@haystackeditor/cli 0.8.0 → 0.9.0

package/dist/types.d.ts

@@ -1,203 +1,1398 @@
 /**
  * Haystack CLI Types
  *
- * These types define the .haystack.json schema that sandbox.py reads.
+ * Zod schemas for .haystack.json configuration + CLI-only types.
+ * The config schema matches what agent/modal/sandbox.py expects to read.
  */
-/**
- * Main configuration file schema (.haystack.json)
- */
-export interface HaystackConfig {
-    /** Schema version - must be "1" */
-    version: '1';
-    /** Project name for display */
-    name?: string;
-    /** Package manager (auto-detected if not specified) */
-    package_manager?: 'npm' | 'pnpm' | 'yarn' | 'bun';
-    /**
-     * Single dev server configuration.
-     * Use this for simple projects with one service.
-     * Mutually exclusive with `services`.
-     */
-    dev_server?: DevServer;
-    /**
-     * Multiple services configuration.
-     * Use this for monorepos with multiple services.
-     * Mutually exclusive with `dev_server`.
-     */
-    services?: Record<string, Service>;
-    /** Verification configuration */
-    verification?: VerificationConfig;
-    /**
-     * Network egress configuration for the sandbox.
-     * By default, sandbox can only reach Cloudflare + GitHub IPs.
-     * Add your own destinations here (staging servers, S3, etc.).
-     */
-    network?: NetworkConfig;
-    /**
-     * Secrets required by this project.
-     * Values are stored securely on the Haystack platform via `haystack secrets set`.
-     * At runtime, secrets are fetched and injected as environment variables.
-     *
-     * This field declares WHAT secrets are needed, not their values.
-     * Use `haystack secrets set KEY VALUE` to store the actual values.
-     *
-     * @example
-     * secrets:
-     *   OPENAI_API_KEY:
-     *     description: "OpenAI API key for LLM calls"
-     *     required: true
-     *   STAGING_TOKEN:
-     *     description: "Token for staging API access"
-     *     required: false
-     */
-    secrets?: Record<string, SecretDeclaration>;
-}
-/**
- * Secret declaration - describes what a secret is for, not its value
- */
-export interface SecretDeclaration {
-    /** Human-readable description of what this secret is used for */
-    description?: string;
-    /**
-     * Whether this secret is required for verification to run.
-     * If true and the secret is not set, verification will fail with an error.
-     * If false, verification will continue with a warning.
-     * @default false
-     */
-    required?: boolean;
-    /**
-     * Services that use this secret.
-     * If specified, the secret is only injected into these services' environments.
-     * If omitted, the secret is available to all services.
-     */
-    services?: string[];
-}
-/**
- * Dev server configuration (simple mode)
- */
-export interface DevServer {
-    /** Command to start the dev server (e.g., "pnpm dev") */
+import { z } from 'zod';
+declare const VerificationCommandSchema: z.ZodObject<{
+    /** Human-readable name (e.g., "Build", "Lint", "Typecheck") */
+    name: z.ZodString;
+    /** The shell command to run (e.g., "pnpm build", "pnpm lint") */
+    run: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    run: string;
+}, {
+    name: string;
+    run: string;
+}>;
+declare const FixtureEntrySchema: z.ZodObject<{
+    /** Where to load fixture data from */
+    source: z.ZodEffects<z.ZodString, string, string>;
+    /** Headers to include when fetching from remote source */
+    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /** Cookies to include when fetching from remote source */
+    cookies: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    source: string;
+    headers?: Record<string, string> | undefined;
+    cookies?: string | undefined;
+}, {
+    source: string;
+    headers?: Record<string, string> | undefined;
+    cookies?: string | undefined;
+}>;
+declare const DevServerSchema: z.ZodObject<{
+    /** Command to start dev server (e.g., "pnpm dev") */
+    command: z.ZodString;
+    /** Port the dev server runs on */
+    port: z.ZodNumber;
+    /** Pattern in stdout that indicates server is ready (e.g., "Local:") */
+    ready_pattern: z.ZodOptional<z.ZodString>;
+    /** Environment variables to set when starting the server */
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, "strip", z.ZodTypeAny, {
     command: string;
-    /** Port the server runs on */
     port: number;
-    /** Pattern in stdout indicating server is ready (e.g., "Local:") */
-    ready_pattern?: string;
-    /** Environment variables to set (e.g., { SKIP_AUTH: "true" }) */
-    env?: Record<string, string>;
-}
-/**
- * Service configuration (monorepo mode)
- */
-export interface Service {
-    /** Directory relative to repo root (e.g., "infra/api-worker") */
-    root?: string;
-    /** Command to start the service */
+    ready_pattern?: string | undefined;
+    env?: Record<string, string> | undefined;
+}, {
     command: string;
-    /** Port the service runs on (omit for batch jobs) */
-    port?: number;
-    /** Pattern in stdout indicating service is ready */
-    ready_pattern?: string;
-    /** Service type: "server" (default) or "batch" */
-    type?: 'server' | 'batch';
+    port: number;
+    ready_pattern?: string | undefined;
+    env?: Record<string, string> | undefined;
+}>;
+/** Valid AI reviewer source identifiers that the merge queue can wait for */
+export declare const AI_REVIEWER_SOURCES: readonly ["cursor", "coderabbit", "copilot", "greptile", "sourcery", "qodo", "codeant", "ellipsis", "korbit", "panto", "bito", "graphite", "deepsource", "snyk", "codacy", "sonarcloud", "sweep", "codeguru", "codereviewer", "codium"];
+export declare const AI_REVIEWER_DISPLAY_NAMES: Record<typeof AI_REVIEWER_SOURCES[number], string>;
+declare const BabysitterConfigSchema: z.ZodObject<{
+    /** Enable the Haystack auto-merge queue */
+    merge_queue: z.ZodOptional<z.ZodBoolean>;
+    /** Automatically rebase PRs that develop merge conflicts after pushes to the base branch */
+    auto_resolve_conflicts: z.ZodOptional<z.ZodBoolean>;
+    /** Grace period configuration before auto-merging */
+    merge_debounce: z.ZodOptional<z.ZodObject<{
+        /** Default wait time in minutes before auto-merging */
+        default_minutes: z.ZodOptional<z.ZodNumber>;
+        /** Per-author wait time overrides (author login → minutes) */
+        authors: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
+    }, "strip", z.ZodTypeAny, {
+        default_minutes?: number | undefined;
+        authors?: Record<string, number> | undefined;
+    }, {
+        default_minutes?: number | undefined;
+        authors?: Record<string, number> | undefined;
+    }>>;
+    /** AI reviewer sources to wait for before starting the merge grace period */
+    expected_ai_reviewers: z.ZodOptional<z.ZodArray<z.ZodEnum<["cursor", "coderabbit", "copilot", "greptile", "sourcery", "qodo", "codeant", "ellipsis", "korbit", "panto", "bito", "graphite", "deepsource", "snyk", "codacy", "sonarcloud", "sweep", "codeguru", "codereviewer", "codium"]>, "many">>;
+}, "strip", z.ZodTypeAny, {
+    merge_queue?: boolean | undefined;
+    auto_resolve_conflicts?: boolean | undefined;
+    merge_debounce?: {
+        default_minutes?: number | undefined;
+        authors?: Record<string, number> | undefined;
+    } | undefined;
+    expected_ai_reviewers?: ("cursor" | "coderabbit" | "copilot" | "greptile" | "sourcery" | "qodo" | "codeant" | "ellipsis" | "korbit" | "panto" | "bito" | "graphite" | "deepsource" | "snyk" | "codacy" | "sonarcloud" | "sweep" | "codeguru" | "codereviewer" | "codium")[] | undefined;
+}, {
+    merge_queue?: boolean | undefined;
+    auto_resolve_conflicts?: boolean | undefined;
+    merge_debounce?: {
+        default_minutes?: number | undefined;
+        authors?: Record<string, number> | undefined;
+    } | undefined;
+    expected_ai_reviewers?: ("cursor" | "coderabbit" | "copilot" | "greptile" | "sourcery" | "qodo" | "codeant" | "ellipsis" | "korbit" | "panto" | "bito" | "graphite" | "deepsource" | "snyk" | "codacy" | "sonarcloud" | "sweep" | "codeguru" | "codereviewer" | "codium")[] | undefined;
+}>;
+declare const ServiceSchema: z.ZodObject<{
+    /** Root directory relative to repo root */
+    root: z.ZodOptional<z.ZodString>;
+    /** Command to start the service */
+    command: z.ZodString;
+    /** Port the service runs on (not required for batch jobs) */
+    port: z.ZodOptional<z.ZodNumber>;
+    /** Pattern in stdout that indicates service is ready */
+    ready_pattern: z.ZodOptional<z.ZodString>;
     /** Environment variables to set */
-    env?: Record<string, string>;
-    /**
-     * Services that must be started before this service.
