# description
Project-level LPM configuration. Sits alongside package.json and provides runtime pinning, env file mapping, task runner config, hosted task cache settings, dev services, local-domain proxy settings, publish targets, and tunnel/HTTPS settings.

# properties.env.description
Env file mapping per script name.
e.g., `{"dev": ".env.development", "staging": ".env.staging"}`

# properties.tasks.description
Task configuration for caching, dependency ordering, and outputs.

# properties.services.description
Dev services for multi-process orchestration.
e.g., `{"web": {"command": "next dev", "port": 3000}}`

# properties.proxy.description
Dev reverse-proxy configuration for friendly local hostnames.

# properties.https.description
Enable local HTTPS for `lpm dev`.
When `true`, `lpm dev` auto-generates and trusts a local certificate.
Overridden by `--no-https` CLI flag.

# properties.tunnel.description
Tunnel configuration for `lpm dev --tunnel`.
e.g., `{"domain": "acme-api.lpm.llc"}`

# properties.publish.description
Publish configuration for multi-registry publishing.
e.g., `{"registries": ["lpm", "npm"], "npm": {"name": "@scope/pkg"}}`

# properties.envSchema.description
Environment variable schema for validation.
Defines required vars, formats, patterns, defaults, and secrets.
e.g., `{"envSchema": {"vars": {"DATABASE_URL": {"required": true, "format": "url"}}}}`

# properties.environments.description
Named environment definitions with inheritance.
e.g., `{"environments": {"staging": {"extends": "base", "file": ".env.staging"}}}`

# properties.cert.description
Local-HTTPS certificate configuration.

`extra_permitted_dns` entries are validated at parse time and can be
consumed by project-scoped certificate-chain generation.

# $defs.TaskConfig.description
Configuration for a single task in `lpm.json`.

# $defs.TaskConfig.properties.command.description
Command to run (overrides package.json scripts).

# $defs.TaskConfig.properties.dependsOn.description
Task dependencies. `"build"` = same package, `"^build"` = upstream workspace deps.

# $defs.TaskConfig.properties.cache.description
Enable local task caching for this task.

# $defs.TaskConfig.properties.outputs.description
Output file globs to cache (e.g., `["dist/**"]`). Required for caching.

# $defs.TaskConfig.properties.inputs.description
Input file globs that invalidate cache (default: `["src/**", "package.json"]`).

# $defs.TaskConfig.properties.env.description
Env mode for this task (e.g., `"development"` → loads `.env.development`).

# $defs.RemoteCacheConfig.description
Hosted cache configuration in `lpm.json`.

# $defs.RemoteCacheConfig.properties.enabled.description
Enable hosted task cache reads and writes for cache-enabled tasks.

# $defs.RemoteCacheConfig.properties.team.description
Organization slug/team namespace. Omit for the authenticated personal namespace.

# $defs.RemoteCacheConfig.properties.url.description
Remote cache service URL. Defaults to the configured LPM registry plus `/v8`.

# $defs.RemoteCacheConfig.properties.signature.description
Require HMAC tags on downloads and attach them to uploads.

# $defs.RemoteCacheConfig.properties.readOnly.description
Read remote artifacts but do not upload newly produced artifacts.

# $defs.RemoteCacheConfig.properties.env.description
Controls which loaded environment variables may be used with remote uploads.

# $defs.RemoteCacheEnvConfig.description
Env safety controls for hosted task cache uploads.

# $defs.RemoteCacheEnvConfig.properties.include.description
Variable-name patterns explicitly allowed for remote uploads.

# $defs.RemoteCacheEnvConfig.properties.exclude.description
Variable-name patterns that block remote uploads.

# $defs.RemoteCacheEnvConfig.properties.allowSecrets.description
Permit secret-looking variable names after explicit project opt-in.

# $defs.ServiceConfig.description
Configuration for a dev service in `lpm.json`.

# $defs.ServiceConfig.properties.port.description
Port this service listens on; omitted host-only services get a stable auto-assigned port.

