@geekmidas/cli 1.10.29 → 1.10.31

package/dist/sniffer-CBhzByiY.cjs

@@ -0,0 +1,386 @@
+const require_chunk = require('./chunk-CUT6urMc.cjs');
+const require_client_generator = require('./client-generator-D-T4ypQo.cjs');
+const node_fs = require_chunk.__toESM(require("node:fs"));
+const node_path = require_chunk.__toESM(require("node:path"));
+const node_child_process = require_chunk.__toESM(require("node:child_process"));
+const node_module = require_chunk.__toESM(require("node:module"));
+const node_url = require_chunk.__toESM(require("node:url"));
+
+//#region src/deploy/sniffer.ts
+const __filename$1 = (0, node_url.fileURLToPath)(require("url").pathToFileURL(__filename).href);
+const __dirname$1 = (0, node_path.dirname)(__filename$1);
+/**
+* Resolve the tsx package path from the CLI package's dependencies.
+* This ensures tsx is available regardless of whether the target project has it installed.
+*/
+function resolveTsxPath() {
+	const require$1 = (0, node_module.createRequire)(require("url").pathToFileURL(__filename).href);
+	return require$1.resolve("tsx");
+}
+/**
+* Resolve the path to a sniffer helper file.
+* Handles both dev (.ts with tsx) and production (.mjs from dist).
+*
+* In production: sniffer.ts is bundled into dist/index.mjs, but sniffer helper
+* files are output to dist/deploy/ as standalone modules for subprocess loading.
+*
+* In development: All files are in src/deploy/ and loaded via tsx.
+*/
+function resolveSnifferFile(baseName) {
+	const deployMjsPath = (0, node_path.resolve)(__dirname$1, "deploy", `${baseName}.mjs`);
+	if ((0, node_fs.existsSync)(deployMjsPath)) return deployMjsPath;
+	const mjsPath = (0, node_path.resolve)(__dirname$1, `${baseName}.mjs`);
+	if ((0, node_fs.existsSync)(mjsPath)) return mjsPath;
+	const tsPath = (0, node_path.resolve)(__dirname$1, `${baseName}.ts`);
+	if ((0, node_fs.existsSync)(tsPath)) return tsPath;
+	return tsPath;
+}
+/**
+* Get required environment variables for an app.
+*
+* Detection strategy (in order):
+* 1. Frontend apps: Returns empty (no server secrets)
+* 2. Apps with `requiredEnv`: Uses explicit list from config
+* 3. Entry apps: Imports entry file in subprocess to capture config.parse() calls
+* 4. Route-based apps: Loads route files and calls getEnvironment() on each construct
+* 5. Apps with `envParser` (no routes): Runs SnifferEnvironmentParser to detect usage
+* 6. Apps with neither: Returns empty
+*
+* This function handles "fire and forget" async operations gracefully,
+* capturing errors and unhandled rejections without failing the build.
+*
+* @param app - The normalized app configuration
+* @param appName - The name of the app
+* @param workspacePath - Absolute path to the workspace root
+* @param options - Optional configuration for sniffing behavior
+* @returns The sniffed environment with required variables
+*/
+async function sniffAppEnvironment(app, appName, workspacePath, options = {}) {
+	const { logWarnings = true, markOptional = false } = options;
+	if (app.type === "frontend") {
+		const depVars = (app.dependencies ?? []).map((dep) => `NEXT_PUBLIC_${dep.toUpperCase()}_URL`);
+		if (app.config) {
+			const sniffedVars = [];
+			const sniffedOptional = [];
+			const configPaths = [];
+			if (app.config.client) configPaths.push(app.config.client);
+			if (app.config.server) configPaths.push(app.config.server);
+			for (const configPath of configPaths) {
+				const result = await sniffEntryFile(configPath, app.path, workspacePath);
+				if (logWarnings && result.error) console.warn(`[sniffer] ${appName}: Config file "${configPath}" threw error during sniffing (env vars still captured): ${result.error.message}`);
+				sniffedVars.push(...result.envVars);
+				sniffedOptional.push(...result.optionalEnvVars);
+			}
+			const optionalEnvVars = [...new Set(sniffedOptional)];
+			const allVars = applyMarkOptional([...new Set([...depVars, ...sniffedVars])], optionalEnvVars, markOptional);
+			return {
+				appName,
+				requiredEnvVars: allVars,
+				optionalEnvVars
+			};
+		}
+		return {
+			appName,
+			requiredEnvVars: depVars,
+			optionalEnvVars: []
+		};
+	}
+	if (app.entry) {
+		const result = await sniffEntryFile(app.entry, app.path, workspacePath);
+		if (logWarnings && result.error) console.warn(`[sniffer] ${appName}: Entry file threw error during sniffing (env vars still captured): ${result.error.message}`);
+		return {
+			appName,
+			requiredEnvVars: applyMarkOptional(result.envVars, result.optionalEnvVars, markOptional),
+			optionalEnvVars: result.optionalEnvVars
+		};
+	}
+	if (app.routes) {
+		const result = await sniffRouteFiles(require_client_generator.normalizeRoutes(app.routes), app.path, workspacePath);
+		if (logWarnings && result.error) console.warn(`[sniffer] ${appName}: Route sniffing threw error (env vars still captured): ${result.error.message}`);
+		return {
+			appName,
+			requiredEnvVars: applyMarkOptional(result.envVars, result.optionalEnvVars, markOptional),
+			optionalEnvVars: result.optionalEnvVars
+		};
+	}
+	if (app.envParser) {
+		const result = await sniffEnvParser(app.envParser, app.path, workspacePath);
+		if (logWarnings) {
+			if (result.error) console.warn(`[sniffer] ${appName}: envParser threw error during sniffing (env vars still captured): ${result.error.message}`);
+			if (result.unhandledRejections.length > 0) console.warn(`[sniffer] ${appName}: Fire-and-forget rejections during sniffing (suppressed): ${result.unhandledRejections.map((e) => e.message).join(", ")}`);
+		}
+		return {
+			appName,
+			requiredEnvVars: applyMarkOptional(result.envVars, result.optionalEnvVars, markOptional),
+			optionalEnvVars: result.optionalEnvVars
+		};
+	}
+	return {
+		appName,
+		requiredEnvVars: [],
+		optionalEnvVars: []
+	};
+}
+/**
+* Apply the `?` suffix to optional variables in an env var list.
+* Only modifies the list when `markOptional` is true and there are optional vars.
+*/
+function applyMarkOptional(envVars, optionalEnvVars, markOptional) {
+	if (!markOptional || optionalEnvVars.length === 0) return envVars;
+	const optionalSet = new Set(optionalEnvVars);
+	return envVars.map((v) => optionalSet.has(v) ? `${v}?` : v);
+}
+/**
+* Sniff an entry file by importing it in a subprocess.
+*
+* Entry apps call `config.parse()` at module load time. To capture which
+* env vars are accessed, we:
+* 1. Spawn a subprocess with a module loader hook
+* 2. The loader intercepts `@geekmidas/envkit` and replaces EnvironmentParser
+*    with SnifferEnvironmentParser
+* 3. Import the entry file (triggers config.parse())
+* 4. Capture and return the accessed env var names
+*
+* This approach provides process isolation - each app is sniffed in its own
+* subprocess, preventing module cache pollution.