-     * Used when a service proxies to another (e.g., frontend → API worker).
-     * Auto-detected from vite.config.ts proxy configuration.
-     *
-     * @example
-     * depends_on:
-     *   - haystack-worker  # Start review-chat worker first
-     */
-    depends_on?: string[];
-}
-/**
- * Verification configuration
- */
-export interface VerificationConfig {
-    /** Commands to run during sandbox creation */
-    commands?: VerificationCommand[];
-    /** Fixture definitions - array of pattern/source pairs */
-    fixtures?: Fixture[];
-}
-/**
- * Network egress configuration
- */
-export interface NetworkConfig {
-    /**
-     * Additional hosts/domains to allow egress to.
-     * The sandbox always allows Cloudflare and GitHub IPs.
-     * Add your own destinations here.
-     *
-     * Supports:
-     * - Exact domains: "staging.mycompany.com"
-     * - Wildcards: "*.s3.amazonaws.com"
-     * - CIDR blocks: "10.0.0.0/8"
-     *
-     * @example
-     * allow:
-     *   - "staging.mycompany.com"
-     *   - "*.s3.amazonaws.com"
-     *   - "internal-api.example.com"
-     */
-    allow?: string[];
-}
-/**
- * Fixture definition - pattern to match and source to load from
- */
-export interface Fixture {
-    /** URL pattern to match (e.g., "/api/github/repos/*") */
-    pattern: string;
-    /**
-     * Source to load data from. Supports environment variable substitution:
-     * - $VAR, ${VAR}, ${VAR:-default}
-     *
-     * Source types:
-     * - file://path/to/file.json - Local file
-     * - https://staging.example.com/api/... - Remote URL (e.g., staging server)
-     * - https://${STAGING_HOST}/api/... - Remote URL with env var
-     * - s3://bucket/key - AWS S3 (uses AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY)
-     * - r2://bucket/key - Cloudflare R2 (uses R2_ACCOUNT_ID, R2_ACCESS_KEY_ID)
-     * - passthrough - Don't intercept, let request through to real API
-     *
-     * @example
-     * // Pull from staging with auth
-     * source: "https://${STAGING_URL:-staging.example.com}/api/users"
-     *
-     * @example
-     * // S3 with region override
-     * source: "s3://my-bucket/fixtures/data.json"
-     */
-    source: string;
-    /**
-     * Headers for remote sources.
-     * Supports environment variable substitution: $VAR, ${VAR}, ${VAR:-default}
-     *
-     * @example
-     * headers:
-     *   Authorization: "Bearer $STAGING_API_TOKEN"
-     *   Cookie: "$STAGING_SESSION_COOKIE"
-     *   X-Api-Key: "${API_KEY:-test-key}"
-     */
-    headers?: Record<string, string>;
-}
-/**
- * A verification command (e.g., build, lint, typecheck)
- */
-export interface VerificationCommand {
-    /** Human-readable name */
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /** Service type: 'server' (default) or 'batch' (run once, no port) */
+    type: z.ZodOptional<z.ZodEnum<["server", "batch"]>>;
+    /** Services that must be started before this service */
+    depends_on: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    command: string;
+    type?: "server" | "batch" | undefined;
+    port?: number | undefined;
+    ready_pattern?: string | undefined;
+    env?: Record<string, string> | undefined;
+    root?: string | undefined;
+    depends_on?: string[] | undefined;
+}, {
+    command: string;
+    type?: "server" | "batch" | undefined;
+    port?: number | undefined;
+    ready_pattern?: string | undefined;
+    env?: Record<string, string> | undefined;
+    root?: string | undefined;
+    depends_on?: string[] | undefined;
+}>;
+declare const VerificationSchema: z.ZodObject<{
+    /** Commands to run for verification (build, lint, test, etc.) */
+    commands: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        /** Human-readable name (e.g., "Build", "Lint", "Typecheck") */
+        name: z.ZodString;
+        /** The shell command to run (e.g., "pnpm build", "pnpm lint") */
+        run: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        name: string;
+        run: string;
+    }, {
+        name: string;
+        run: string;
+    }>, "many">>;
+    /** Fixture data sources keyed by endpoint pattern */
+    fixtures: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        /** Where to load fixture data from */
+        source: z.ZodEffects<z.ZodString, string, string>;
+        /** Headers to include when fetching from remote source */
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        /** Cookies to include when fetching from remote source */
+        cookies: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        source: string;
+        headers?: Record<string, string> | undefined;
+        cookies?: string | undefined;
+    }, {
+        source: string;
+        headers?: Record<string, string> | undefined;
+        cookies?: string | undefined;
+    }>>>;
+}, "strip", z.ZodTypeAny, {
+    commands?: {
+        name: string;
+        run: string;
+    }[] | undefined;
+    fixtures?: Record<string, {
+        source: string;
+        headers?: Record<string, string> | undefined;
+        cookies?: string | undefined;
+    }> | undefined;
+}, {
+    commands?: {
+        name: string;
+        run: string;
+    }[] | undefined;
+    fixtures?: Record<string, {
+        source: string;
+        headers?: Record<string, string> | undefined;
+        cookies?: string | undefined;
+    }> | undefined;
+}>;
+declare const AuthStrategySchema: z.ZodEnum<["bypass", "fixture", "token", "test_account"]>;
+declare const TokenInjectionSchema: z.ZodObject<{
+    type: z.ZodEnum<["cookie", "localStorage", "sessionStorage", "header"]>;
+    name: z.ZodString;
+    secret: z.ZodString;
+    cookie_options: z.ZodOptional<z.ZodObject<{
+        path: z.ZodOptional<z.ZodString>;
+        domain: z.ZodOptional<z.ZodString>;
+        secure: z.ZodOptional<z.ZodBoolean>;
+        httpOnly: z.ZodOptional<z.ZodBoolean>;
+        sameSite: z.ZodOptional<z.ZodEnum<["Strict", "Lax", "None"]>>;
+    }, "strip", z.ZodTypeAny, {
+        path?: string | undefined;
+        domain?: string | undefined;
+        secure?: boolean | undefined;
+        httpOnly?: boolean | undefined;
+        sameSite?: "Strict" | "Lax" | "None" | undefined;
+    }, {
+        path?: string | undefined;
+        domain?: string | undefined;
+        secure?: boolean | undefined;
+        httpOnly?: boolean | undefined;
+        sameSite?: "Strict" | "Lax" | "None" | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
     name: string;
-    /** Shell command to run */
-    run: string;
-}
-/**
- * @deprecated Use Fixture interface instead. This is kept for backwards compatibility.
