing. */
+function stageProblems(stages) {
+	if (!stages) return ["`stages` is required, e.g. stages: { local: 'dev', deployed: ['prod'] }"];
+	const { local, deployed, protected: kept = [] } = stages;
+	const problems = [...nameProblems(local), ...deployedProblems(deployed)];
+	if (deployed.includes(local)) problems.push(`"${local}" is both the local stage and a deployed one; they would share secrets`);
+	for (const name of kept) if (!deployed.includes(name)) problems.push(`protected stage "${name}" is not a deployed stage`);
+	return problems;
+}
+/** The stages block, or an error naming everything wrong with it. */
+function validateStages(stages) {
+	const problems = stageProblems(stages);
+	if (problems.length) throw new InvalidStages(problems);
+	return stages;
+}
+/** Refuses a stage the project does not deploy to. */
+function assertDeployedStage(stages, stage) {
+	if (!stages.deployed.includes(stage)) throw new UndeclaredStage(stage, stages.deployed);
+}
+/** A stages block — in gkm.config.ts or from `gkm init`'s flags — that breaks a rule. */
+var InvalidStages = class extends Error {
+	problems;
+	constructor(problems) {
+		super(`Invalid stages:\n  ${problems.join("\n  ")}`);
+		this.problems = problems;
+		this.name = "InvalidStages";
+	}
+};
+/**
+* A stage the project does not deploy to. Refused before anything is
+* provisioned, so a typo does not become a second environment.
+*/
+var UndeclaredStage = class extends Error {
+	stage;
+	deployed;
+	constructor(stage, deployed) {
+		super(`"${stage}" is not a deployed stage. gkm.config.ts deploys to: ${deployed.join(", ") || "nothing yet"}.`);
+		this.stage = stage;
+		this.deployed = deployed;
+		this.name = "UndeclaredStage";
+	}
+};
+/**
+* A per-stage setting keyed by a stage the workspace does not deploy: a typo,
+* a stage since removed, or the local stage, which none of them apply to.
+*/
+var UnknownStageKey = class extends Error {
+	setting;
+	stage;
+	deployed;
+	local;
+	constructor(setting, stage, deployed, local) {
+		super(`${setting} names the stage '${stage}', ` + (stage === local ? `the local stage — ${setting} is read for deployed stages only. ` : "which is not one of this workspace's deployed stages. ") + `It takes ${deployed.length > 0 ? deployed.map((s) => `'${s}'`).join(", ") : "no stage: stages.deployed is empty"} — the stages in stages.deployed.`);
+		this.setting = setting;
+		this.stage = stage;
+		this.deployed = deployed;
+		this.local = local;
+		this.name = "UnknownStageKey";
+	}
+};
+/**
+* The first key of a per-stage map that is not a deployed stage.
+*
+* @throws {UnknownStageKey}
+*/
+function assertDeployedStageKeys(setting, map, stages) {
+	if (!map || !stages?.deployed) return;
+	for (const key of Object.keys(map)) if (!stages.deployed.includes(key)) throw new UnknownStageKey(setting, key, stages.deployed, stages.local);
+}
+//#endregion
+//#region src/workspace/schema.ts
+/** Routes are a glob, or a list of them. */
+const RoutesSchema = union([string(), array(string())]);
+/**
+* Telescope configuration schema.
+*/
+const TelescopeConfigSchema = object({
+	enabled: boolean().optional(),
+	port: number().optional(),
+	path: string().optional(),
+	ignore: array(string()).optional(),
+	recordBody: boolean().optional(),
+	maxEntries: number().optional(),
+	websocket: boolean().optional()
+});
+/**
+* OpenAPI configuration schema.
+*/
+const OpenApiConfigSchema = object({
+	enabled: boolean().optional(),
+	title: string().optional(),
+	version: string().optional(),
+	description: string().optional()
+});
+/**
+* Hooks configuration schema.
+*/
+const HooksConfigSchema = object({ server: string().optional() });
+/**
+* Backend framework schema for non-gkm apps.
+*/
+const BackendFrameworkSchema = _enum([
+	"hono",
+	"better-auth",
+	"express",
+	"fastify"
+]);
+/**
+* Frontend framework schema.
+*/
+const FrontendFrameworkSchema = _enum([
+	"nextjs",
+	"remix",
+	"vite",
+	"tanstack-start"
+]);
+/**
+* Mobile framework schema.
+*/
+const MobileFrameworkSchema = _enum(["expo"]);
+/**
+* Combined framework schema (backend, frontend, or mobile).
+*/
+const FrameworkSchema = union([
+	BackendFrameworkSchema,
+	FrontendFrameworkSchema,
+	MobileFrameworkSchema
+]);
+/** Frontend framework values, kept in sync with FrontendFrameworkSchema. */
+const FRONTEND_FRAMEWORKS = [
+	"nextjs",
+	"remix",
+	"vite",
+	"tanstack-start"
+];
+/** Mobile framework values, kept in sync with MobileFrameworkSchema. */
+const MOBILE_FRAMEWORKS = ["expo"];
+/**
+* A deploy target's name. Which names exist is the workspace's to say — the
+* built-ins and its own `deploy.targets` — so it is checked against both
+* once the whole config is read.
+*/
+const DeployTargetSchema = string().min(1);
+/**
+* The built-in targets a config may name, both deployed by `gkm deploy`:
+* `dokploy`, and `sst`, which runs `sst deploy` on the manifest `gkm build`
+* writes.
+*/
+const SUPPORTED_DEPLOY_TARGETS = configurableBuiltins();
+/** Built-in names reserved for targets that do not exist yet. */
+const PHASE_2_DEPLOY_TARGETS = Object.entries(BUILTIN_TARGETS).filter(([, target]) => target.status === "planned").map(([name]) => name);
+/**
+* Whether a config may name `target`: a usable built-in, or one of its own
+* `deploy.targets`.
+*/
+function isDeployTargetSupported(target, targets = {}) {
+	return SUPPORTED_DEPLOY_TARGETS.includes(target) || Object.hasOwn(targets, target);
+}
+/**
+* Check if a deploy target is planned for Phase 2.
+*/
+function isPhase2DeployTarget(target) {
+	return PHASE_2_DEPLOY_TARGETS.includes(target);
+}
+/**
+* Get error message for unsupported deploy targets.