+*
+* @param entryPath - Relative path to the entry file (e.g., './src/index.ts')
+* @param appPath - The app's path relative to workspace (e.g., 'apps/auth')
+* @param workspacePath - Absolute path to workspace root
+* @returns EntrySniffResult with env vars and optional error
+*/
+async function sniffEntryFile(entryPath, appPath, workspacePath) {
+	const fullEntryPath = (0, node_path.resolve)(workspacePath, appPath, entryPath);
+	const loaderPath = resolveSnifferFile("sniffer-loader");
+	const workerPath = resolveSnifferFile("sniffer-worker");
+	return new Promise((resolvePromise) => {
+		const child = (0, node_child_process.spawn)("node", [
+			"--import",
+			loaderPath,
+			workerPath,
+			fullEntryPath
+		], {
+			cwd: (0, node_path.resolve)(workspacePath, appPath),
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			env: {
+				...process.env,
+				NODE_OPTIONS: "--import=tsx"
+			}
+		});
+		let stdout = "";
+		let stderr = "";
+		child.stdout.on("data", (data) => {
+			stdout += data.toString();
+		});
+		child.stderr.on("data", (data) => {
+			stderr += data.toString();
+		});
+		child.on("close", (code) => {
+			try {
+				const jsonMatch = stdout.match(/\{[^{}]*"envVars"[^{}]*\}[^{]*$/);
+				if (jsonMatch) {
+					const result = JSON.parse(jsonMatch[0]);
+					resolvePromise({
+						envVars: result.envVars || [],
+						optionalEnvVars: result.optionalEnvVars || [],
+						error: result.error ? new Error(result.error) : void 0
+					});
+					return;
+				}
+			} catch {}
+			resolvePromise({
+				envVars: [],
+				optionalEnvVars: [],
+				error: new Error(`Failed to sniff entry file (exit code ${code}): ${stderr || stdout || "No output"}`)
+			});
+		});
+		child.on("error", (err) => {
+			resolvePromise({
+				envVars: [],
+				optionalEnvVars: [],
+				error: err
+			});
+		});
+	});
+}
+/**
+* Sniff route files by loading constructs and calling getEnvironment().
+*
+* Route-based apps have endpoints, functions, crons, and subscribers that
+* use services. Each service's register() method accesses environment variables.
+*
+* This runs in a subprocess with tsx loader to properly handle TypeScript
+* compilation and path alias resolution (e.g., `src/...` imports).
+*
+* @param routes - Glob pattern(s) for route files
+* @param appPath - The app's path relative to workspace (e.g., 'apps/api')
+* @param workspacePath - Absolute path to workspace root
+* @returns EntrySniffResult with env vars and optional error
+*/
+async function sniffRouteFiles(routes, appPath, workspacePath) {
+	const fullAppPath = (0, node_path.resolve)(workspacePath, appPath);
+	const workerPath = resolveSnifferFile("sniffer-routes-worker");
+	const tsxPath = resolveTsxPath();
+	const routesArray = Array.isArray(routes) ? routes : [routes];
+	const pattern = routesArray[0];
+	if (!pattern) return {
+		envVars: [],
+		optionalEnvVars: [],
+		error: new Error("No route patterns provided")
+	};
+	return new Promise((resolvePromise) => {
+		const child = (0, node_child_process.spawn)("node", [
+			"--import",
+			tsxPath,
+			workerPath,
+			fullAppPath,
+			pattern
+		], {
+			cwd: fullAppPath,
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			env: { ...process.env }
+		});
+		let stdout = "";
+		let stderr = "";
+		child.stdout.on("data", (data) => {
+			stdout += data.toString();
+		});
+		child.stderr.on("data", (data) => {
+			stderr += data.toString();
+		});
+		child.on("close", (code) => {
+			if (stderr) stderr.split("\n").filter((line) => line.trim()).forEach((line) => console.warn(line));
+			try {
+				const jsonMatch = stdout.match(/\{[^{}]*"envVars"[^{}]*\}[^{]*$/);
+				if (jsonMatch) {
+					const result = JSON.parse(jsonMatch[0]);
+					resolvePromise({
+						envVars: result.envVars || [],
+						optionalEnvVars: result.optionalEnvVars || [],
+						error: result.error ? new Error(result.error) : void 0
+					});
+					return;
+				}
+			} catch {}
+			resolvePromise({
+				envVars: [],
+				optionalEnvVars: [],
+				error: new Error(`Failed to sniff route files (exit code ${code}): ${stderr || stdout || "No output"}`)
+			});
+		});
+		child.on("error", (err) => {
+			resolvePromise({
+				envVars: [],
+				optionalEnvVars: [],
+				error: err
+			});
+		});
+	});
+}
+/**
+* Run the SnifferEnvironmentParser on an envParser module to detect
+* which environment variables it accesses.
+*
+* This function handles "fire and forget" async operations by using
+* the shared sniffWithFireAndForget utility from @geekmidas/envkit.
+*
+* @param envParserPath - The envParser config (e.g., './src/config/env#envParser')
+* @param appPath - The app's path relative to workspace
+* @param workspacePath - Absolute path to workspace root
+* @returns SniffResult with env vars and any errors encountered
+*/
+async function sniffEnvParser(envParserPath, appPath, workspacePath) {
+	const [modulePath, exportName = "default"] = envParserPath.split("#");
+	if (!modulePath) return {
+		envVars: [],
+		optionalEnvVars: [],
+		unhandledRejections: []
+	};
+	const fullPath = (0, node_path.resolve)(workspacePath, appPath, modulePath);
+	let SnifferEnvironmentParser;
+	let sniffWithFireAndForget;
+	try {
+		const envkitModule = await import("@geekmidas/envkit/sniffer");
+		SnifferEnvironmentParser = envkitModule.SnifferEnvironmentParser;
+		sniffWithFireAndForget = envkitModule.sniffWithFireAndForget;
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		console.warn(`[sniffer] Failed to import SnifferEnvironmentParser: ${message}`);
+		return {
+			envVars: [],
+			optionalEnvVars: [],
+			unhandledRejections: []
+		};
+	}
+	const sniffer = new SnifferEnvironmentParser();
+	return sniffWithFireAndForget(sniffer, async () => {
+		const moduleUrl = (0, node_url.pathToFileURL)(fullPath).href;
+		const module$1 = await import(moduleUrl);
+		const envParser = module$1[exportName];
+		if (typeof envParser !== "function") {
+			console.warn(`[sniffer] Export "${exportName}" from "${modulePath}" is not a function`);
+			return;
+		}
+		const result = envParser(sniffer);
+		if (result && typeof result.parse === "function") try {
+			result.parse();
+		} catch {}
+	});
+}
+/**
+* Sniff environment requirements for multiple apps.