- */
-export interface FixtureEntry {
-    source: string;
-    headers?: Record<string, string>;
-}
+    type: "cookie" | "localStorage" | "sessionStorage" | "header";
+    secret: string;
+    cookie_options?: {
+        path?: string | undefined;
+        domain?: string | undefined;
+        secure?: boolean | undefined;
+        httpOnly?: boolean | undefined;
+        sameSite?: "Strict" | "Lax" | "None" | undefined;
+    } | undefined;
+}, {
+    name: string;
+    type: "cookie" | "localStorage" | "sessionStorage" | "header";
+    secret: string;
+    cookie_options?: {
+        path?: string | undefined;
+        domain?: string | undefined;
+        secure?: boolean | undefined;
+        httpOnly?: boolean | undefined;
+        sameSite?: "Strict" | "Lax" | "None" | undefined;
+    } | undefined;
+}>;
+declare const LoginStepSchema: z.ZodObject<{
+    action: z.ZodEnum<["navigate", "type", "click", "wait", "submit"]>;
+    url: z.ZodOptional<z.ZodString>;
+    selector: z.ZodOptional<z.ZodString>;
+    value: z.ZodOptional<z.ZodString>;
+    timeout: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    action: "type" | "navigate" | "click" | "wait" | "submit";
+    value?: string | undefined;
+    url?: string | undefined;
+    selector?: string | undefined;
+    timeout?: number | undefined;
+}, {
+    action: "type" | "navigate" | "click" | "wait" | "submit";
+    value?: string | undefined;
+    url?: string | undefined;
+    selector?: string | undefined;
+    timeout?: number | undefined;
+}>;
+declare const TestAccountSchema: z.ZodObject<{
+    credentials_secret: z.ZodString;
+    login_flow: z.ZodArray<z.ZodObject<{
+        action: z.ZodEnum<["navigate", "type", "click", "wait", "submit"]>;
+        url: z.ZodOptional<z.ZodString>;
+        selector: z.ZodOptional<z.ZodString>;
+        value: z.ZodOptional<z.ZodString>;
+        timeout: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        action: "type" | "navigate" | "click" | "wait" | "submit";
+        value?: string | undefined;
+        url?: string | undefined;
+        selector?: string | undefined;
+        timeout?: number | undefined;
+    }, {
+        action: "type" | "navigate" | "click" | "wait" | "submit";
+        value?: string | undefined;
+        url?: string | undefined;
+        selector?: string | undefined;
+        timeout?: number | undefined;
+    }>, "many">;
+    success_selector: z.ZodOptional<z.ZodString>;
+    failure_selector: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    credentials_secret: string;
+    login_flow: {
+        action: "type" | "navigate" | "click" | "wait" | "submit";
+        value?: string | undefined;
+        url?: string | undefined;
+        selector?: string | undefined;
+        timeout?: number | undefined;
+    }[];
+    success_selector?: string | undefined;
+    failure_selector?: string | undefined;
+}, {
+    credentials_secret: string;
+    login_flow: {
+        action: "type" | "navigate" | "click" | "wait" | "submit";
+        value?: string | undefined;
+        url?: string | undefined;
+        selector?: string | undefined;
+        timeout?: number | undefined;
+    }[];
+    success_selector?: string | undefined;
+    failure_selector?: string | undefined;
+}>;
+declare const AuthConfigSchema: z.ZodObject<{
+    strategy: z.ZodDefault<z.ZodEnum<["bypass", "fixture", "token", "test_account"]>>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    fixture: z.ZodOptional<z.ZodObject<{
+        pattern: z.ZodString;
+        source: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        source: string;
+        pattern: string;
+    }, {
+        source: string;
+        pattern: string;
+    }>>;
+    token: z.ZodOptional<z.ZodObject<{
+        type: z.ZodEnum<["cookie", "localStorage", "sessionStorage", "header"]>;
+        name: z.ZodString;
+        secret: z.ZodString;
+        cookie_options: z.ZodOptional<z.ZodObject<{
+            path: z.ZodOptional<z.ZodString>;
+            domain: z.ZodOptional<z.ZodString>;
+            secure: z.ZodOptional<z.ZodBoolean>;
+            httpOnly: z.ZodOptional<z.ZodBoolean>;
+            sameSite: z.ZodOptional<z.ZodEnum<["Strict", "Lax", "None"]>>;
+        }, "strip", z.ZodTypeAny, {
+            path?: string | undefined;
+            domain?: string | undefined;
+            secure?: boolean | undefined;
+            httpOnly?: boolean | undefined;
+            sameSite?: "Strict" | "Lax" | "None" | undefined;
+        }, {
+            path?: string | undefined;
+            domain?: string | undefined;
+            secure?: boolean | undefined;
+            httpOnly?: boolean | undefined;
+            sameSite?: "Strict" | "Lax" | "None" | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        name: string;
+        type: "cookie" | "localStorage" | "sessionStorage" | "header";
+        secret: string;
+        cookie_options?: {
+            path?: string | undefined;
+            domain?: string | undefined;
+            secure?: boolean | undefined;
+            httpOnly?: boolean | undefined;
+            sameSite?: "Strict" | "Lax" | "None" | undefined;
+        } | undefined;
+    }, {
+        name: string;
+        type: "cookie" | "localStorage" | "sessionStorage" | "header";
+        secret: string;
+        cookie_options?: {
+            path?: string | undefined;
+            domain?: string | undefined;
+            secure?: boolean | undefined;
+            httpOnly?: boolean | undefined;
+            sameSite?: "Strict" | "Lax" | "None" | undefined;
+        } | undefined;
+    }>>;
+    test_account: z.ZodOptional<z.ZodObject<{
+        credentials_secret: z.ZodString;
+        login_flow: z.ZodArray<z.ZodObject<{
+            action: z.ZodEnum<["navigate", "type", "click", "wait", "submit"]>;
+            url: z.ZodOptional<z.ZodString>;
+            selector: z.ZodOptional<z.ZodString>;
+            value: z.ZodOptional<z.ZodString>;
+            timeout: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            action: "type" | "navigate" | "click" | "wait" | "submit";
+            value?: string | undefined;
+            url?: string | undefined;
+            selector?: string | undefined;
+            timeout?: number | undefined;
+        }, {
+            action: "type" | "navigate" | "click" | "wait" | "submit";
+            value?: string | undefined;
+            url?: string | undefined;
+            selector?: string | undefined;
+            timeout?: number | undefined;
+        }>, "many">;
+        success_selector: z.ZodOptional<z.ZodString>;
+        failure_selector: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        credentials_secret: string;
+        login_flow: {
+            action: "type" | "navigate" | "click" | "wait" | "submit";
+            value?: string | undefined;
+            url?: string | undefined;
+            selector?: string | undefined;
+            timeout?: number | undefined;
+        }[];
+        success_selector?: string | undefined;
+        failure_selector?: string | undefined;
+    }, {
+        credentials_secret: string;
+        login_flow: {
+            action: "type" | "navigate" | "click" | "wait" | "submit";
+            value?: string | undefined;
+            url?: string | undefined;
+            selector?: string | undefined;
+            timeout?: number | undefined;
+        }[];
+        success_selector?: string | undefined;
+        failure_selector?: string | undefined;
+    }>>;
+    fallback: z.ZodOptional<z.ZodEnum<["bypass", "fixture", "token", "test_account"]>>;
+}, "strip", z.ZodTypeAny, {
+    strategy: "bypass" | "fixture" | "token" | "test_account";
+    env?: Record<string, string> | undefined;
+    fixture?: {
+        source: string;
+        pattern: string;
+    } | undefined;
+    token?: {
+        name: string;
+        type: "cookie" | "localStorage" | "sessionStorage" | "header";
+        secret: string;
+        cookie_options?: {
+            path?: string | undefined;
+            domain?: string | undefined;
+            secure?: boolean | undefined;
+            httpOnly?: boolean | undefined;
+            sameSite?: "Strict" | "Lax" | "None" | undefined;
+        } | undefined;
+    } | undefined;
+    test_account?: {
+        credentials_secret: string;
+        login_flow: {