+*/
+function getDeployTargetError(target, appName) {
+	if (isPhase2DeployTarget(target)) return `Deploy target "${target}"${appName ? ` for app "${appName}"` : ""} is coming in Phase 2. Currently "dokploy" and "sst" are supported.`;
+	return `Unknown deploy target: ${target}. Built in: ${SUPPORTED_DEPLOY_TARGETS.join(", ")}; any other is named in deploy.targets with the package that provides it. Coming in Phase 2: ${PHASE_2_DEPLOY_TARGETS.join(", ")}.`;
+}
+/**
+* One `deploy.targets` entry: a package name, a target object, or either
+* with options.
+*/
+const DeployTargetEntrySchema = union([
+	string().min(1, "A target package name cannot be empty"),
+	custom((value) => isDeployTarget(value), { message: "Expected a package name, a target (defineTarget), or [package or target, options]" }),
+	tuple([union([string().min(1), custom((value) => isDeployTarget(value), { message: "Expected a package name or a target (defineTarget)" })]), unknown()])
+]);
+/**
+* Dokploy workspace configuration schema.
+* Supports either a single endpoint or per-stage endpoints.
+*/
+const DokployWorkspaceConfigSchema = object({
+	/** Single endpoint for all stages */
+	endpoint: url("Dokploy endpoint must be a valid URL").optional(),
+	/** Per-stage endpoints (stage name -> endpoint URL) */
+	endpoints: record(string(), url("Endpoint must be a valid URL")).optional(),
+	registryId: string().optional(),
+	verify: object({
+		deploymentTimeoutMs: number().int().positive().optional(),
+		healthCheckPath: string().startsWith("/", "healthCheckPath must start with /").optional(),
+		healthyAfter: number().int().positive().optional(),
+		intervalMs: number().int().positive().optional(),
+		healthTimeoutMs: number().int().positive().optional()
+	}).optional()
+}).refine((data) => data.endpoint || data.endpoints, { message: "Either endpoint or endpoints must be provided" });
+/**
+* Valid AWS regions.
+*/
+const AwsRegionSchema = _enum([
+	"us-east-1",
+	"us-east-2",
+	"us-west-1",
+	"us-west-2",
+	"af-south-1",
+	"ap-east-1",
+	"ap-south-1",
+	"ap-south-2",
+	"ap-southeast-1",
+	"ap-southeast-2",
+	"ap-southeast-3",
+	"ap-southeast-4",
+	"ap-northeast-1",
+	"ap-northeast-2",
+	"ap-northeast-3",
+	"ca-central-1",
+	"eu-central-1",
+	"eu-central-2",
+	"eu-west-1",
+	"eu-west-2",
+	"eu-west-3",
+	"eu-south-1",
+	"eu-south-2",
+	"eu-north-1",
+	"me-south-1",
+	"me-central-1",
+	"sa-east-1"
+]);
+/**
+* DNS record types supported across providers.
+*/
+const DnsRecordTypeSchema = _enum([
+	"A",
+	"AAAA",
+	"CNAME",
+	"MX",
+	"TXT",
+	"NS",
+	"SRV",
+	"CAA"
+]);
+object({
+	/** Subdomain name (e.g., 'api' for api.example.com, '@' for root) */
+	name: string(),
+	/** Record type */
+	type: DnsRecordTypeSchema,
+	/** TTL in seconds */
+	ttl: number().int().positive(),
+	/** Record values */
+	values: array(string())
+});
+/**
+* A DNS record to create or update.
+*/
+const UpsertDnsRecordSchema = object({
+	/** Subdomain name (e.g., 'api' for api.example.com, '@' for root) */
+	name: string(),
+	/** Record type */
+	type: DnsRecordTypeSchema,
+	/** TTL in seconds */
+	ttl: number().int().positive(),
+	/** Record value (IP address, hostname, etc.) */
+	value: string()
+});
+object({
+	/** The record that was upserted */
+	record: UpsertDnsRecordSchema,
+	/** Whether the record was created (true) or updated (false) */
+	created: boolean(),
+	/** Whether the record already existed with the same value */
+	unchanged: boolean()
+});
+/**
+* How a domain's hosts point at a compose stage's server: an A (and AAAA)
+* record each (`'a'`, the default), or one A record for `target` and a CNAME
+* to it for every other host but the apex. `target` is one name, or one per
+* stage; it must be under the domain.
+*/
+const DnsRecordsModeSchema = union([literal("a"), object({
+	mode: literal("cname"),
+	target: union([string(), record(string(), string())])
+}).strict()]);
+/**
+* Hostinger DNS provider config (without domain - domain is the record key).
+*/
+const HostingerDnsProviderSchema = object({
+	provider: literal("hostinger"),
+	/** How the hosts point at a compose stage's server — see {@link DnsRecordsModeSchema}. */
+	records: DnsRecordsModeSchema.optional(),
+	/** TTL in seconds (default: 300) */
+	ttl: number().int().positive().optional()
+});
+/**
+* Route53 DNS provider config (without domain - domain is the record key).
+*/
+const Route53DnsProviderSchema = object({
+	provider: literal("route53"),
+	/** How the hosts point at a compose stage's server — see {@link DnsRecordsModeSchema}. */
+	records: DnsRecordsModeSchema.optional(),
+	/** AWS region (optional - uses AWS_REGION env var if not provided) */
+	region: AwsRegionSchema.optional(),
+	/** AWS profile name (optional - uses default credential chain if not provided) */
+	profile: string().optional(),
+	/** Hosted zone ID (optional - auto-detected from domain if not provided) */
+	hostedZoneId: string().optional(),
+	/** TTL in seconds (default: 300) */
+	ttl: number().int().positive().optional()
+});
+/**
+* GoDaddy DNS provider config (without domain - domain is the record key).
+*
+* Credentials: `GODADDY_API_TOKEN` (a Personal Access Token scoped to
+* `domains.dns:update`), else `gkm login --provider godaddy`. GoDaddy refuses
+* a TTL under 600 seconds.
+*/
+const GoDaddyDnsProviderSchema = object({
+	provider: literal("godaddy"),
+	/** How the hosts point at a compose stage's server — see {@link DnsRecordsModeSchema}. */
+	records: DnsRecordsModeSchema.optional(),
+	/** TTL in seconds (default and minimum: 600) */
+	ttl: number().int().min(600, "GoDaddy's minimum TTL is 600 seconds").optional()
+});
+/**
+* Cloudflare DNS provider config (placeholder for future).