+*
+* @param apps - Map of app name to app config
+* @param workspacePath - Absolute path to workspace root
+* @param options - Optional configuration for sniffing behavior
+* @returns Map of app name to sniffed environment
+*/
+async function sniffAllApps(apps, workspacePath, options = {}) {
+	const results = /* @__PURE__ */ new Map();
+	for (const [appName, app] of Object.entries(apps)) {
+		const sniffed = await sniffAppEnvironment(app, appName, workspacePath, options);
+		results.set(appName, sniffed);
+	}
+	return results;
+}
+
+//#endregion
+Object.defineProperty(exports, 'sniffAllApps', {
+  enumerable: true,
+  get: function () {
+    return sniffAllApps;
+  }
+});
+Object.defineProperty(exports, 'sniffAppEnvironment', {
+  enumerable: true,
+  get: function () {
+    return sniffAppEnvironment;
+  }
+});
+Object.defineProperty(exports, 'sniffEntryFile', {
+  enumerable: true,
+  get: function () {
+    return sniffEntryFile;
+  }
+});
+Object.defineProperty(exports, 'sniffEnvParser', {
+  enumerable: true,
+  get: function () {
+    return sniffEnvParser;
+  }
+});
+Object.defineProperty(exports, 'sniffRouteFiles', {
+  enumerable: true,
+  get: function () {
+    return sniffRouteFiles;
+  }
+});
+//# sourceMappingURL=sniffer-CBhzByiY.cjs.map

package/dist/sniffer-CBhzByiY.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sniffer-CBhzByiY.cjs","names":["__filename","__dirname","require","baseName: string","app: NormalizedAppConfig","appName: string","workspacePath: string","options: SniffAppOptions","sniffedVars: string[]","sniffedOptional: string[]","configPaths: string[]","envVars: string[]","optionalEnvVars: string[]","markOptional: boolean","entryPath: string","appPath: string","routes: string | string[]","envParserPath: string","SnifferEnvironmentParser: any","sniffWithFireAndForget: any","module","apps: Record<string, NormalizedAppConfig>"],"sources":["../src/deploy/sniffer.ts"],"sourcesContent":["import { spawn } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport { createRequire } from 'node:module';\nimport { dirname, resolve } from 'node:path';\nimport { fileURLToPath, pathToFileURL } from 'node:url';\nimport type { SniffResult } from '@geekmidas/envkit/sniffer';\nimport { normalizeRoutes } from '../workspace/client-generator.js';\nimport type { NormalizedAppConfig } from '../workspace/types.js';\n\nconst __filename = fileURLToPath(import.meta.url);\nconst __dirname = dirname(__filename);\n\n/**\n * Resolve the tsx package path from the CLI package's dependencies.\n * This ensures tsx is available regardless of whether the target project has it installed.\n */\nfunction resolveTsxPath(): string {\n\tconst require = createRequire(import.meta.url);\n\treturn require.resolve('tsx');\n}\n\n/**\n * Resolve the path to a sniffer helper file.\n * Handles both dev (.ts with tsx) and production (.mjs from dist).\n *\n * In production: sniffer.ts is bundled into dist/index.mjs, but sniffer helper\n * files are output to dist/deploy/ as standalone modules for subprocess loading.\n *\n * In development: All files are in src/deploy/ and loaded via tsx.\n */\nfunction resolveSnifferFile(baseName: string): string {\n\t// Try deploy/ subdirectory first (production: bundled code is at dist/index.mjs,\n\t// but sniffer files are at dist/deploy/)\n\tconst deployMjsPath = resolve(__dirname, 'deploy', `${baseName}.mjs`);\n\tif (existsSync(deployMjsPath)) {\n\t\treturn deployMjsPath;\n\t}\n\n\t// Try same directory .mjs (production: if running from dist/deploy/ directly)\n\tconst mjsPath = resolve(__dirname, `${baseName}.mjs`);\n\tif (existsSync(mjsPath)) {\n\t\treturn mjsPath;\n\t}\n\n\t// Try same directory .ts (development with tsx: all files in src/deploy/)\n\tconst tsPath = resolve(__dirname, `${baseName}.ts`);\n\tif (existsSync(tsPath)) {\n\t\treturn tsPath;\n\t}\n\n\t// Fallback to .ts (will error if neither exists)\n\treturn tsPath;\n}\n\n// Re-export SniffResult for consumers\nexport type { SniffResult } from '@geekmidas/envkit/sniffer';\n\n/**\n * Result of sniffing an app's environment requirements.\n */\nexport interface SniffedEnvironment {\n\tappName: string;\n\t/**\n\t * All required environment variable names.\n\t * When `SniffAppOptions.markOptional` is true, optional variables are\n\t * suffixed with `?` (e.g. `PORT?`).\n\t */\n\trequiredEnvVars: string[];\n\t/**\n\t * Subset of variables that are optional (accessed via `.optional()` or\n\t * `.default()`). Always populated regardless of `markOptional`.\n\t */\n\toptionalEnvVars: string[];\n}\n\n/**\n * Options for sniffing an app's environment.\n */\nexport interface SniffAppOptions {\n\t/** Whether to log warnings for errors encountered during sniffing. Defaults to true. */\n\tlogWarnings?: boolean;\n\t/**\n\t * When true, optional variables (those with `.optional()` or `.default()`)\n\t * are suffixed with `?` in `requiredEnvVars` (e.g. `PORT?`).\n\t * Defaults to false.\n\t */\n\tmarkOptional?: boolean;\n}\n\n/**\n * Get required environment variables for an app.