+            action: "type" | "navigate" | "click" | "wait" | "submit";
+            value?: string | undefined;
+            url?: string | undefined;
+            selector?: string | undefined;
+            timeout?: number | undefined;
+        }[];
+        success_selector?: string | undefined;
+        failure_selector?: string | undefined;
+    } | undefined;
+    fallback?: "bypass" | "fixture" | "token" | "test_account" | undefined;
+}, {
+    env?: Record<string, string> | undefined;
+    fixture?: {
+        source: string;
+        pattern: string;
+    } | undefined;
+    token?: {
+        name: string;
+        type: "cookie" | "localStorage" | "sessionStorage" | "header";
+        secret: string;
+        cookie_options?: {
+            path?: string | undefined;
+            domain?: string | undefined;
+            secure?: boolean | undefined;
+            httpOnly?: boolean | undefined;
+            sameSite?: "Strict" | "Lax" | "None" | undefined;
+        } | undefined;
+    } | undefined;
+    test_account?: {
+        credentials_secret: string;
+        login_flow: {
+            action: "type" | "navigate" | "click" | "wait" | "submit";
+            value?: string | undefined;
+            url?: string | undefined;
+            selector?: string | undefined;
+            timeout?: number | undefined;
+        }[];
+        success_selector?: string | undefined;
+        failure_selector?: string | undefined;
+    } | undefined;
+    strategy?: "bypass" | "fixture" | "token" | "test_account" | undefined;
+    fallback?: "bypass" | "fixture" | "token" | "test_account" | undefined;
+}>;
+declare const DatabaseStrategySchema: z.ZodEnum<["fixture", "memory", "seed", "docker", "remote"]>;
+declare const DockerServiceSchema: z.ZodObject<{
+    image: z.ZodString;
+    port: z.ZodNumber;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    health_check: z.ZodOptional<z.ZodString>;
+    health_timeout: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    port: number;
+    image: string;
+    env?: Record<string, string> | undefined;
+    health_check?: string | undefined;
+    health_timeout?: number | undefined;
+}, {
+    port: number;
+    image: string;
+    env?: Record<string, string> | undefined;
+    health_check?: string | undefined;
+    health_timeout?: number | undefined;
+}>;
+declare const DatabaseConfigSchema: z.ZodObject<{
+    strategy: z.ZodDefault<z.ZodEnum<["fixture", "memory", "seed", "docker", "remote"]>>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    seed_command: z.ZodOptional<z.ZodString>;
+    migrate_command: z.ZodOptional<z.ZodString>;
+    services: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        image: z.ZodString;
+        port: z.ZodNumber;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        health_check: z.ZodOptional<z.ZodString>;
+        health_timeout: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        port: number;
+        image: string;
+        env?: Record<string, string> | undefined;
+        health_check?: string | undefined;
+        health_timeout?: number | undefined;
+    }, {
+        port: number;
+        image: string;
+        env?: Record<string, string> | undefined;
+        health_check?: string | undefined;
+        health_timeout?: number | undefined;
+    }>, "many">>;
+    read_only: z.ZodOptional<z.ZodBoolean>;
+    ready_timeout: z.ZodOptional<z.ZodNumber>;
+} & {
+    fallback: z.ZodOptional<z.ZodObject<{
+        strategy: z.ZodDefault<z.ZodEnum<["fixture", "memory", "seed", "docker", "remote"]>>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        seed_command: z.ZodOptional<z.ZodString>;
+        migrate_command: z.ZodOptional<z.ZodString>;
+        services: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            image: z.ZodString;
+            port: z.ZodNumber;
+            env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            health_check: z.ZodOptional<z.ZodString>;
+            health_timeout: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            port: number;
+            image: string;
+            env?: Record<string, string> | undefined;
+            health_check?: string | undefined;
+            health_timeout?: number | undefined;
+        }, {
+            port: number;
+            image: string;
+            env?: Record<string, string> | undefined;
+            health_check?: string | undefined;
+            health_timeout?: number | undefined;
+        }>, "many">>;
+        read_only: z.ZodOptional<z.ZodBoolean>;
+        ready_timeout: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        strategy: "fixture" | "memory" | "seed" | "docker" | "remote";
+        env?: Record<string, string> | undefined;
+        seed_command?: string | undefined;
+        migrate_command?: string | undefined;
+        services?: {
+            port: number;
+            image: string;
+            env?: Record<string, string> | undefined;
+            health_check?: string | undefined;
+            health_timeout?: number | undefined;
+        }[] | undefined;
+        read_only?: boolean | undefined;
+        ready_timeout?: number | undefined;
+    }, {
+        env?: Record<string, string> | undefined;
+        strategy?: "fixture" | "memory" | "seed" | "docker" | "remote" | undefined;
+        seed_command?: string | undefined;
+        migrate_command?: string | undefined;
+        services?: {
+            port: number;
+            image: string;
+            env?: Record<string, string> | undefined;
+            health_check?: string | undefined;
+            health_timeout?: number | undefined;
+        }[] | undefined;
+        read_only?: boolean | undefined;
+        ready_timeout?: number | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    strategy: "fixture" | "memory" | "seed" | "docker" | "remote";
+    env?: Record<string, string> | undefined;
+    fallback?: {
+        strategy: "fixture" | "memory" | "seed" | "docker" | "remote";
+        env?: Record<string, string> | undefined;
+        seed_command?: string | undefined;
+        migrate_command?: string | undefined;
+        services?: {
+            port: number;
+            image: string;
+            env?: Record<string, string> | undefined;
+            health_check?: string | undefined;
+            health_timeout?: number | undefined;
+        }[] | undefined;
+        read_only?: boolean | undefined;
+        ready_timeout?: number | undefined;
+    } | undefined;
+    seed_command?: string | undefined;
+    migrate_command?: string | undefined;
+    services?: {
+        port: number;
+        image: string;
+        env?: Record<string, string> | undefined;
+        health_check?: string | undefined;
+        health_timeout?: number | undefined;
+    }[] | undefined;
+    read_only?: boolean | undefined;
+    ready_timeout?: number | undefined;
+}, {
+    env?: Record<string, string> | undefined;
+    strategy?: "fixture" | "memory" | "seed" | "docker" | "remote" | undefined;
+    fallback?: {
+        env?: Record<string, string> | undefined;
+        strategy?: "fixture" | "memory" | "seed" | "docker" | "remote" | undefined;
+        seed_command?: string | undefined;
+        migrate_command?: string | undefined;
+        services?: {
+            port: number;
+            image: string;
+            env?: Record<string, string> | undefined;
+            health_check?: string | undefined;
+            health_timeout?: number | undefined;
+        }[] | undefined;
+        read_only?: boolean | undefined;
+        ready_timeout?: number | undefined;
+    } | undefined;
+    seed_command?: string | undefined;
+    migrate_command?: string | undefined;
+    services?: {
+        port: number;
+        image: string;
+        env?: Record<string, string> | undefined;
+        health_check?: string | undefined;
+        health_timeout?: number | undefined;
+    }[] | undefined;
+    read_only?: boolean | undefined;
+    ready_timeout?: number | undefined;
+}>;
+declare const AgenticToolSchema: z.ZodEnum<["opencode", "claude-code", "codex"]>;
+declare const AgenticSchema: z.ZodObject<{
+    tool: z.ZodOptional<z.ZodEnum<["opencode", "claude-code", "codex"]>>;
+}, "strip", z.ZodTypeAny, {
+    tool?: "opencode" | "claude-code" | "codex" | undefined;
+}, {
+    tool?: "opencode" | "claude-code" | "codex" | undefined;