+*/
+const CloudflareDnsProviderSchema = object({
+	provider: literal("cloudflare"),
+	/** How the hosts point at a compose stage's server — see {@link DnsRecordsModeSchema}. */
+	records: DnsRecordsModeSchema.optional(),
+	/** TTL in seconds (default: 300) */
+	ttl: number().int().positive().optional()
+});
+/**
+* Manual DNS configuration (user handles DNS themselves).
+*/
+const ManualDnsProviderSchema = object({
+	provider: literal("manual"),
+	/** How the hosts point at a compose stage's server — see {@link DnsRecordsModeSchema}. */
+	records: DnsRecordsModeSchema.optional()
+});
+/**
+* Custom DNS provider config (user-provided implementation).
+*/
+const CustomDnsProviderSchema = object({
+	/** Custom DnsProvider implementation */
+	provider: custom((val) => typeof val === "object" && val !== null && typeof val.name === "string" && typeof val.getRecords === "function" && typeof val.upsertRecords === "function", { message: "Custom DNS provider must implement name, getRecords(), and upsertRecords() methods" }),
+	/** How the hosts point at a compose stage's server — see {@link DnsRecordsModeSchema}. */
+	records: DnsRecordsModeSchema.optional(),
+	/** TTL in seconds (default: 300) */
+	ttl: number().int().positive().optional()
+});
+/**
+* Built-in DNS provider config (discriminated union).
+*/
+const BuiltInDnsProviderSchema = discriminatedUnion("provider", [
+	HostingerDnsProviderSchema,
+	Route53DnsProviderSchema,
+	GoDaddyDnsProviderSchema,
+	CloudflareDnsProviderSchema,
+	ManualDnsProviderSchema
+]);
+/**
+* Single DNS provider config (for one domain).
+*/
+const DnsProviderSchema = union([BuiltInDnsProviderSchema, CustomDnsProviderSchema]);
+/**
+* DNS configuration schema.
+*
+* Maps root domains to their DNS provider configuration.
+* Example:
+* ```
+* dns: {
+*   'geekmidas.dev': { provider: 'hostinger' },
+*   'geekmidas.com': { provider: 'route53' },
+* }
+* ```
+*
+* Supported providers:
+* - 'hostinger': Use Hostinger DNS API
+* - 'route53': Use AWS Route53
+* - 'godaddy': Use GoDaddy's v1 DNS API
+* - 'cloudflare': Use Cloudflare DNS API (future)
+* - 'manual': Don't create records, just print required records
+* - Custom: Provide a DnsProvider implementation
+*/
+const DnsConfigSchema = record(string(), DnsProviderSchema);
+const HostingerDnsConfigSchema = HostingerDnsProviderSchema.extend({ domain: string().min(1, "Domain is required") });
+const Route53DnsConfigSchema = Route53DnsProviderSchema.extend({ domain: string().min(1, "Domain is required") });
+const GoDaddyDnsConfigSchema = GoDaddyDnsProviderSchema.extend({ domain: string().min(1, "Domain is required") });
+const CloudflareDnsConfigSchema = CloudflareDnsProviderSchema.extend({ domain: string().min(1, "Domain is required") });
+const ManualDnsConfigSchema = ManualDnsProviderSchema.extend({ domain: string().min(1, "Domain is required") });
+const CustomDnsConfigSchema = CustomDnsProviderSchema.extend({ domain: string().min(1, "Domain is required") });
+const BuiltInDnsConfigSchema = discriminatedUnion("provider", [
+	HostingerDnsConfigSchema,
+	Route53DnsConfigSchema,
+	GoDaddyDnsConfigSchema,
+	CloudflareDnsConfigSchema,
+	ManualDnsConfigSchema
+]);
+const LegacyDnsConfigSchema = union([BuiltInDnsConfigSchema, CustomDnsConfigSchema]);
+union([DnsConfigSchema, LegacyDnsConfigSchema]);
+/**
+* Backups configuration schema.
+*
+* Configures automatic backup destinations for database services.
+* On first deploy, creates S3 bucket with unique name and IAM credentials.
+*/
+const BackupsConfigSchema = object({
+	/** Backup storage type (currently only 's3' supported) */
+	type: literal("s3"),
+	/** AWS profile name for creating bucket/IAM resources */
+	profile: string().optional(),
+	/** AWS region for the backup bucket */
+	region: AwsRegionSchema,
+	/** Cron schedule for backups (default: '0 2 * * *' = 2 AM daily) */
+	schedule: string().optional(),
+	/** Number of backups to retain (default: 30) */
+	retention: number().optional()
+});
+/** `deploy.compose` — what the compose target runs beside the apps. */
+const ComposeWorkspaceConfigSchema = object({
+	proxy: union([_enum(["caddy", "traefik"]), record(string(), _enum(["caddy", "traefik"]))]).optional(),
+	tls: record(string(), object({
+		certFile: string().min(1),
+		keyFile: string().min(1)
+	}).strict()).optional()
+}).strict();
+const TelemetrySampleRate = number().optional();
+/**
+* `deploy.telemetry` — where each stage's telemetry goes. The rules past the
+* shape are `checkStageTelemetry`'s, so the schema and a deploy refuse the
+* same configs with the same words.
+*/
+const TelemetryConfigSchema = record(string(), union([
+	literal(false),
+	literal("self-hosted"),
+	object({
+		provider: literal("self-hosted"),
+		port: number().optional(),
+		retentionDays: number().optional(),
+		public: object({ allow: array(string()) }).optional(),
+		sampleRate: TelemetrySampleRate
+	}).strict(),
+	object({
+		provider: literal("otlp"),
+		endpoint: string(),
+		headers: record(string(), string()).optional(),
+		sampleRate: TelemetrySampleRate
+	}).strict()
+])).superRefine((telemetry, ctx) => {
+	for (const [stage, config] of Object.entries(telemetry)) try {
+		checkStageTelemetry(stage, config);
+	} catch (error) {
+		ctx.addIssue({
+			code: "custom",
+			message: error instanceof Error ? error.message : String(error),
+			path: [stage]
+		});
+	}
+});
+/**
+* `deploy.objects` — what backs each deployed stage's buckets. The rules are
+* `checkStageProvider`'s, so the schema and a provision run refuse the same
+* entries with the same words.