\n *\n * Detection strategy (in order):\n * 1. Frontend apps: Returns empty (no server secrets)\n * 2. Apps with `requiredEnv`: Uses explicit list from config\n * 3. Entry apps: Imports entry file in subprocess to capture config.parse() calls\n * 4. Route-based apps: Loads route files and calls getEnvironment() on each construct\n * 5. Apps with `envParser` (no routes): Runs SnifferEnvironmentParser to detect usage\n * 6. Apps with neither: Returns empty\n *\n * This function handles \"fire and forget\" async operations gracefully,\n * capturing errors and unhandled rejections without failing the build.\n *\n * @param app - The normalized app configuration\n * @param appName - The name of the app\n * @param workspacePath - Absolute path to the workspace root\n * @param options - Optional configuration for sniffing behavior\n * @returns The sniffed environment with required variables\n */\nexport async function sniffAppEnvironment(\n\tapp: NormalizedAppConfig,\n\tappName: string,\n\tworkspacePath: string,\n\toptions: SniffAppOptions = {},\n): Promise<SniffedEnvironment> {\n\tconst { logWarnings = true, markOptional = false } = options;\n\n\t// 1. Frontend apps - handle dependencies and config sniffing\n\tif (app.type === 'frontend') {\n\t\t// Auto-generate NEXT_PUBLIC_{DEP}_URL from dependencies\n\t\tconst depVars = (app.dependencies ?? []).map(\n\t\t\t(dep) => `NEXT_PUBLIC_${dep.toUpperCase()}_URL`,\n\t\t);\n\n\t\t// If config specified, sniff by importing the file(s)\n\t\t// The file calls .parse() at module load, which triggers sniffer to capture vars\n\t\tif (app.config) {\n\t\t\tconst sniffedVars: string[] = [];\n\t\t\tconst sniffedOptional: string[] = [];\n\n\t\t\t// Collect config paths to sniff\n\t\t\tconst configPaths: string[] = [];\n\t\t\tif (app.config.client) configPaths.push(app.config.client);\n\t\t\tif (app.config.server) configPaths.push(app.config.server);\n\n\t\t\t// Sniff each config file\n\t\t\tfor (const configPath of configPaths) {\n\t\t\t\tconst result = await sniffEntryFile(\n\t\t\t\t\tconfigPath,\n\t\t\t\t\tapp.path,\n\t\t\t\t\tworkspacePath,\n\t\t\t\t);\n\n\t\t\t\tif (logWarnings && result.error) {\n\t\t\t\t\tconsole.warn(\n\t\t\t\t\t\t`[sniffer] ${appName}: Config file \"${configPath}\" threw error during sniffing (env vars still captured): ${result.error.message}`,\n\t\t\t\t\t);\n\t\t\t\t}\n\n\t\t\t\tsniffedVars.push(...result.envVars);\n\t\t\t\tsniffedOptional.push(...result.optionalEnvVars);\n\t\t\t}\n\n\t\t\tconst optionalEnvVars = [...new Set(sniffedOptional)];\n\t\t\t// Combine: dependency vars + sniffed vars (deduplicated)\n\t\t\tconst allVars = applyMarkOptional(\n\t\t\t\t[...new Set([...depVars, ...sniffedVars])],\n\t\t\t\toptionalEnvVars,\n\t\t\t\tmarkOptional,\n\t\t\t);\n\t\t\treturn { appName, requiredEnvVars: allVars, optionalEnvVars };\n\t\t}\n\n\t\treturn { appName, requiredEnvVars: depVars, optionalEnvVars: [] };\n\t}\n\n\t// 2. Entry apps - import entry file in subprocess to trigger config.parse()\n\tif (app.entry) {\n\t\tconst result = await sniffEntryFile(app.entry, app.path, workspacePath);\n\n\t\tif (logWarnings && result.error) {\n\t\t\tconsole.warn(\n\t\t\t\t`[sniffer] ${appName}: Entry file threw error during sniffing (env vars still captured): ${result.error.message}`,\n\t\t\t);\n\t\t}\n\n\t\treturn {\n\t\t\tappName,\n\t\t\trequiredEnvVars: applyMarkOptional(\n\t\t\t\tresult.envVars,\n\t\t\t\tresult.optionalEnvVars,\n\t\t\t\tmarkOptional,\n\t\t\t),\n\t\t\toptionalEnvVars: result.optionalEnvVars,\n\t\t};\n\t}\n\n\t// 4. Route-based apps - load routes and call getEnvironment() on each construct\n\tif (app.routes) {\n\t\tconst result = await sniffRouteFiles(\n\t\t\tnormalizeRoutes(app.routes),\n\t\t\tapp.path,\n\t\t\tworkspacePath,\n\t\t);\n\n\t\tif (logWarnings && result.error) {\n\t\t\tconsole.warn(\n\t\t\t\t`[sniffer] ${appName}: Route sniffing threw error (env vars still captured): ${result.error.message}`,\n\t\t\t);\n\t\t}\n\n\t\treturn {\n\t\t\tappName,\n\t\t\trequiredEnvVars: applyMarkOptional(\n\t\t\t\tresult.envVars,\n\t\t\t\tresult.optionalEnvVars,\n\t\t\t\tmarkOptional,\n\t\t\t),\n\t\t\toptionalEnvVars: result.optionalEnvVars,\n\t\t};\n\t}\n\n\t// 5. Apps with envParser but no routes - run sniffer to detect env var usage\n\tif (app.envParser) {\n\t\tconst result = await sniffEnvParser(app.envParser, app.path, workspacePath);\n\n\t\t// Log any issues for debugging\n\t\tif (logWarnings) {\n\t\t\tif (result.error) {\n\t\t\t\tconsole.warn(\n\t\t\t\t\t`[sniffer] ${appName}: envParser threw error during sniffing (env vars still captured): ${result.error.message}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (result.unhandledRejections.length > 0) {\n\t\t\t\tconsole.warn(\n\t\t\t\t\t`[sniffer] ${appName}: Fire-and-forget rejections during sniffing (suppressed): ${result.unhandledRejections.map((e) => e.message).join(', ')}`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\treturn {\n\t\t\tappName,\n\t\t\trequiredEnvVars: applyMarkOptional(\n\t\t\t\tresult.envVars,\n\t\t\t\tresult.optionalEnvVars,\n\t\t\t\tmarkOptional,\n\t\t\t),\n\t\t\toptionalEnvVars: result.optionalEnvVars,\n\t\t};\n\t}\n\n\t// No env detection method available\n\treturn { appName, requiredEnvVars: [], optionalEnvVars: [] };\n}\n\n/**\n * Apply the `?` suffix to optional variables in an env var list.\n * Only modifies the list when `markOptional` is true and there are optional vars.