+}>;
+declare const NetworkConfigSchema: z.ZodObject<{
+    /** Additional hosts/domains to allow egress to */
+    allow: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    allow?: string[] | undefined;
+}, {
+    allow?: string[] | undefined;
+}>;
+declare const SecretDeclarationSchema: z.ZodObject<{
+    description: z.ZodOptional<z.ZodString>;
+    required: z.ZodOptional<z.ZodBoolean>;
+    services: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    required?: boolean | undefined;
+    services?: string[] | undefined;
+    description?: string | undefined;
+}, {
+    required?: boolean | undefined;
+    services?: string[] | undefined;
+    description?: string | undefined;
+}>;
+export declare const HaystackConfigSchema: z.ZodObject<{
+    /** Config version (must be "1") */
+    version: z.ZodLiteral<"1">;
+    /** Project name (for display) */
+    name: z.ZodOptional<z.ZodString>;
+    /** Package manager override (auto-detected if not specified) */
+    package_manager: z.ZodOptional<z.ZodEnum<["npm", "pnpm", "yarn", "bun"]>>;
+    /** Development server configuration */
+    dev_server: z.ZodOptional<z.ZodObject<{
+        /** Command to start dev server (e.g., "pnpm dev") */
+        command: z.ZodString;
+        /** Port the dev server runs on */
+        port: z.ZodNumber;
+        /** Pattern in stdout that indicates server is ready (e.g., "Local:") */
+        ready_pattern: z.ZodOptional<z.ZodString>;
+        /** Environment variables to set when starting the server */
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+        command: string;
+        port: number;
+        ready_pattern?: string | undefined;
+        env?: Record<string, string> | undefined;
+    }, {
+        command: string;
+        port: number;
+        ready_pattern?: string | undefined;
+        env?: Record<string, string> | undefined;
+    }>>;
+    /** Multiple services (for monorepos) */
+    services: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        /** Root directory relative to repo root */
+        root: z.ZodOptional<z.ZodString>;
+        /** Command to start the service */
+        command: z.ZodString;
+        /** Port the service runs on (not required for batch jobs) */
+        port: z.ZodOptional<z.ZodNumber>;
+        /** Pattern in stdout that indicates service is ready */
+        ready_pattern: z.ZodOptional<z.ZodString>;
+        /** Environment variables to set */
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        /** Service type: 'server' (default) or 'batch' (run once, no port) */
+        type: z.ZodOptional<z.ZodEnum<["server", "batch"]>>;
+        /** Services that must be started before this service */
+        depends_on: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        command: string;
+        type?: "server" | "batch" | undefined;
+        port?: number | undefined;
+        ready_pattern?: string | undefined;
+        env?: Record<string, string> | undefined;
+        root?: string | undefined;
+        depends_on?: string[] | undefined;
+    }, {
+        command: string;
+        type?: "server" | "batch" | undefined;
+        port?: number | undefined;
+        ready_pattern?: string | undefined;
+        env?: Record<string, string> | undefined;
+        root?: string | undefined;
+        depends_on?: string[] | undefined;
+    }>>>;
+    /** Verification configuration */
+    verification: z.ZodOptional<z.ZodObject<{
+        /** Commands to run for verification (build, lint, test, etc.) */
+        commands: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            /** Human-readable name (e.g., "Build", "Lint", "Typecheck") */
+            name: z.ZodString;
+            /** The shell command to run (e.g., "pnpm build", "pnpm lint") */
+            run: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            name: string;
+            run: string;
+        }, {
+            name: string;
+            run: string;
+        }>, "many">>;
+        /** Fixture data sources keyed by endpoint pattern */
+        fixtures: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            /** Where to load fixture data from */
+            source: z.ZodEffects<z.ZodString, string, string>;
+            /** Headers to include when fetching from remote source */
+            headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            /** Cookies to include when fetching from remote source */
+            cookies: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            source: string;
+            headers?: Record<string, string> | undefined;
+            cookies?: string | undefined;
+        }, {
+            source: string;
+            headers?: Record<string, string> | undefined;
+            cookies?: string | undefined;
+        }>>>;
+    }, "strip", z.ZodTypeAny, {
+        commands?: {
+            name: string;
+            run: string;
+        }[] | undefined;
+        fixtures?: Record<string, {
+            source: string;
+            headers?: Record<string, string> | undefined;
+            cookies?: string | undefined;
+        }> | undefined;
+    }, {
+        commands?: {
+            name: string;
+            run: string;
+        }[] | undefined;
+        fixtures?: Record<string, {
+            source: string;
+            headers?: Record<string, string> | undefined;
+            cookies?: string | undefined;
+        }> | undefined;
+    }>>;
+    /** Auth configuration for sandbox verification */
+    auth: z.ZodOptional<z.ZodObject<{
+        strategy: z.ZodDefault<z.ZodEnum<["bypass", "fixture", "token", "test_account"]>>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        fixture: z.ZodOptional<z.ZodObject<{
+            pattern: z.ZodString;
+            source: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            source: string;
+            pattern: string;
+        }, {
+            source: string;
+            pattern: string;
+        }>>;
+        token: z.ZodOptional<z.ZodObject<{
+            type: z.ZodEnum<["cookie", "localStorage", "sessionStorage", "header"]>;
+            name: z.ZodString;
+            secret: z.ZodString;
+            cookie_options: z.ZodOptional<z.ZodObject<{
+                path: z.ZodOptional<z.ZodString>;
+                domain: z.ZodOptional<z.ZodString>;
+                secure: z.ZodOptional<z.ZodBoolean>;
+                httpOnly: z.ZodOptional<z.ZodBoolean>;
+                sameSite: z.ZodOptional<z.ZodEnum<["Strict", "Lax", "None"]>>;
+            }, "strip", z.ZodTypeAny, {
+                path?: string | undefined;
+                domain?: string | undefined;
+                secure?: boolean | undefined;
+                httpOnly?: boolean | undefined;
+                sameSite?: "Strict" | "Lax" | "None" | undefined;
+            }, {
+                path?: string | undefined;
+                domain?: string | undefined;
+                secure?: boolean | undefined;
+                httpOnly?: boolean | undefined;
+                sameSite?: "Strict" | "Lax" | "None" | undefined;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            name: string;
+            type: "cookie" | "localStorage" | "sessionStorage" | "header";
+            secret: string;
+            cookie_options?: {
+                path?: string | undefined;
+                domain?: string | undefined;
+                secure?: boolean | undefined;
+                httpOnly?: boolean | undefined;
+                sameSite?: "Strict" | "Lax" | "None" | undefined;
+            } | undefined;
+        }, {
+            name: string;
+            type: "cookie" | "localStorage" | "sessionStorage" | "header";
+            secret: string;
+            cookie_options?: {
+                path?: string | undefined;
+                domain?: string | undefined;
+                secure?: boolean | undefined;
+                httpOnly?: boolean | undefined;
+                sameSite?: "Strict" | "Lax" | "None" | undefined;
+            } | undefined;
+        }>>;
+        test_account: z.ZodOptional<z.ZodObject<{
+            credentials_secret: z.ZodString;
+            login_flow: z.ZodArray<z.ZodObject<{
+                action: z.ZodEnum<["navigate", "type", "click", "wait", "submit"]>;
+                url: z.ZodOptional<z.ZodString>;