+*/
+const ObjectsConfigSchema = record(string(), unknown()).superRefine((entries, ctx) => {
+	for (const [stage, value] of Object.entries(entries)) try {
+		checkStageProvider("objects", stage, value);
+	} catch (error) {
+		ctx.addIssue({
+			code: "custom",
+			message: error instanceof Error ? error.message : String(error),
+			path: [stage]
+		});
+	}
+});
+/**
+* Deploy configuration schema.
+*/
+const DeployConfigSchema = object({
+	default: DeployTargetSchema.optional(),
+	targets: record(string(), DeployTargetEntrySchema).superRefine((targets, ctx) => {
+		for (const name of Object.keys(targets)) if (builtinTarget(name)) ctx.addIssue({
+			code: "custom",
+			message: `"${name}" is a built-in target; give this one a name of its own`,
+			path: [name]
+		});
+	}).optional(),
+	/** Whose deploy this is, on a target shared with other workspaces. */
+	namespace: string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "deploy.namespace must be lowercase letters and digits with single '-' between them").optional(),
+	/** Where every target pushes and pulls the apps' images. */
+	registry: string().min(1).optional(),
+	dokploy: DokployWorkspaceConfigSchema.optional(),
+	compose: ComposeWorkspaceConfigSchema.optional(),
+	telemetry: TelemetryConfigSchema.optional(),
+	objects: ObjectsConfigSchema.optional(),
+	backups: BackupsConfigSchema.optional()
+});
+/**
+* Models configuration schema.
+*/
+const ModelsConfigSchema = object({
+	path: string().optional(),
+	schema: _enum(["zod"]).optional()
+});
+/**
+* Shared configuration schema.
+*/
+const SharedConfigSchema = object({
+	packages: array(string()).optional(),
+	models: ModelsConfigSchema.optional()
+});
+/**
+* Secrets configuration schema.
+*/
+const StagesConfigSchema = object({
+	local: string(),
+	deployed: array(string()),
+	protected: array(string()).optional()
+}).superRefine((stages, ctx) => {
+	for (const message of stageProblems(stages)) ctx.addIssue({
+		code: "custom",
+		message
+	});
+});
+const SecretsStoreSchema = union([
+	literal("file"),
+	object({
+		provider: literal("ssm"),
+		region: AwsRegionSchema
+	}).strict(),
+	object({
+		provider: literal("secrets-manager"),
+		region: AwsRegionSchema,
+		kmsKeyId: string().min(1).optional()
+	}).strict(),
+	object({ 
+	/** Any backend: an object implementing SecretsStore */
+provider: custom((val) => typeof val === "object" && val !== null && typeof val.name === "string" && typeof val.read === "function" && typeof val.write === "function", { message: "a secrets store has a name, read() and write()" }) })
+]);
+const SecretsConfigSchema = object({
+	enabled: boolean().optional(),
+	store: SecretsStoreSchema.optional(),
+	algorithm: string().optional(),
+	kdf: _enum(["scrypt", "pbkdf2"]).optional()
+});
+/**
+* Local state provider config.
+*/
+const LocalStateConfigSchema = object({ provider: literal("local") });
+/**
+* SSM state provider config (requires region).
+*/
+const SSMStateConfigSchema = object({
+	provider: literal("ssm"),
+	/** AWS region (required for SSM provider) */
+	region: AwsRegionSchema,
+	/** AWS profile name (optional - uses default credential chain if not provided) */
+	profile: string().optional()
+});
+/**
+* S3 state provider config: conditional writes and a lock object in a bucket.
+*/
+const S3StateConfigSchema = object({
+	provider: literal("s3"),
+	/** Bucket the state lives in (must already exist) */
+	bucket: string().min(1),
+	/** AWS region of the bucket */
+	region: AwsRegionSchema,
+	/** Key prefix inside the bucket (default: 'gkm') */
+	prefix: string().optional(),
+	/** AWS profile name (optional - uses default credential chain if not provided) */
+	profile: string().optional()
+});
+/**
+* Custom state provider config (user-provided implementation).
+*/
+const CustomStateConfigSchema = object({ 
+/** Custom StateProvider implementation */
+provider: custom((val) => typeof val === "object" && val !== null && typeof val.read === "function" && typeof val.write === "function", { message: "Custom provider must implement read() and write() methods" }) });
+/**
+* Built-in state provider config (discriminated union).
+*/
+const BuiltInStateConfigSchema = discriminatedUnion("provider", [
+	LocalStateConfigSchema,
+	SSMStateConfigSchema,
+	S3StateConfigSchema
+]);
+/**
+* State configuration schema.
+*
+* Configures how deployment state is stored.
+* - 'local': Store in .gkm/deploy-{stage}.json (default)
+* - 'ssm': Store in AWS SSM Parameter Store (requires region)
+* - 's3': Store in an S3 bucket with conditional writes (requires bucket, region)
+* - Custom: Provide a StateStore, or a StateProvider with read/write methods
+*/
+const StateConfigSchema = union([BuiltInStateConfigSchema, CustomStateConfigSchema]);
+/**
+* App configuration schema.