\n */\nfunction applyMarkOptional(\n\tenvVars: string[],\n\toptionalEnvVars: string[],\n\tmarkOptional: boolean,\n): string[] {\n\tif (!markOptional || optionalEnvVars.length === 0) return envVars;\n\tconst optionalSet = new Set(optionalEnvVars);\n\treturn envVars.map((v) => (optionalSet.has(v) ? `${v}?` : v));\n}\n\n/**\n * Result from sniffing an entry file.\n */\ninterface EntrySniffResult {\n\tenvVars: string[];\n\toptionalEnvVars: string[];\n\terror?: Error;\n}\n\n/**\n * Sniff an entry file by importing it in a subprocess.\n *\n * Entry apps call `config.parse()` at module load time. To capture which\n * env vars are accessed, we:\n * 1. Spawn a subprocess with a module loader hook\n * 2. The loader intercepts `@geekmidas/envkit` and replaces EnvironmentParser\n *    with SnifferEnvironmentParser\n * 3. Import the entry file (triggers config.parse())\n * 4. Capture and return the accessed env var names\n *\n * This approach provides process isolation - each app is sniffed in its own\n * subprocess, preventing module cache pollution.\n *\n * @param entryPath - Relative path to the entry file (e.g., './src/index.ts')\n * @param appPath - The app's path relative to workspace (e.g., 'apps/auth')\n * @param workspacePath - Absolute path to workspace root\n * @returns EntrySniffResult with env vars and optional error\n */\nasync function sniffEntryFile(\n\tentryPath: string,\n\tappPath: string,\n\tworkspacePath: string,\n): Promise<EntrySniffResult> {\n\tconst fullEntryPath = resolve(workspacePath, appPath, entryPath);\n\tconst loaderPath = resolveSnifferFile('sniffer-loader');\n\tconst workerPath = resolveSnifferFile('sniffer-worker');\n\n\treturn new Promise((resolvePromise) => {\n\t\tconst child = spawn(\n\t\t\t'node',\n\t\t\t['--import', loaderPath, workerPath, fullEntryPath],\n\t\t\t{\n\t\t\t\tcwd: resolve(workspacePath, appPath),\n\t\t\t\tstdio: ['ignore', 'pipe', 'pipe'],\n\t\t\t\tenv: {\n\t\t\t\t\t...process.env,\n\t\t\t\t\t// Ensure tsx is available for TypeScript entry files\n\t\t\t\t\tNODE_OPTIONS: '--import=tsx',\n\t\t\t\t},\n\t\t\t},\n\t\t);\n\n\t\tlet stdout = '';\n\t\tlet stderr = '';\n\n\t\tchild.stdout.on('data', (data) => {\n\t\t\tstdout += data.toString();\n\t\t});\n\n\t\tchild.stderr.on('data', (data) => {\n\t\t\tstderr += data.toString();\n\t\t});\n\n\t\tchild.on('close', (code) => {\n\t\t\t// Try to parse the JSON output from the worker\n\t\t\ttry {\n\t\t\t\t// Find the last JSON object in stdout (worker may emit other output)\n\t\t\t\tconst jsonMatch = stdout.match(/\\{[^{}]*\"envVars\"[^{}]*\\}[^{]*$/);\n\t\t\t\tif (jsonMatch) {\n\t\t\t\t\tconst result = JSON.parse(jsonMatch[0]);\n\t\t\t\t\tresolvePromise({\n\t\t\t\t\t\tenvVars: result.envVars || [],\n\t\t\t\t\t\toptionalEnvVars: result.optionalEnvVars || [],\n\t\t\t\t\t\terror: result.error ? new Error(result.error) : undefined,\n\t\t\t\t\t});\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t} catch {\n\t\t\t\t// JSON parse failed\n\t\t\t}\n\n\t\t\t// If we couldn't parse the output, return empty with error info\n\t\t\tresolvePromise({\n\t\t\t\tenvVars: [],\n\t\t\t\toptionalEnvVars: [],\n\t\t\t\terror: new Error(\n\t\t\t\t\t`Failed to sniff entry file (exit code ${code}): ${stderr || stdout || 'No output'}`,\n\t\t\t\t),\n\t\t\t});\n\t\t});\n\n\t\tchild.on('error', (err) => {\n\t\t\tresolvePromise({\n\t\t\t\tenvVars: [],\n\t\t\t\toptionalEnvVars: [],\n\t\t\t\terror: err,\n\t\t\t});\n\t\t});\n\t});\n}\n\n/**\n * Sniff route files by loading constructs and calling getEnvironment().\n *\n * Route-based apps have endpoints, functions, crons, and subscribers that\n * use services. Each service's register() method accesses environment variables.\n *\n * This runs in a subprocess with tsx loader to properly handle TypeScript\n * compilation and path alias resolution (e.g., `src/...` imports).\n *\n * @param routes - Glob pattern(s) for route files\n * @param appPath - The app's path relative to workspace (e.g., 'apps/api')\n * @param workspacePath - Absolute path to workspace root\n * @returns EntrySniffResult with env vars and optional error\n */\nasync function sniffRouteFiles(\n\troutes: string | string[],\n\tappPath: string,\n\tworkspacePath: string,\n): Promise<EntrySniffResult> {\n\tconst fullAppPath = resolve(workspacePath, appPath);\n\tconst workerPath = resolveSnifferFile('sniffer-routes-worker');\n\tconst tsxPath = resolveTsxPath();\n\n\t// Convert array of patterns to first pattern (worker handles glob internally)\n\tconst routesArray = Array.isArray(routes) ? routes : [routes];\n\tconst pattern = routesArray[0];\n\tif (!pattern) {\n\t\treturn {\n\t\t\tenvVars: [],\n\t\t\toptionalEnvVars: [],\n\t\t\terror: new Error('No route patterns provided'),\n\t\t};\n\t}\n\n\treturn new Promise((resolvePromise) => {\n\t\tconst child = spawn(\n\t\t\t'node',\n\t\t\t['--import', tsxPath, workerPath, fullAppPath, pattern],\n\t\t\t{\n\t\t\t\tcwd: fullAppPath,\n\t\t\t\tstdio: ['ignore', 'pipe', 'pipe'],\n\t\t\t\tenv: {\n\t\t\t\t\t...process.env,\n\t\t\t\t},\n\t\t\t},\n\t\t);\n\n\t\tlet stdout = '';\n\t\tlet stderr = '';\n\n\t\tchild.stdout.on('data', (data) => {\n\t\t\tstdout += data.toString();\n\t\t});\n\n\t\tchild.stderr.on('data', (data) => {\n\t\t\tstderr += data.toString();\n\t\t});\n\n\t\tchild.on('close', (code) => {\n\t\t\t// Log any stderr output (import errors, etc.)