+                selector: z.ZodOptional<z.ZodString>;
+                value: z.ZodOptional<z.ZodString>;
+                timeout: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                action: "type" | "navigate" | "click" | "wait" | "submit";
+                value?: string | undefined;
+                url?: string | undefined;
+                selector?: string | undefined;
+                timeout?: number | undefined;
+            }, {
+                action: "type" | "navigate" | "click" | "wait" | "submit";
+                value?: string | undefined;
+                url?: string | undefined;
+                selector?: string | undefined;
+                timeout?: number | undefined;
+            }>, "many">;
+            success_selector: z.ZodOptional<z.ZodString>;
+            failure_selector: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            credentials_secret: string;
+            login_flow: {
+                action: "type" | "navigate" | "click" | "wait" | "submit";
+                value?: string | undefined;
+                url?: string | undefined;
+                selector?: string | undefined;
+                timeout?: number | undefined;
+            }[];
+            success_selector?: string | undefined;
+            failure_selector?: string | undefined;
+        }, {
+            credentials_secret: string;
+            login_flow: {
+                action: "type" | "navigate" | "click" | "wait" | "submit";
+                value?: string | undefined;
+                url?: string | undefined;
+                selector?: string | undefined;
+                timeout?: number | undefined;
+            }[];
+            success_selector?: string | undefined;
+            failure_selector?: string | undefined;
+        }>>;
+        fallback: z.ZodOptional<z.ZodEnum<["bypass", "fixture", "token", "test_account"]>>;
+    }, "strip", z.ZodTypeAny, {
+        strategy: "bypass" | "fixture" | "token" | "test_account";
+        env?: Record<string, string> | undefined;
+        fixture?: {
+            source: string;
+            pattern: string;
+        } | undefined;
+        token?: {
+            name: string;
+            type: "cookie" | "localStorage" | "sessionStorage" | "header";
+            secret: string;
+            cookie_options?: {
+                path?: string | undefined;
+                domain?: string | undefined;
+                secure?: boolean | undefined;
+                httpOnly?: boolean | undefined;
+                sameSite?: "Strict" | "Lax" | "None" | undefined;
+            } | undefined;
+        } | undefined;
+        test_account?: {
+            credentials_secret: string;
+            login_flow: {
+                action: "type" | "navigate" | "click" | "wait" | "submit";
+                value?: string | undefined;
+                url?: string | undefined;
+                selector?: string | undefined;
+                timeout?: number | undefined;
+            }[];
+            success_selector?: string | undefined;
+            failure_selector?: string | undefined;
+        } | undefined;
+        fallback?: "bypass" | "fixture" | "token" | "test_account" | undefined;
+    }, {
+        env?: Record<string, string> | undefined;
+        fixture?: {
+            source: string;
+            pattern: string;
+        } | undefined;
+        token?: {
+            name: string;
+            type: "cookie" | "localStorage" | "sessionStorage" | "header";
+            secret: string;
+            cookie_options?: {
+                path?: string | undefined;
+                domain?: string | undefined;
+                secure?: boolean | undefined;
+                httpOnly?: boolean | undefined;
+                sameSite?: "Strict" | "Lax" | "None" | undefined;
+            } | undefined;
+        } | undefined;
+        test_account?: {
+            credentials_secret: string;
+            login_flow: {
+                action: "type" | "navigate" | "click" | "wait" | "submit";
+                value?: string | undefined;
+                url?: string | undefined;
+                selector?: string | undefined;
+                timeout?: number | undefined;
+            }[];
+            success_selector?: string | undefined;
+            failure_selector?: string | undefined;
+        } | undefined;
+        strategy?: "bypass" | "fixture" | "token" | "test_account" | undefined;
+        fallback?: "bypass" | "fixture" | "token" | "test_account" | undefined;
+    }>>;
+    /** Agentic configuration (project-level override) */
+    agentic: z.ZodOptional<z.ZodObject<{
+        tool: z.ZodOptional<z.ZodEnum<["opencode", "claude-code", "codex"]>>;
+    }, "strip", z.ZodTypeAny, {
+        tool?: "opencode" | "claude-code" | "codex" | undefined;
+    }, {
+        tool?: "opencode" | "claude-code" | "codex" | undefined;
+    }>>;
+    /** Database configuration for sandbox verification */
+    database: z.ZodOptional<z.ZodObject<{
+        strategy: z.ZodDefault<z.ZodEnum<["fixture", "memory", "seed", "docker", "remote"]>>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        seed_command: z.ZodOptional<z.ZodString>;
+        migrate_command: z.ZodOptional<z.ZodString>;
+        services: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            image: z.ZodString;
+            port: z.ZodNumber;
+            env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            health_check: z.ZodOptional<z.ZodString>;
+            health_timeout: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            port: number;
+            image: string;
+            env?: Record<string, string> | undefined;
+            health_check?: string | undefined;
+            health_timeout?: number | undefined;
+        }, {
+            port: number;
+            image: string;
+            env?: Record<string, string> | undefined;
+            health_check?: string | undefined;
+            health_timeout?: number | undefined;
+        }>, "many">>;
+        read_only: z.ZodOptional<z.ZodBoolean>;
+        ready_timeout: z.ZodOptional<z.ZodNumber>;
+    } & {
+        fallback: z.ZodOptional<z.ZodObject<{
+            strategy: z.ZodDefault<z.ZodEnum<["fixture", "memory", "seed", "docker", "remote"]>>;
+            env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            seed_command: z.ZodOptional<z.ZodString>;
+            migrate_command: z.ZodOptional<z.ZodString>;
+            services: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                image: z.ZodString;
+                port: z.ZodNumber;
+                env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+                health_check: z.ZodOptional<z.ZodString>;
+                health_timeout: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                port: number;
+                image: string;
+                env?: Record<string, string> | undefined;
+                health_check?: string | undefined;
+                health_timeout?: number | undefined;
+            }, {
+                port: number;
+                image: string;
+                env?: Record<string, string> | undefined;
+                health_check?: string | undefined;
+                health_timeout?: number | undefined;
+            }>, "many">>;
+            read_only: z.ZodOptional<z.ZodBoolean>;
+            ready_timeout: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            strategy: "fixture" | "memory" | "seed" | "docker" | "remote";
+            env?: Record<string, string> | undefined;
+            seed_command?: string | undefined;
+            migrate_command?: string | undefined;
+            services?: {
+                port: number;
+                image: string;
+                env?: Record<string, string> | undefined;
+                health_check?: string | undefined;
+                health_timeout?: number | undefined;
+            }[] | undefined;
+            read_only?: boolean | undefined;
+            ready_timeout?: number | undefined;
+        }, {
+            env?: Record<string, string> | undefined;
+            strategy?: "fixture" | "memory" | "seed" | "docker" | "remote" | undefined;
+            seed_command?: string | undefined;
+            migrate_command?: string | undefined;
+            services?: {