+*/
+const AppConfigSchema = object({
+	type: _enum([
+		"backend",
+		"web",
+		"mobile"
+	]).optional().default("backend"),
+	path: string().min(1, "App path is required"),
+	port: number().int().positive("Port must be a positive integer"),
+	dependencies: array(string()).optional(),
+	deploy: DeployTargetSchema.optional(),
+	constructs: RoutesSchema.optional(),
+	routes: RoutesSchema.optional(),
+	functions: RoutesSchema.optional(),
+	crons: RoutesSchema.optional(),
+	queues: RoutesSchema.optional(),
+	topics: RoutesSchema.optional(),
+	subscribers: RoutesSchema.optional(),
+	envParser: string().optional(),
+	logger: string().optional(),
+	hooks: HooksConfigSchema.optional(),
+	telescope: union([
+		string(),
+		boolean(),
+		TelescopeConfigSchema
+	]).optional(),
+	openapi: union([boolean(), OpenApiConfigSchema]).optional(),
+	runtime: _enum(["node", "bun"]).optional(),
+	env: union([string(), array(string())]).optional(),
+	entry: string().optional(),
+	framework: FrameworkSchema.optional(),
+	config: object({
+		client: string().optional(),
+		server: string().optional()
+	}).optional()
+}).refine((data) => {
+	if (data.type === "web") {
+		if (!data.framework || !FRONTEND_FRAMEWORKS.includes(data.framework)) return false;
+	}
+	return true;
+}, {
+	message: `Web apps must have a valid web framework (${FRONTEND_FRAMEWORKS.join(", ")})`,
+	path: ["framework"]
+}).refine((data) => {
+	if (data.type === "mobile") {
+		if (!data.framework || !MOBILE_FRAMEWORKS.includes(data.framework)) return false;
+	}
+	return true;
+}, {
+	message: `Mobile apps must have a valid mobile framework (${MOBILE_FRAMEWORKS.join(", ")})`,
+	path: ["framework"]
+});
+/** What `gkm test` hands a feature test. */
+const TestConfigSchema = object({ 
+/** The folder of per-database factories; `test/factories` by default. */
+factories: string().optional() }).strict();
+/** How `gkm dev` is reached from outside the apps it runs. */
+const DevConfigSchema = object({
+	/** Browser origins that may read the discovery endpoint. */
+	allowedOrigins: array(url().refine((value) => URL.canParse(value) && new URL(value).origin === value, { message: "An origin is a scheme, host and port only, e.g. https://console.example.com — no path or trailing slash" })).optional(),
+	/** The discovery endpoint's loopback port; 4983 by default. */
+	discoveryPort: number().int().min(0).max(65535).optional()
+}).strict();
+/**
+* Workspace configuration schema.
+*/
+const WorkspaceConfigSchema = object({
+	name: string().optional(),
+	/**
+	* Where the workspace's own constructs live, relative to its root.
+	*
+	* Infrastructure is a fact about the product, not about the process that
+	* happens to import it — so a database two apps share is declared once,
+	* at the top, and both find it. An app-level glob still works and is
+	* additive, for something only one app uses.
+	*/
+	constructs: RoutesSchema.optional(),
+	/**
+	* Apps that nothing declares.
+	*
+	* Optional, and normally absent: a `site` is an app and so is a
+	* `rest-api` that named one, so the list is read off the graph. This is
+	* the escape hatch for what no construct describes — a mobile app, a
+	* process someone runs by hand — and for overriding one field of a
+	* derived app without restating it.
+	*/
+	apps: record(string(), AppConfigSchema).optional(),
+	shared: SharedConfigSchema.optional(),
+	/** Each deployed stage's base domain (stage name -> domain). */
+	domains: record(string(), string()).optional(),
+	/** Each root domain's DNS provider, and how its hosts are pointed. */
+	dns: DnsConfigSchema.optional(),
+	deploy: DeployConfigSchema.optional(),
+	stages: StagesConfigSchema,
+	secrets: SecretsConfigSchema.optional(),
+	state: StateConfigSchema.optional(),
+	test: TestConfigSchema.optional(),
+	dev: DevConfigSchema.optional()
+}).strict().refine((data) => {
+	const appNames = Object.keys(data.apps ?? {});
+	for (const [appName, app] of Object.entries(data.apps ?? {})) for (const dep of app.dependencies ?? []) {
+		if (!appNames.includes(dep)) return false;
+		if (dep === appName) return false;
+	}
+	return true;
+}, { message: "App dependencies must reference existing apps and cannot be self-referential" }).refine((data) => {
+	const appNames = Object.keys(data.apps ?? {});
+	const visited = /* @__PURE__ */ new Set();
+	const recStack = /* @__PURE__ */ new Set();
+	function hasCycle(app) {
+		if (recStack.has(app)) return true;
+		if (visited.has(app)) return false;
+		visited.add(app);
+		recStack.add(app);
+		const deps = data.apps?.[app]?.dependencies ?? [];
+		for (const dep of deps) if (hasCycle(dep)) return true;
+		recStack.delete(app);
+		return false;
+	}
+	for (const app of appNames) {
+		visited.clear();
+		recStack.clear();
+		if (hasCycle(app)) return false;
+	}
+	return true;
+}, { message: "Circular dependencies detected between apps" }).superRefine((data, ctx) => {
+	const defaultTarget = data.deploy?.default;
+	const ownTargets = data.deploy?.targets ?? {};
+	if (defaultTarget && !isDeployTargetSupported(defaultTarget, ownTargets)) {
+		ctx.addIssue({
+			code: "custom",
+			message: getDeployTargetError(defaultTarget),
+			path: ["deploy", "default"]
+		});
+		return;
+	}
+	for (const [appName, app] of Object.entries(data.apps ?? {})) if (app.deploy && !isDeployTargetSupported(app.deploy, ownTargets)) {
+		ctx.addIssue({
+			code: "custom",
+			message: getDeployTargetError(app.deploy, appName),
+			path: [
+				"apps",
+				appName,
+				"deploy"
+			]
+		});
+		return;
+	}
+	try {
+		checkComposeStages(data.deploy?.compose, data.stages);
+	} catch (error) {
+		ctx.addIssue({
+			code: "custom",
+			message: error instanceof Error ? error.message : String(error),
+			path: ["deploy", "compose"]
+		});
+	}
+	const perStage = [
+		[
+			"domains",
+			["domains"],
+			data.domains
+		],
+		[
+			"deploy.objects",
+			["deploy", "objects"],
+			data.deploy?.objects
+		],
+		[
+			"deploy.telemetry",
+			["deploy", "telemetry"],
+			data.deploy?.telemetry
+		],
+		...Object.entries(data.dns ?? {}).map(([domain, entry]) => {
+			const records = entry.records;
+			const target = records && typeof records === "object" ? records.target : void 0;
+			return [
+				`dns['${domain}'].records.target`,
+				[
+					"dns",
+					domain,
+					"records",
+					"target"
+				],
+				target && typeof target === "object" ? target : void 0
+			];
+		})
+	];
+	for (const [setting, path, map] of perStage) try {
+		assertDeployedStageKeys(setting, map, data.stages);
+	} catch (error) {
+		ctx.addIssue({
+			code: "custom",
+			message: error instanceof Error ? error.message : String(error),
+			path
+		});
+	}
+	for (const [domain, entry] of Object.entries(data.dns ?? {})) try {
+		checkDnsRecordsMode(domain, entry.records);
+	} catch (error) {
+		ctx.addIssue({
+			code: "custom",
+			message: error instanceof Error ? error.message : String(error),
+			path: [
+				"dns",
+				domain,
+				"records"
+			]
+		});
+	}
+	if (data.state?.provider === "ssm" && !data.name) ctx.addIssue({
+		code: "custom",
+		message: "Workspace name is required when using SSM state provider. Add \"name\" to your gkm.config.ts.",
+		path: ["name"]
+	});
+});
+/**
+* Validate workspace configuration.