\n\t\t\tif (stderr) {\n\t\t\t\tstderr\n\t\t\t\t\t.split('\\n')\n\t\t\t\t\t.filter((line) => line.trim())\n\t\t\t\t\t.forEach((line) => console.warn(line));\n\t\t\t}\n\n\t\t\t// Try to parse the JSON output from the worker\n\t\t\ttry {\n\t\t\t\t// Find the last JSON object in stdout (worker may emit other output)\n\t\t\t\tconst jsonMatch = stdout.match(/\\{[^{}]*\"envVars\"[^{}]*\\}[^{]*$/);\n\t\t\t\tif (jsonMatch) {\n\t\t\t\t\tconst result = JSON.parse(jsonMatch[0]);\n\t\t\t\t\tresolvePromise({\n\t\t\t\t\t\tenvVars: result.envVars || [],\n\t\t\t\t\t\t// Routes worker uses getEnvironment() which doesn't track\n\t\t\t\t\t\t// optionality yet — populated when service register() is sniffed\n\t\t\t\t\t\toptionalEnvVars: result.optionalEnvVars || [],\n\t\t\t\t\t\terror: result.error ? new Error(result.error) : undefined,\n\t\t\t\t\t});\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t} catch {\n\t\t\t\t// JSON parse failed\n\t\t\t}\n\n\t\t\t// If we couldn't parse the output, return empty with error info\n\t\t\tresolvePromise({\n\t\t\t\tenvVars: [],\n\t\t\t\toptionalEnvVars: [],\n\t\t\t\terror: new Error(\n\t\t\t\t\t`Failed to sniff route files (exit code ${code}): ${stderr || stdout || 'No output'}`,\n\t\t\t\t),\n\t\t\t});\n\t\t});\n\n\t\tchild.on('error', (err) => {\n\t\t\tresolvePromise({\n\t\t\t\tenvVars: [],\n\t\t\t\toptionalEnvVars: [],\n\t\t\t\terror: err,\n\t\t\t});\n\t\t});\n\t});\n}\n\n/**\n * Run the SnifferEnvironmentParser on an envParser module to detect\n * which environment variables it accesses.\n *\n * This function handles \"fire and forget\" async operations by using\n * the shared sniffWithFireAndForget utility from @geekmidas/envkit.\n *\n * @param envParserPath - The envParser config (e.g., './src/config/env#envParser')\n * @param appPath - The app's path relative to workspace\n * @param workspacePath - Absolute path to workspace root\n * @returns SniffResult with env vars and any errors encountered\n */\nasync function sniffEnvParser(\n\tenvParserPath: string,\n\tappPath: string,\n\tworkspacePath: string,\n): Promise<SniffResult> {\n\t// Parse the envParser path: './src/config/env#envParser' or './src/config/env'\n\tconst [modulePath, exportName = 'default'] = envParserPath.split('#');\n\tif (!modulePath) {\n\t\treturn { envVars: [], optionalEnvVars: [], unhandledRejections: [] };\n\t}\n\n\t// Resolve the full path to the module\n\tconst fullPath = resolve(workspacePath, appPath, modulePath);\n\n\t// Dynamically import the sniffer utilities\n\tlet SnifferEnvironmentParser: any;\n\tlet sniffWithFireAndForget: any;\n\ttry {\n\t\tconst envkitModule = await import('@geekmidas/envkit/sniffer');\n\t\tSnifferEnvironmentParser = envkitModule.SnifferEnvironmentParser;\n\t\tsniffWithFireAndForget = envkitModule.sniffWithFireAndForget;\n\t} catch (error) {\n\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\tconsole.warn(\n\t\t\t`[sniffer] Failed to import SnifferEnvironmentParser: ${message}`,\n\t\t);\n\t\treturn { envVars: [], optionalEnvVars: [], unhandledRejections: [] };\n\t}\n\n\tconst sniffer = new SnifferEnvironmentParser();\n\n\treturn sniffWithFireAndForget(sniffer, async () => {\n\t\t// Import the envParser module\n\t\tconst moduleUrl = pathToFileURL(fullPath).href;\n\t\tconst module = await import(moduleUrl);\n\n\t\t// Get the envParser function\n\t\tconst envParser = module[exportName];\n\t\tif (typeof envParser !== 'function') {\n\t\t\tconsole.warn(\n\t\t\t\t`[sniffer] Export \"${exportName}\" from \"${modulePath}\" is not a function`,\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\n\t\t// The envParser function typically creates and configures an EnvironmentParser.\n\t\t// We pass our sniffer which implements the same interface.\n\t\tconst result = envParser(sniffer);\n\n\t\t// If the result is a ConfigParser, call parse() to trigger env var access\n\t\tif (result && typeof result.parse === 'function') {\n\t\t\ttry {\n\t\t\t\tresult.parse();\n\t\t\t} catch {\n\t\t\t\t// Parsing may fail due to mock values, that's expected\n\t\t\t}\n\t\t}\n\t});\n}\n\n/**\n * Sniff environment requirements for multiple apps.\n *\n * @param apps - Map of app name to app config\n * @param workspacePath - Absolute path to workspace root\n * @param options - Optional configuration for sniffing behavior\n * @returns Map of app name to sniffed environment\n */\nexport async function sniffAllApps(\n\tapps: Record<string, NormalizedAppConfig>,\n\tworkspacePath: string,\n\toptions: SniffAppOptions = {},\n): Promise<Map<string, SniffedEnvironment>> {\n\tconst results = new Map<string, SniffedEnvironment>();\n\n\tfor (const [appName, app] of Object.entries(apps)) {\n\t\tconst sniffed = await sniffAppEnvironment(\n\t\t\tapp,\n\t\t\tappName,\n\t\t\tworkspacePath,\n\t\t\toptions,\n\t\t);\n\t\tresults.set(appName, sniffed);\n\t}\n\n\treturn results;\n}\n\n// Export for testing\nexport {\n\tsniffEnvParser as _sniffEnvParser,\n\tsniffEntryFile as _sniffEntryFile,\n\tsniffRouteFiles as _sniffRouteFiles,\n};\n"],"mappings":";;;;;;;;;AASA,MAAMA,eAAa,0EAA8B;AACjD,MAAMC,cAAY,uBAAQD,aAAW;;;;;AAMrC,SAAS,iBAAyB;CACjC,MAAME,YAAU,6EAA8B;AAC9C,QAAO,UAAQ,QAAQ,MAAM;AAC7B;;;;;;;;;;AAWD,SAAS,mBAAmBC,UAA0B;CAGrD,MAAM,gBAAgB,uBAAQF,aAAW,WAAW,EAAE,SAAS,MAAM;AACrE,KAAI,wBAAW,cAAc,CAC5B,QAAO;CAIR,MAAM,UAAU,uBAAQA,cAAY,EAAE,SAAS,MAAM;AACrD,KAAI,wBAAW,QAAQ,CACtB,QAAO;CAIR,MAAM,SAAS,uBAAQA,cAAY,EAAE,SAAS,KAAK;AACnD,KAAI,wBAAW,OAAO,CACrB,QAAO;AAIR,QAAO;AACP;;;;;;;;;;;;;;;;;;;;;AAyDD,eAAsB,oBACrBG,KACAC,SACAC,eACAC,UAA2B,CAAE,GACC;CAC9B,MAAM,EAAE,cAAc,MAAM,eAAe,OAAO,GAAG;AAGrD,KAAI,IAAI,SAAS,YAAY;EAE5B,MAAM,UAAU,CAAC,IAAI,gBAAgB,CAAE,GAAE,IACxC,CAAC,SAAS,cAAc,IAAI,aAAa,CAAC,MAC1C;AAID,MAAI,IAAI,QAAQ;GACf,MAAMC,cAAwB,CAAE;GAChC,MAAMC,kBAA4B,CAAE;GAGpC,MAAMC,cAAwB,CAAE;AAChC,OAAI,IAAI,OAAO,OAAQ,aAAY,KAAK,IAAI,OAAO,OAAO;AAC1D,OAAI,IAAI,OAAO,OAAQ,aAAY,KAAK,IAAI,OAAO,OAAO;AAG1D,QAAK,MAAM,cAAc,aAAa;IACrC,MAAM,SAAS,MAAM,eACpB,YACA,IAAI,MACJ,cACA;AAED,QAAI,eAAe,OAAO,MACzB,SAAQ,MACN,YAAY,QAAQ,iBAAiB,WAAW,2DAA2D,OAAO,MAAM,QAAQ,EACjI;AAGF,gBAAY,KAAK,GAAG,OAAO,QAAQ;AACnC,oBAAgB,KAAK,GAAG,OAAO,gBAAgB;GAC/C;GAED,MAAM,kBAAkB,CAAC,GAAG,IAAI,IAAI,gBAAiB;GAErD,MAAM,UAAU,kBACf,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,SAAS,GAAG,WAAY,EAAE,GAC1C,iBACA,aACA;AACD,UAAO;IAAE;IAAS,iBAAiB;IAAS;GAAiB;EAC7D;AAED,SAAO;GAAE;GAAS,iBAAiB;GAAS,iBAAiB,CAAE;EAAE;CACjE;AAGD,KAAI,IAAI,OAAO;EACd,MAAM,SAAS,MAAM,eAAe,IAAI,OAAO,IAAI,MAAM,cAAc;AAEvE,MAAI,eAAe,OAAO,MACzB,SAAQ,MACN,YAAY,QAAQ,sEAAsE,OAAO,MAAM,QAAQ,EAChH;AAGF,SAAO;GACN;GACA,iBAAiB,kBAChB,OAAO,SACP,OAAO,iBACP,aACA;GACD,iBAAiB,OAAO;EACxB;CACD;AAGD,KAAI,IAAI,QAAQ;EACf,MAAM,SAAS,MAAM,gBACpB,yCAAgB,IAAI,OAAO,EAC3B,IAAI,MACJ,cACA;AAED,MAAI,eAAe,OAAO,MACzB,SAAQ,MACN,YAAY,QAAQ,0DAA0D,OAAO,MAAM,QAAQ,EACpG;AAGF,SAAO;GACN;GACA,iBAAiB,kBAChB,OAAO,SACP,OAAO,iBACP,aACA;GACD,iBAAiB,OAAO;EACxB;CACD;AAGD,KAAI,IAAI,WAAW;EAClB,MAAM,SAAS,MAAM,eAAe,IAAI,WAAW,IAAI,MAAM,cAAc;AAG3E,MAAI,aAAa;AAChB,OAAI,OAAO,MACV,SAAQ,MACN,YAAY,QAAQ,qEAAqE,OAAO,MAAM,QAAQ,EAC/G;AAEF,OAAI,OAAO,oBAAoB,SAAS,EACvC,SAAQ,MACN,YAAY,QAAQ,6DAA6D,OAAO,oBAAoB,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,KAAK,CAAC,EAC9I;EAEF;AAED,SAAO;GACN;GACA,iBAAiB,kBAChB,OAAO,SACP,OAAO,iBACP,aACA;GACD,iBAAiB,OAAO;EACxB;CACD;AAGD,QAAO;EAAE;EAAS,iBAAiB,CAAE;EAAE,iBAAiB,CAAE;CAAE;AAC5D;;;;;AAMD,SAAS,kBACRC,SACAC,iBACAC,cACW;AACX,MAAK,gBAAgB,gBAAgB,WAAW,EAAG,QAAO;CAC1D,MAAM,cAAc,IAAI,IAAI;AAC5B,QAAO,QAAQ,IAAI,CAAC,MAAO,YAAY,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAG;AAC7D;;;;;;;;;;;;;;;;;;;;AA8BD,eAAe,eACdC,WACAC,SACAT,eAC4B;CAC5B,MAAM,gBAAgB,uBAAQ,eAAe,SAAS,UAAU;CAChE,MAAM,aAAa,mBAAmB,iBAAiB;CACvD,MAAM,aAAa,mBAAmB,iBAAiB;AAEvD,QAAO,IAAI,QAAQ,CAAC,mBAAmB;EACtC,MAAM,QAAQ,8BACb,QACA;GAAC;GAAY;GAAY;GAAY;EAAc,GACnD;GACC,KAAK,uBAAQ,eAAe,QAAQ;GACpC,OAAO;IAAC;IAAU;IAAQ;GAAO;GACjC,KAAK;IACJ,GAAG,QAAQ;IAEX,cAAc;GACd;EACD,EACD;EAED,IAAI,SAAS;EACb,IAAI,SAAS;AAEb,QAAM,OAAO,GAAG,QAAQ,CAAC,SAAS;AACjC,aAAU,KAAK,UAAU;EACzB,EAAC;AAEF,QAAM,OAAO,GAAG,QAAQ,CAAC,SAAS;AACjC,aAAU,KAAK,UAAU;EACzB,EAAC;AAEF,QAAM,GAAG,SAAS,CAAC,SAAS;AAE3B,OAAI;IAEH,MAAM,YAAY,OAAO,MAAM,kCAAkC;AACjE,QAAI,WAAW;KACd,MAAM,SAAS,KAAK,MAAM,UAAU,GAAG;AACvC,oBAAe;MACd,SAAS,OAAO,WAAW,CAAE;MAC7B,iBAAiB,OAAO,mBAAmB,CAAE;MAC7C,OAAO,OAAO,QAAQ,IAAI,MAAM,OAAO;KACvC,EAAC;AACF;IACA;GACD,QAAO,CAEP;AAGD,kBAAe;IACd,SAAS,CAAE;IACX,iBAAiB,CAAE;IACnB,OAAO,IAAI,OACT,wCAAwC,KAAK,KAAK,UAAU,UAAU,YAAY;GAEpF,EAAC;EACF,EAAC;AAEF,QAAM,GAAG,SAAS,CAAC,QAAQ;AAC1B,kBAAe;IACd,SAAS,CAAE;IACX,iBAAiB,CAAE;IACnB,OAAO;GACP,EAAC;EACF,EAAC;CACF;AACD;;;;;;;;;;;;;;;AAgBD,eAAe,gBACdU,QACAD,SACAT,eAC4B;CAC5B,MAAM,cAAc,uBAAQ,eAAe,QAAQ;CACnD,MAAM,aAAa,mBAAmB,wBAAwB;CAC9D,MAAM,UAAU,gBAAgB;CAGhC,MAAM,cAAc,MAAM,QAAQ,OAAO,GAAG,SAAS,CAAC,MAAO;CAC7D,MAAM,UAAU,YAAY;AAC5B,MAAK,QACJ,QAAO;EACN,SAAS,CAAE;EACX,iBAAiB,CAAE;EACnB,OAAO,IAAI,MAAM;CACjB;AAGF,QAAO,IAAI,QAAQ,CAAC,mBAAmB;EACtC,MAAM,QAAQ,8BACb,QACA;GAAC;GAAY;GAAS;GAAY;GAAa;EAAQ,GACvD;GACC,KAAK;GACL,OAAO;IAAC;IAAU;IAAQ;GAAO;GACjC,KAAK,EACJ,GAAG,QAAQ,IACX;EACD,EACD;EAED,IAAI,SAAS;EACb,IAAI,SAAS;AAEb,QAAM,OAAO,GAAG,QAAQ,CAAC,SAAS;AACjC,aAAU,KAAK,UAAU;EACzB,EAAC;AAEF,QAAM,OAAO,GAAG,QAAQ,CAAC,SAAS;AACjC,aAAU,KAAK,UAAU;EACzB,EAAC;AAEF,QAAM,GAAG,SAAS,CAAC,SAAS;AAE3B,OAAI,OACH,QACE,MAAM,KAAK,CACX,OAAO,CAAC,SAAS,KAAK,MAAM,CAAC,CAC7B,QAAQ,CAAC,SAAS,QAAQ,KAAK,KAAK,CAAC;AAIxC,OAAI;IAEH,MAAM,YAAY,OAAO,MAAM,kCAAkC;AACjE,QAAI,WAAW;KACd,MAAM,SAAS,KAAK,MAAM,UAAU,GAAG;AACvC,oBAAe;MACd,SAAS,OAAO,WAAW,CAAE;MAG7B,iBAAiB,OAAO,mBAAmB,CAAE;MAC7C,OAAO,OAAO,QAAQ,IAAI,MAAM,OAAO;KACvC,EAAC;AACF;IACA;GACD,QAAO,CAEP;AAGD,kBAAe;IACd,SAAS,CAAE;IACX,iBAAiB,CAAE;IACnB,OAAO,IAAI,OACT,yCAAyC,KAAK,KAAK,UAAU,UAAU,YAAY;GAErF,EAAC;EACF,EAAC;AAEF,QAAM,GAAG,SAAS,CAAC,QAAQ;AAC1B,kBAAe;IACd,SAAS,CAAE;IACX,iBAAiB,CAAE;IACnB,OAAO;GACP,EAAC;EACF,EAAC;CACF;AACD;;;;;;;;;;;;;AAcD,eAAe,eACdW,eACAF,SACAT,eACuB;CAEvB,MAAM,CAAC,YAAY,aAAa,UAAU,GAAG,cAAc,MAAM,IAAI;AACrE,MAAK,WACJ,QAAO;EAAE,SAAS,CAAE;EAAE,iBAAiB,CAAE;EAAE,qBAAqB,CAAE;CAAE;CAIrE,MAAM,WAAW,uBAAQ,eAAe,SAAS,WAAW;CAG5D,IAAIY;CACJ,IAAIC;AACJ,KAAI;EACH,MAAM,eAAe,MAAM,OAAO;AAClC,6BAA2B,aAAa;AACxC,2BAAyB,aAAa;CACtC,SAAQ,OAAO;EACf,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AACtE,UAAQ,MACN,uDAAuD,QAAQ,EAChE;AACD,SAAO;GAAE,SAAS,CAAE;GAAE,iBAAiB,CAAE;GAAE,qBAAqB,CAAE;EAAE;CACpE;CAED,MAAM,UAAU,IAAI;AAEpB,QAAO,uBAAuB,SAAS,YAAY;EAElD,MAAM,YAAY,4BAAc,SAAS,CAAC;EAC1C,MAAMC,WAAS,MAAM,OAAO;EAG5B,MAAM,YAAYA,SAAO;AACzB,aAAW,cAAc,YAAY;AACpC,WAAQ,MACN,oBAAoB,WAAW,UAAU,WAAW,qBACrD;AACD;EACA;EAID,MAAM,SAAS,UAAU,QAAQ;AAGjC,MAAI,iBAAiB,OAAO,UAAU,WACrC,KAAI;AACH,UAAO,OAAO;EACd,QAAO,CAEP;CAEF,EAAC;AACF;;;;;;;;;AAUD,eAAsB,aACrBC,MACAf,eACAC,UAA2B,CAAE,GACc;CAC3C,MAAM,0BAAU,IAAI;AAEpB,MAAK,MAAM,CAAC,SAAS,IAAI,IAAI,OAAO,QAAQ,KAAK,EAAE;EAClD,MAAM,UAAU,MAAM,oBACrB,KACA,SACA,eACA,QACA;AACD,UAAQ,IAAI,SAAS,QAAQ;CAC7B;AAED,QAAO;AACP"}