+                port: number;
+                image: string;
+                env?: Record<string, string> | undefined;
+                health_check?: string | undefined;
+                health_timeout?: number | undefined;
+            }[] | undefined;
+            read_only?: boolean | undefined;
+            ready_timeout?: number | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        strategy: "fixture" | "memory" | "seed" | "docker" | "remote";
+        env?: Record<string, string> | undefined;
+        fallback?: {
+            strategy: "fixture" | "memory" | "seed" | "docker" | "remote";
+            env?: Record<string, string> | undefined;
+            seed_command?: string | undefined;
+            migrate_command?: string | undefined;
+            services?: {
+                port: number;
+                image: string;
+                env?: Record<string, string> | undefined;
+                health_check?: string | undefined;
+                health_timeout?: number | undefined;
+            }[] | undefined;
+            read_only?: boolean | undefined;
+            ready_timeout?: number | undefined;
+        } | undefined;
+        seed_command?: string | undefined;
+        migrate_command?: string | undefined;
+        services?: {
+            port: number;
+            image: string;
+            env?: Record<string, string> | undefined;
+            health_check?: string | undefined;
+            health_timeout?: number | undefined;
+        }[] | undefined;
+        read_only?: boolean | undefined;
+        ready_timeout?: number | undefined;
+    }, {
+        env?: Record<string, string> | undefined;
+        strategy?: "fixture" | "memory" | "seed" | "docker" | "remote" | undefined;
+        fallback?: {
+            env?: Record<string, string> | undefined;
+            strategy?: "fixture" | "memory" | "seed" | "docker" | "remote" | undefined;
+            seed_command?: string | undefined;
+            migrate_command?: string | undefined;
+            services?: {
+                port: number;
+                image: string;
+                env?: Record<string, string> | undefined;
+                health_check?: string | undefined;
+                health_timeout?: number | undefined;
+            }[] | undefined;
+            read_only?: boolean | undefined;
+            ready_timeout?: number | undefined;
+        } | undefined;
+        seed_command?: string | undefined;
+        migrate_command?: string | undefined;
+        services?: {
+            port: number;
+            image: string;
+            env?: Record<string, string> | undefined;
+            health_check?: string | undefined;
+            health_timeout?: number | undefined;
+        }[] | undefined;
+        read_only?: boolean | undefined;
+        ready_timeout?: number | undefined;
+    }>>;
+    /** Network egress configuration */
+    network: z.ZodOptional<z.ZodObject<{
+        /** Additional hosts/domains to allow egress to */
+        allow: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        allow?: string[] | undefined;
+    }, {
+        allow?: string[] | undefined;
+    }>>;
+    /** Secrets required by this project */
+    secrets: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        description: z.ZodOptional<z.ZodString>;
+        required: z.ZodOptional<z.ZodBoolean>;
+        services: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        required?: boolean | undefined;
+        services?: string[] | undefined;
+        description?: string | undefined;
+    }, {
+        required?: boolean | undefined;
+        services?: string[] | undefined;
+        description?: string | undefined;
+    }>>>;
+    /** Babysitter configuration for autonomous PR maintenance */
+    babysitter: z.ZodOptional<z.ZodObject<{
+        /** Enable the Haystack auto-merge queue */
+        merge_queue: z.ZodOptional<z.ZodBoolean>;
+        /** Automatically rebase PRs that develop merge conflicts after pushes to the base branch */
+        auto_resolve_conflicts: z.ZodOptional<z.ZodBoolean>;
+        /** Grace period configuration before auto-merging */
+        merge_debounce: z.ZodOptional<z.ZodObject<{
+            /** Default wait time in minutes before auto-merging */
+            default_minutes: z.ZodOptional<z.ZodNumber>;
+            /** Per-author wait time overrides (author login → minutes) */
+            authors: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
+        }, "strip", z.ZodTypeAny, {
+            default_minutes?: number | undefined;
+            authors?: Record<string, number> | undefined;
+        }, {
+            default_minutes?: number | undefined;
+            authors?: Record<string, number> | undefined;
+        }>>;
+        /** AI reviewer sources to wait for before starting the merge grace period */
+        expected_ai_reviewers: z.ZodOptional<z.ZodArray<z.ZodEnum<["cursor", "coderabbit", "copilot", "greptile", "sourcery", "qodo", "codeant", "ellipsis", "korbit", "panto", "bito", "graphite", "deepsource", "snyk", "codacy", "sonarcloud", "sweep", "codeguru", "codereviewer", "codium"]>, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        merge_queue?: boolean | undefined;
+        auto_resolve_conflicts?: boolean | undefined;
+        merge_debounce?: {
+            default_minutes?: number | undefined;
+            authors?: Record<string, number> | undefined;
+        } | undefined;
+        expected_ai_reviewers?: ("cursor" | "coderabbit" | "copilot" | "greptile" | "sourcery" | "qodo" | "codeant" | "ellipsis" | "korbit" | "panto" | "bito" | "graphite" | "deepsource" | "snyk" | "codacy" | "sonarcloud" | "sweep" | "codeguru" | "codereviewer" | "codium")[] | undefined;
+    }, {
+        merge_queue?: boolean | undefined;
+        auto_resolve_conflicts?: boolean | undefined;
+        merge_debounce?: {
+            default_minutes?: number | undefined;
+            authors?: Record<string, number> | undefined;
+        } | undefined;
+        expected_ai_reviewers?: ("cursor" | "coderabbit" | "copilot" | "greptile" | "sourcery" | "qodo" | "codeant" | "ellipsis" | "korbit" | "panto" | "bito" | "graphite" | "deepsource" | "snyk" | "codacy" | "sonarcloud" | "sweep" | "codeguru" | "codereviewer" | "codium")[] | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    version: "1";
+    name?: string | undefined;
+    services?: Record<string, {
+        command: string;
+        type?: "server" | "batch" | undefined;
+        port?: number | undefined;
+        ready_pattern?: string | undefined;
+        env?: Record<string, string> | undefined;
+        root?: string | undefined;
+        depends_on?: string[] | undefined;
+    }> | undefined;
+    package_manager?: "npm" | "pnpm" | "yarn" | "bun" | undefined;
+    dev_server?: {
+        command: string;
+        port: number;
+        ready_pattern?: string | undefined;
+        env?: Record<string, string> | undefined;
+    } | undefined;
+    verification?: {
+        commands?: {
+            name: string;
+            run: string;
+        }[] | undefined;
+        fixtures?: Record<string, {
+            source: string;
+            headers?: Record<string, string> | undefined;
+            cookies?: string | undefined;
+        }> | undefined;
+    } | undefined;
+    auth?: {
+        strategy: "bypass" | "fixture" | "token" | "test_account";
+        env?: Record<string, string> | undefined;
+        fixture?: {
+            source: string;
+            pattern: string;
+        } | undefined;
+        token?: {
+            name: string;
+            type: "cookie" | "localStorage" | "sessionStorage" | "header";
+            secret: string;
+            cookie_options?: {
+                path?: string | undefined;
+                domain?: string | undefined;
+                secure?: boolean | undefined;
+                httpOnly?: boolean | undefined;
+                sameSite?: "Strict" | "Lax" | "None" | undefined;
+            } | undefined;
+        } | undefined;
+        test_account?: {
+            credentials_secret: string;
+            login_flow: {
+                action: "type" | "navigate" | "click" | "wait" | "submit";
+                value?: string | undefined;
+                url?: string | undefined;
+                selector?: string | undefined;
+                timeout?: number | undefined;