+* Throws ZodError with detailed messages on validation failure.
+*/
+function validateWorkspaceConfig(config) {
+	return WorkspaceConfigSchema.parse(config);
+}
+/**
+* Safe validation that returns result instead of throwing.
+*/
+function safeValidateWorkspaceConfig(config) {
+	const result = WorkspaceConfigSchema.safeParse(config);
+	if (result.success) return {
+		success: true,
+		data: result.data
+	};
+	return {
+		success: false,
+		error: result.error
+	};
+}
+/**
+* Format Zod errors into user-friendly messages.
+*/
+function formatValidationErrors(error) {
+	return `Workspace configuration validation failed:\n${error.issues.map((issue) => {
+		const path = issue.path.join(".");
+		return path ? `  - ${path}: ${issue.message}` : `  - ${issue.message}`;
+	}).join("\n")}`;
+}
+//#endregion
+//#region src/workspace/types.ts
+/**
+* Type guard to check if a config is a WorkspaceConfig.
+*
+* @example
+* ```ts
+* const config = await loadConfig();
+* if (isWorkspaceConfig(config)) {
+*   // config.apps is available
+*   console.log(Object.keys(config.apps));
+* }
+* ```
+*/
+function isWorkspaceConfig(config) {
+	if (typeof config !== "object" || config === null) return false;
+	if ("apps" in config && typeof config.apps === "object") return true;
+	return "constructs" in config && Object.keys(config).every((key) => WORKSPACE_KEYS.has(key));
+}
+/** Every top-level key a workspace config has — see `WorkspaceConfigSchema`. */
+const WORKSPACE_KEYS = /* @__PURE__ */ new Set([
+	"name",
+	"constructs",
+	"apps",
+	"shared",
+	"domains",
+	"dns",
+	"deploy",
+	"stages",
+	"secrets",
+	"state"
+]);
+//#endregion
+//#region src/workspace/publicEnv.ts
+/**
+* All public env-var prefixes the toolbox understands.
+*
+* Used when resolving incoming var names back to a dependency
+* (e.g. `VITE_AUTH_URL` → `auth`). A var matching any of these
+* is considered safe to inline into a client bundle.
+*/
+const PUBLIC_ENV_PREFIXES = [
+	"NEXT_PUBLIC_",
+	"VITE_",
+	"EXPO_PUBLIC_"
+];
+/**
+* Resolve the public env-var prefix that a frontend framework's bundler
+* inlines into client code at build time:
+*
+*  - `nextjs`         → `NEXT_PUBLIC_`
+*  - `vite`           → `VITE_`
+*  - `tanstack-start` → `VITE_` (uses Vite under the hood)
+*  - `expo`           → `EXPO_PUBLIC_`
+*  - `remix`          → `''` (Remix exposes via loaders, no prefix convention)
+*
+* For backend frameworks or unspecified, falls back to `NEXT_PUBLIC_` to
+* preserve the historical default. Backend apps never read these vars
+* from a bundle, so the prefix only affects scaffolding/symmetry.
+*/
+function getPublicEnvPrefix(framework) {
+	switch (framework) {
+		case "vite":
+		case "tanstack-start": return "VITE_";
+		case "expo": return "EXPO_PUBLIC_";
+		case "remix": return "";
+		case "nextjs": return "NEXT_PUBLIC_";
+		default: return "NEXT_PUBLIC_";
+	}
+}
+/**
+* Strip a known public prefix from a var name.
+* Returns the un-prefixed name, or `null` if no prefix matched.
+*/
+function stripPublicPrefix(name) {
+	for (const prefix of PUBLIC_ENV_PREFIXES) if (prefix && name.startsWith(prefix)) return name.slice(prefix.length);
+	return null;
+}
+//#endregion
+//#region src/workspace/index.ts
+/**
+* Validate that all dependencies reference existing apps.
+* Returns the config if valid, throws otherwise.
+*/
+function validateDependencies(apps) {
+	const appNames = new Set(Object.keys(apps));
+	for (const [appName, app] of Object.entries(apps)) for (const dep of app.dependencies ?? []) {
+		if (!appNames.has(dep)) throw new Error(`Invalid dependency: App "${appName}" depends on "${dep}" which does not exist. Valid apps are: ${[...appNames].join(", ")}`);
+		if (dep === appName) throw new Error(`Invalid dependency: App "${appName}" cannot depend on itself.`);
+	}
+}
+/**
+* Define workspace configuration with full TypeScript support and type inference.
+*
+* Uses `const` type parameter to infer literal app names, providing:
+* - Autocomplete for app names in dependencies
+* - Type errors for invalid dependency references
+* - Full type inference for the returned config
+*
+* @example
+* ```ts
+* // gkm.config.ts
+* import { defineWorkspace } from '@geekmidas/cli';
+*
+* export default defineWorkspace({
+*   name: 'my-saas',
+*   apps: {
+*     api: {
+*       type: 'backend',
+*       path: 'apps/api',
+*       port: 3000,
+*       routes: './src/endpoints/**\/*.ts',
+*       envParser: './src/config/env',
+*       logger: './src/logger',
+*     },
+*     web: {
+*       type: 'web',
+*       framework: 'nextjs',
+*       path: 'apps/web',
+*       port: 3001,
+*       dependencies: ['api'], // <- autocomplete shows 'api' | 'web'
+*     },
+*   },
+* });
+*
+* // config.apps.api <- full type inference
+* // config.apps.foo <- TypeScript error
+* ```
+*/
+function defineWorkspace(config) {
+	assertNoMovedDeployKeys(config.deploy);
+	assertKnownSecretsStore(config.secrets?.store);
+	if (config.apps) validateDependencies(config.apps);
+	const result = safeValidateWorkspaceConfig(config);
+	if (!result.success && result.error) throw new Error(formatValidationErrors(result.error));
+	return config;
+}
+/**
+* Get the package name from package.json in the given directory.