# $defs.ServiceConfig.properties.dependsOn.description
Services that must be ready before this one starts.

# $defs.ServiceConfig.properties.readyPort.description
TCP port to check for readiness (defaults to `port` if set).

# $defs.ServiceConfig.properties.readyUrl.description
HTTP URL to poll for readiness (2xx = ready).

# $defs.ServiceConfig.properties.readyTimeout.description
Seconds to wait for readiness (default: 30).

# $defs.ServiceConfig.properties.env.description
Extra environment variables for this service.

# $defs.ServiceConfig.properties.restart.description
Auto-restart on crash with exponential backoff.

# $defs.ServiceConfig.properties.primary.description
This is the primary service (receives --https/--tunnel/--network).

# $defs.ServiceConfig.properties.host.description
Friendly local hostname routed to this service by the dev proxy.

# $defs.ServiceConfig.properties.cwd.description
Working directory relative to project root.

# $defs.ProxyConfig.description
Dev reverse-proxy configuration in `lpm.json`.

# $defs.ProxyConfig.properties.host.description
Top-level host routed by the local dev proxy.

# $defs.ProxyConfig.properties.port.description
Listen port for the HTTPS proxy. Defaults to 443.

# $defs.ProxyConfig.properties.httpRedirect.description
Also listen on :80 and redirect to HTTPS. Defaults to true.

# $defs.TunnelConfig.properties.domain.description
Full tunnel domain (e.g., "acme-api.lpm.llc").
Pro/Org only — free users get ephemeral random domains.

# $defs.PublishConfig.description
Publish configuration in `lpm.json`.

Controls which registries `lpm publish` targets and per-registry settings.
CLI flags (`--npm`, `--lpm`) override these values.

# $defs.PublishConfig.properties.registries.description
Target registries. e.g., `["lpm", "npm"]`.
If absent, defaults to `["lpm"]` (backward compatible).

# $defs.LpmPublishConfig.description
LPM registry publish configuration in `lpm.json`.

# $defs.LpmPublishConfig.properties.name.description
Override package name for LPM (must be `@lpm.dev/owner.pkg` format).

# $defs.NpmPublishConfig.properties.name.description
Override package name for npm (e.g., `"@scope/pkg"`).
Required if the package.json name starts with `@lpm.dev/`.

# $defs.NpmPublishConfig.properties.access.description
Access level: `"public"` or `"restricted"`.
Scoped packages default to `"restricted"`, unscoped to `"public"`.

# $defs.NpmPublishConfig.properties.tag.description
dist-tag for the published version (default: `"latest"`).

# $defs.NpmPublishConfig.properties.otpRequired.description
Prompt for OTP before the first publish attempt (saves a round-trip).

# $defs.GithubPublishConfig.description
GitHub Packages publish configuration in `lpm.json`.

# $defs.GithubPublishConfig.properties.name.description
Override package name for GitHub Packages (must be scoped: `@owner/pkg`).

# $defs.GithubPublishConfig.properties.access.description
Access level: `"public"` or `"restricted"`.

# $defs.GitlabPublishConfig.description
GitLab Packages publish configuration in `lpm.json`.

# $defs.GitlabPublishConfig.properties.name.description
Override package name for GitLab Packages.

# $defs.GitlabPublishConfig.properties.access.description
Access level: `"public"` or `"restricted"`.

# $defs.GitlabPublishConfig.properties.projectId.description
GitLab project ID (required for GitLab npm registry URL).

# $defs.EnvSchema.description
The full env schema: a map of variable names to their rules.

Deserialized from `lpm.json`:
```json
{ "env": { "schema": { "DATABASE_URL": { "required": true, "format": "url" } } } }
```

# $defs.EnvVarRule.description
Validation rules for a single environment variable.

# $defs.EnvVarRule.properties.required.description
Whether the variable must be set and non-empty.

# $defs.EnvVarRule.properties.default.description
Default value if not set (injected at runtime, not written to files).

# $defs.EnvVarRule.properties.secret.description
Whether this variable contains sensitive data (redacted in logs).

# $defs.EnvVarRule.properties.client.description
Whether this variable is safe for client-side exposure.

# $defs.EnvVarRule.properties.description.description
Human-readable description (shown in error messages and .env.example).

# $defs.VarFormat.description
Built-in format validators for common value types.

# $defs.EnvironmentsConfig.description
Named environment definitions with optional inheritance.

Deserialized from `lpm.json`:
```json
{ "environments": { "staging": { "extends": "base", "file": ".env.staging" } } }
```

# $defs.EnvDefinition.description
A single environment definition — either a file path string or a structured object.

# $defs.EnvDefinition.anyOf[].description
Simple: just a file path (e.g., `"base": ".env"`)

# $defs.EnvDefinition.anyOf[].description
Structured: with optional extends and file

# $defs.EnvDefinition.anyOf[].properties.file.description
The .env file for this environment (optional — may inherit everything).

# $defs.CertBlock.description
`cert` configuration block in `lpm.json`.

# $defs.CertBlock.properties.extraPermittedDns.description
Additional DNS subtrees the project-scoped intermediate may permit.
Each entry must be a bare multi-label hostname. Wildcards, leading dots,
and non-local TLDs are rejected at parse time.

# $defs.CertBlock.properties.allowPublicDns.description
Permit non-local TLDs (e.g. `staging.example.com`) in
`extraPermittedDns`. Off by default — public-internet hostnames widen
the CA's authority and require explicit opt-in.