+            }[];
+            success_selector?: string | undefined;
+            failure_selector?: string | undefined;
+        } | undefined;
+        fallback?: "bypass" | "fixture" | "token" | "test_account" | undefined;
+    } | undefined;
+    agentic?: {
+        tool?: "opencode" | "claude-code" | "codex" | undefined;
+    } | undefined;
+    database?: {
+        strategy: "fixture" | "memory" | "seed" | "docker" | "remote";
+        env?: Record<string, string> | undefined;
+        fallback?: {
+            strategy: "fixture" | "memory" | "seed" | "docker" | "remote";
+            env?: Record<string, string> | undefined;
+            seed_command?: string | undefined;
+            migrate_command?: string | undefined;
+            services?: {
+                port: number;
+                image: string;
+                env?: Record<string, string> | undefined;
+                health_check?: string | undefined;
+                health_timeout?: number | undefined;
+            }[] | undefined;
+            read_only?: boolean | undefined;
+            ready_timeout?: number | undefined;
+        } | undefined;
+        seed_command?: string | undefined;
+        migrate_command?: string | undefined;
+        services?: {
+            port: number;
+            image: string;
+            env?: Record<string, string> | undefined;
+            health_check?: string | undefined;
+            health_timeout?: number | undefined;
+        }[] | undefined;
+        read_only?: boolean | undefined;
+        ready_timeout?: number | undefined;
+    } | undefined;
+    network?: {
+        allow?: string[] | undefined;
+    } | undefined;
+    secrets?: Record<string, {
+        required?: boolean | undefined;
+        services?: string[] | undefined;
+        description?: string | undefined;
+    }> | undefined;
+    babysitter?: {
+        merge_queue?: boolean | undefined;
+        auto_resolve_conflicts?: boolean | undefined;
+        merge_debounce?: {
+            default_minutes?: number | undefined;
+            authors?: Record<string, number> | undefined;
+        } | undefined;
+        expected_ai_reviewers?: ("cursor" | "coderabbit" | "copilot" | "greptile" | "sourcery" | "qodo" | "codeant" | "ellipsis" | "korbit" | "panto" | "bito" | "graphite" | "deepsource" | "snyk" | "codacy" | "sonarcloud" | "sweep" | "codeguru" | "codereviewer" | "codium")[] | undefined;
+    } | undefined;
+}, {
+    version: "1";
+    name?: string | undefined;
+    services?: Record<string, {
+        command: string;
+        type?: "server" | "batch" | undefined;
+        port?: number | undefined;
+        ready_pattern?: string | undefined;
+        env?: Record<string, string> | undefined;
+        root?: string | undefined;
+        depends_on?: string[] | undefined;
+    }> | undefined;
+    package_manager?: "npm" | "pnpm" | "yarn" | "bun" | undefined;
+    dev_server?: {
+        command: string;
+        port: number;
+        ready_pattern?: string | undefined;
+        env?: Record<string, string> | undefined;
+    } | undefined;
+    verification?: {
+        commands?: {
+            name: string;
+            run: string;
+        }[] | undefined;
+        fixtures?: Record<string, {
+            source: string;
+            headers?: Record<string, string> | undefined;
+            cookies?: string | undefined;
+        }> | undefined;
+    } | undefined;
+    auth?: {
+        env?: Record<string, string> | undefined;
+        fixture?: {
+            source: string;
+            pattern: string;
+        } | undefined;
+        token?: {
+            name: string;
+            type: "cookie" | "localStorage" | "sessionStorage" | "header";
+            secret: string;
+            cookie_options?: {
+                path?: string | undefined;
+                domain?: string | undefined;
+                secure?: boolean | undefined;
+                httpOnly?: boolean | undefined;
+                sameSite?: "Strict" | "Lax" | "None" | undefined;
+            } | undefined;
+        } | undefined;
+        test_account?: {
+            credentials_secret: string;
+            login_flow: {
+                action: "type" | "navigate" | "click" | "wait" | "submit";
+                value?: string | undefined;
+                url?: string | undefined;
+                selector?: string | undefined;
+                timeout?: number | undefined;
+            }[];
+            success_selector?: string | undefined;
+            failure_selector?: string | undefined;
+        } | undefined;
+        strategy?: "bypass" | "fixture" | "token" | "test_account" | undefined;
+        fallback?: "bypass" | "fixture" | "token" | "test_account" | undefined;
+    } | undefined;
+    agentic?: {
+        tool?: "opencode" | "claude-code" | "codex" | undefined;
+    } | undefined;
+    database?: {
+        env?: Record<string, string> | undefined;
+        strategy?: "fixture" | "memory" | "seed" | "docker" | "remote" | undefined;
+        fallback?: {
+            env?: Record<string, string> | undefined;
+            strategy?: "fixture" | "memory" | "seed" | "docker" | "remote" | undefined;
+            seed_command?: string | undefined;
+            migrate_command?: string | undefined;
+            services?: {
+                port: number;
+                image: string;
+                env?: Record<string, string> | undefined;
+                health_check?: string | undefined;
+                health_timeout?: number | undefined;
+            }[] | undefined;
+            read_only?: boolean | undefined;
+            ready_timeout?: number | undefined;
+        } | undefined;
+        seed_command?: string | undefined;
+        migrate_command?: string | undefined;
+        services?: {
+            port: number;
+            image: string;
+            env?: Record<string, string> | undefined;
+            health_check?: string | undefined;
+            health_timeout?: number | undefined;
+        }[] | undefined;
+        read_only?: boolean | undefined;
+        ready_timeout?: number | undefined;
+    } | undefined;
+    network?: {
+        allow?: string[] | undefined;
+    } | undefined;
+    secrets?: Record<string, {
+        required?: boolean | undefined;
+        services?: string[] | undefined;
+        description?: string | undefined;
+    }> | undefined;
+    babysitter?: {
+        merge_queue?: boolean | undefined;
+        auto_resolve_conflicts?: boolean | undefined;
+        merge_debounce?: {
+            default_minutes?: number | undefined;
+            authors?: Record<string, number> | undefined;
+        } | undefined;
+        expected_ai_reviewers?: ("cursor" | "coderabbit" | "copilot" | "greptile" | "sourcery" | "qodo" | "codeant" | "ellipsis" | "korbit" | "panto" | "bito" | "graphite" | "deepsource" | "snyk" | "codacy" | "sonarcloud" | "sweep" | "codeguru" | "codereviewer" | "codium")[] | undefined;
+    } | undefined;
+}>;
+export type HaystackConfig = z.infer<typeof HaystackConfigSchema>;
+export type VerificationCommand = z.infer<typeof VerificationCommandSchema>;
+export type FixtureEntry = z.infer<typeof FixtureEntrySchema>;
+export type DevServer = z.infer<typeof DevServerSchema>;
+export type Service = z.infer<typeof ServiceSchema>;
+export type Verification = z.infer<typeof VerificationSchema>;
+export type AuthStrategy = z.infer<typeof AuthStrategySchema>;
+export type TokenInjection = z.infer<typeof TokenInjectionSchema>;
+export type LoginStep = z.infer<typeof LoginStepSchema>;
+export type TestAccount = z.infer<typeof TestAccountSchema>;
+export type AuthConfig = z.infer<typeof AuthConfigSchema>;
+export type AgenticTool = z.infer<typeof AgenticToolSchema>;
+export type Agentic = z.infer<typeof AgenticSchema>;
+export type DatabaseStrategy = z.infer<typeof DatabaseStrategySchema>;
+export type DockerService = z.infer<typeof DockerServiceSchema>;
+export type DatabaseConfig = z.infer<typeof DatabaseConfigSchema>;
+export type NetworkConfig = z.infer<typeof NetworkConfigSchema>;
+export type SecretDeclaration = z.infer<typeof SecretDeclarationSchema>;
+export type BabysitterConfig = z.infer<typeof BabysitterConfigSchema>;
 /**
  * Project detection results
  */
@@ -266,3 +1461,4 @@ export interface StoredSecret {
     createdAt: string;
     updatedAt: string;
 }
+export {};