+*/
+function getPackageName(cwd) {
+	try {
+		return __require(`${cwd}/package.json`).name?.replace(/^@[^/]+\//, "");
+	} catch {
+		return;
+	}
+}
+/**
+* Normalize a workspace configuration with resolved defaults.
+*/
+function normalizeWorkspace(config, cwd) {
+	const name = config.name ?? getPackageName(cwd) ?? basename(cwd);
+	const defaultTarget = config.deploy?.default ?? "dokploy";
+	const normalizedApps = {};
+	for (const [appName, app] of Object.entries(config.apps ?? {})) normalizedApps[appName] = normalizeAppConfig(app, defaultTarget);
+	return {
+		name,
+		root: cwd,
+		...config.constructs ? { constructs: config.constructs } : {},
+		apps: normalizedApps,
+		...config.domains ? { domains: config.domains } : {},
+		...config.dns ? { dns: config.dns } : {},
+		deploy: config.deploy ?? { default: "dokploy" },
+		shared: config.shared ?? { packages: ["packages/*"] },
+		stages: validateStages(config.stages),
+		secrets: config.secrets ?? {},
+		state: config.state,
+		test: config.test ?? {},
+		...config.dev ? { dev: config.dev } : {}
+	};
+}
+/**
+* Normalize an app configuration with resolved defaults.
+* @param app - App configuration
+* @param defaultTarget - Default deploy target from workspace config
+*/
+function normalizeAppConfig(app, defaultTarget) {
+	return {
+		...app,
+		type: app.type ?? "backend",
+		port: app.port,
+		path: app.path,
+		dependencies: app.dependencies ?? [],
+		resolvedDeployTarget: app.deploy ?? defaultTarget
+	};
+}
+/**
+* Wrap a single-app GkmConfig as a workspace.
+* This allows existing single-app configs to work seamlessly.
+*/
+function wrapSingleAppAsWorkspace(config, cwd) {
+	return {
+		name: config.name ?? getPackageName(cwd) ?? basename(cwd),
+		root: cwd,
+		apps: { api: {
+			type: "backend",
+			path: ".",
+			port: 3e3,
+			dependencies: [],
+			resolvedDeployTarget: config.deploy?.default ?? "dokploy",
+			constructs: config.constructs,
+			hooks: config.hooks,
+			telescope: config.telescope,
+			openapi: config.openapi,
+			runtime: config.runtime,
+			env: config.env
+		} },
+		...config.domains ? { domains: config.domains } : {},
+		...config.dns ? { dns: config.dns } : {},
+		deploy: {
+			default: "dokploy",
+			...config.deploy
+		},
+		shared: { packages: [] },
+		stages: validateStages(config.stages),
+		secrets: config.secrets ?? {},
+		test: config.test ?? {},
+		...config.dev ? { dev: config.dev } : {}
+	};
+}
+/**
+* Process a loaded configuration (either single-app or workspace).
+* Returns a normalized workspace in both cases.
+*/
+/**
+* `deploy.dokploy.registry`, which became `deploy.registry`: every target
+* pushes and pulls through the one registry, so it is not Dokploy's to hold.
+*
+* Refused by name rather than dropped: the schema strips keys it does not
+* know, and a registry silently gone would deploy images under no registry.
+*/
+var DokployRegistryMoved = class extends Error {
+	registry;
+	constructor(registry) {
+		super(`deploy.dokploy.registry is now deploy.registry, read by every deploy target. In gkm.config.ts, move it up one level: deploy: { registry: ${JSON.stringify(registry)}, dokploy: { … } }.`);
+		this.registry = registry;
+		this.name = "DokployRegistryMoved";
+	}
+};
+/**
+* `deploy.domains`, which became `domains` at the root of the config: a stage's
+* domain is a fact about the product every target and every command reads,
+* not a deploy setting.
+*/
+var DomainsMoved = class extends Error {
+	domains;
+	constructor(domains) {
+		super(`deploy.domains is now domains, at the root of gkm.config.ts. Move it out of deploy: defineWorkspace({ …, domains: ${JSON.stringify(domains)}, deploy: { … } }).`);
+		this.domains = domains;
+		this.name = "DomainsMoved";
+	}
+};
+/**
+* `deploy.dns`, which became `dns` at the root of the config, keyed by root
+* domain.
+*/
+var DnsMoved = class extends Error {
+	dns;
+	constructor(dns) {
+		const legacy = dns && typeof dns === "object" && "domain" in dns && "provider" in dns;
+		const { domain, ...rest } = legacy ? dns : {};
+		super(`deploy.dns is now dns, at the root of gkm.config.ts, keyed by root domain. Move it out of deploy: defineWorkspace({ …, dns: ${JSON.stringify(legacy ? { [String(domain)]: rest } : dns)}, deploy: { … } }).`);
+		this.dns = dns;
+		this.name = "DnsMoved";
+	}
+};
+/** Refuse a deploy key that has moved, naming where it lives now. */
+function assertNoMovedDeployKeys(deploy) {
+	const dokploy = deploy?.dokploy;
+	if (dokploy && typeof dokploy === "object" && "registry" in dokploy) throw new DokployRegistryMoved(dokploy.registry);
+	if (deploy && typeof deploy === "object") {
+		if ("domains" in deploy) throw new DomainsMoved(deploy.domains);
+		if ("dns" in deploy) throw new DnsMoved(deploy.dns);
+	}
+}
+function processConfig(config, cwd) {
+	assertNoMovedDeployKeys(config.deploy);
+	if (isWorkspaceConfig(config)) {
+		assertKnownSecretsStore(config.secrets?.store);
+		if (config.stages === void 0) throw new InvalidStages(stageProblems(void 0));
+		const result = safeValidateWorkspaceConfig(config);
+		if (!result.success && result.error) throw new InvalidWorkspaceConfig(formatValidationErrors(result.error));
+		return {
+			type: "workspace",
+			raw: config,
+			workspace: normalizeWorkspace(config, cwd)
+		};
+	}
+	return {
+		type: "single",
+		raw: config,
+		workspace: wrapSingleAppAsWorkspace(config, cwd)
+	};
+}
+/** A workspace config the schema refuses; the message lists every issue. */
+var InvalidWorkspaceConfig = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "InvalidWorkspaceConfig";
+	}
+};
+/**
+* The workspace's own constructs globs, absolute.
+*
+* Infrastructure two apps share is a fact about the product, and declaring it
+* inside one of them makes moving that app a change to the other's database.
+*/
+function workspaceConstructGlobs(workspace) {
+	return constructPatterns(workspace.constructs).map((pattern) => isAbsolute(pattern) ? pattern : join(workspace.root, pattern));
+}
+/**
+* Every constructs glob an app can see, absolute.
+*
+* The workspace's own first, then the app's. Absolute because the app builds
+* from its own directory while the workspace's constructs live above it —
+* a relative glob resolved from the app would look for the product's
+* infrastructure inside one of its consumers and find nothing.
+*
+* Additive, not overriding: an app that declares its own constructs still sees
+* the ones the workspace declared for everybody.
+*/
+function appConstructGlobs(workspace, appName) {
+	const globs = workspaceConstructGlobs(workspace);
+	const app = workspace.apps[appName];
+	if (app) {
+		const root = isAbsolute(app.path) ? app.path : join(workspace.root, app.path);
+		for (const pattern of constructPatterns(app.constructs)) globs.push(isAbsolute(pattern) ? pattern : join(root, pattern));
+	}
+	return globs;
+}
+/**
+* Every constructs glob in the workspace: its own, plus each app's.
+*
+* One list, so what a deploy provisions and what an app's entry point
+* registers drivers for are read off the same globs.
+*/
+function allConstructGlobs(workspace) {
+	const globs = [...workspaceConstructGlobs(workspace), ...Object.keys(workspace.apps).flatMap((appName) => appConstructGlobs(workspace, appName))];
+	return [...new Set(globs)];
+}
+/** A `Routes` in any of its accepted shapes, as a flat list of patterns. */
+function constructPatterns(routes) {
+	if (!routes) return [];
+	return typeof routes === "string" ? [routes] : routes;
+}
+/**
+* Get the GkmConfig for a specific app in a workspace.
+* Useful for running existing single-app commands on a specific app.
+*/
+function getAppGkmConfig(workspace, appName) {
+	const app = workspace.apps[appName];
+	if (!app || app.type !== "backend") return;
+	return {
+		...workspace.deploy ? { deploy: workspace.deploy } : {},
+		stages: workspace.stages,
+		constructs: appConstructGlobs(workspace, appName),
+		hooks: app.hooks,
+		telescope: app.telescope,
+		openapi: app.openapi,
+		runtime: app.runtime,
+		env: app.env
+	};
+}
+/**
+* Get topologically sorted app names based on dependencies.
+* Apps with no dependencies come first, then apps that depend on them.
+*/
+function getAppBuildOrder(workspace) {
+	const appNames = Object.keys(workspace.apps);
+	const visited = /* @__PURE__ */ new Set();
+	const result = [];
+	function visit(name) {
+		if (visited.has(name)) return;
+		visited.add(name);
+		const app = workspace.apps[name];
+		if (app) for (const dep of app.dependencies) visit(dep);
+		result.push(name);
+	}
+	for (const name of appNames) visit(name);
+	return result;
+}
+/**
+* Resolve the Dokploy endpoint for a specific stage.
+*
+* Uses per-stage endpoint from `endpoints` if available,
+* otherwise falls back to the global `endpoint`.
+*
+* @param dokployConfig - Dokploy workspace configuration
+* @param stage - Deployment stage (e.g., 'development', 'production')
+* @returns The endpoint URL for the stage, or undefined if not configured
+*
+* @example
+* ```ts
+* // With per-stage endpoints
+* const config = {
+*   endpoints: {
+*     development: 'https://dev.dokploy.example.com:3000',
+*     production: 'https://prod.dokploy.example.com:3000',
+*   },
+* };
+* getEndpointForStage(config, 'production'); // => 'https://prod.dokploy.example.com:3000'
+*
+* // With single endpoint
+* const config = { endpoint: 'https://dokploy.example.com:3000' };
+* getEndpointForStage(config, 'production'); // => 'https://dokploy.example.com:3000'
+* ```
+*/
+function getEndpointForStage(dokployConfig, stage) {
+	if (!dokployConfig) return void 0;
+	if (dokployConfig.endpoints?.[stage]) return dokployConfig.endpoints[stage];
+	return dokployConfig.endpoint;
+}
+//#endregion
+export { RotationInProgress as $, InvalidStages as A, LOGS_PORT as B, WorkspaceConfigSchema as C, isPhase2DeployTarget as D, isDeployTargetSupported as E, stageProblems as F, checkS3Config as G, provisioningOf as H, otlpTelemetryEnv as I, BucketNameUnavailable as J, AccessKeyLimit as K, resolveStageTelemetry as L, UndeclaredStage as M, assertDeployedStage as N, safeValidateWorkspaceConfig as O, deployedProblems as P, RecordedBucketUnreachable as Q, stageSampleRate as R, SUPPORTED_DEPLOY_TARGETS as S, getDeployTargetError as T, stageProvider as U, UnknownStageProvider as V, S3_PROVISIONING as W, IamUserNotOwned as X, BucketOwnedByAnotherProject as Y, ProvisionedBucketUnreachable as Z, PUBLIC_ENV_PREFIXES as _, allConstructGlobs as a, SERVER_IPV6_KEY as at, isWorkspaceConfig as b, constructPatterns as c, SECRETS_STORE_PROVIDERS as ct, getAppGkmConfig as d, S3RegionRequired as et, getEndpointForStage as f, wrapSingleAppAsWorkspace as g, workspaceConstructGlobs as h, InvalidWorkspaceConfig as i, SERVER_IPV4_KEY as it, TEST_STAGE as j, validateWorkspaceConfig as k, defineWorkspace as l, UnknownSecretsStoreProvider as lt, processConfig as m, DokployRegistryMoved as n, certificateFor as nt, appConstructGlobs as o, cnameTarget as ot, normalizeWorkspace as p, BucketKeySetElsewhere as q, DomainsMoved as r, proxyFor as rt, assertNoMovedDeployKeys as s, isReservedStageKey as st, DnsMoved as t, ComposeTlsFileMissing as tt, getAppBuildOrder as u, getPublicEnvPrefix as v, formatValidationErrors as w, PHASE_2_DEPLOY_TARGETS as x, stripPublicPrefix as y, telemetryEnv as z };
+
+//# sourceMappingURL=workspace-CJ0lKFq-.mjs.map