package/dist/sniffer-Cpq_cbyz.mjs

@@ -0,0 +1,4 @@
+import "./client-generator-CUVVtAOo.mjs";
+import { sniffAllApps, sniffAppEnvironment, sniffEntryFile, sniffEnvParser, sniffRouteFiles } from "./sniffer-BqSVVrWA.mjs";
+
+export { sniffEnvParser as _sniffEnvParser };

package/dist/sniffer-eZ13G10M.cjs

@@ -0,0 +1,4 @@
+require('./client-generator-D-T4ypQo.cjs');
+const require_sniffer = require('./sniffer-CBhzByiY.cjs');
+
+exports._sniffEnvParser = require_sniffer.sniffEnvParser;

package/dist/sync-B2CN_KS5.cjs

@@ -0,0 +1,4 @@
+const require_sync = require('./sync-BWY6yoUG.cjs');
+
+exports.pullSecrets = require_sync.pullSecrets;
+exports.pushSecrets = require_sync.pushSecrets;

package/dist/{sync-DGXXSk2v.cjs → sync-BWY6yoUG.cjs}

@@ -90,4 +90,4 @@ Object.defineProperty(exports, 'pushSecrets', {
     return pushSecrets;
   }
 });
-//# sourceMappingURL=sync-DGXXSk2v.cjs.map
+//# sourceMappingURL=sync-BWY6yoUG.cjs.map

package/dist/{sync-DGXXSk2v.cjs.map → sync-BWY6yoUG.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"sync-DGXXSk2v.cjs","names":["workspaceName: string","stage: string","config: SSMStateConfig","clientConfig: SSMClientConfig","SSMClient","workspace: NormalizedWorkspace","PutParameterCommand","GetParameterCommand","ParameterNotFound"],"sources":["../src/secrets/sync.ts"],"sourcesContent":["/**\n * Secrets Sync via AWS SSM Parameter Store\n *\n * Stores and retrieves encrypted StageSecrets as SecureString parameters.\n * Reuses the SSM infrastructure from the state provider.\n *\n * Parameter naming: /gkm/{workspaceName}/{stage}/secrets\n */\n\nimport {\n\tGetParameterCommand,\n\tParameterNotFound,\n\tPutParameterCommand,\n\tSSMClient,\n\ttype SSMClientConfig,\n} from '@aws-sdk/client-ssm';\nimport type { SSMStateConfig } from '../deploy/StateProvider.js';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\nimport type { StageSecrets } from './types.js';\n\n/**\n * Get the SSM parameter name for secrets.\n */\nfunction getSecretsParameterName(workspaceName: string, stage: string): string {\n\treturn `/gkm/${workspaceName}/${stage}/secrets`;\n}\n\n/**\n * Create an SSM client from workspace state config.\n */\nfunction createSSMClient(config: SSMStateConfig): SSMClient {\n\tconst clientConfig: SSMClientConfig = {\n\t\tregion: config.region,\n\t};\n\n\tif (config.profile) {\n\t\tconst { fromIni } = require('@aws-sdk/credential-providers');\n\t\tclientConfig.credentials = fromIni({ profile: config.profile });\n\t}\n\n\treturn new SSMClient(clientConfig);\n}\n\n/**\n * Push secrets to SSM Parameter Store.\n *\n * Stores the full StageSecrets object as a SecureString parameter.\n */\nexport async function pushSecrets(\n\tstage: string,\n\tworkspace: NormalizedWorkspace,\n): Promise<void> {\n\tconst config = workspace.state;\n\tif (!config || config.provider !== 'ssm') {\n\t\tthrow new Error(\n\t\t\t'SSM state provider not configured. Add state: { provider: \"ssm\", region: \"...\" } to gkm.config.ts.',\n\t\t);\n\t}\n\n\tif (!workspace.name) {\n\t\tthrow new Error(\n\t\t\t'Workspace name is required for SSM secrets sync. Set \"name\" in gkm.config.ts.',\n\t\t);\n\t}\n\n\tconst client = createSSMClient(config as SSMStateConfig);\n\tconst parameterName = getSecretsParameterName(workspace.name, stage);\n\n\tconst { readStageSecrets } = await import('./storage.js');\n\tconst secrets = await readStageSecrets(stage, workspace.root);\n\n\tif (!secrets) {\n\t\tthrow new Error(\n\t\t\t`No secrets found for stage \"${stage}\". Run \"gkm secrets:init --stage ${stage}\" first.`,\n\t\t);\n\t}\n\n\tawait client.send(\n\t\tnew PutParameterCommand({\n\t\t\tName: parameterName,\n\t\t\tValue: JSON.stringify(secrets),\n\t\t\tType: 'SecureString',\n\t\t\tOverwrite: true,\n\t\t\tDescription: `GKM secrets for ${workspace.name}/${stage}`,\n\t\t}),\n\t);\n}\n\n/**\n * Pull secrets from SSM Parameter Store.\n *\n * @returns StageSecrets or null if no secrets are stored remotely\n */\nexport async function pullSecrets(\n\tstage: string,\n\tworkspace: NormalizedWorkspace,\n): Promise<StageSecrets | null> {\n\tconst config = workspace.state;\n\tif (!config || config.provider !== 'ssm') {\n\t\treturn null;\n\t}\n\n\tif (!workspace.name) {\n\t\treturn null;\n\t}\n\n\tconst client = createSSMClient(config as SSMStateConfig);\n\tconst parameterName = getSecretsParameterName(workspace.name, stage);\n\n\ttry {\n\t\tconst response = await client.send(\n\t\t\tnew GetParameterCommand({\n\t\t\t\tName: parameterName,\n\t\t\t\tWithDecryption: true,\n\t\t\t}),\n\t\t);\n\n\t\tif (!response.Parameter?.Value) {\n\t\t\treturn null;\n\t\t}\n\n\t\treturn JSON.parse(response.Parameter.Value) as StageSecrets;\n\t} catch (error) {\n\t\tif (error instanceof ParameterNotFound) {\n\t\t\treturn null;\n\t\t}\n\t\tthrow error;\n\t}\n}\n\n/**\n * Check if SSM is configured for the workspace.\n */\nexport function isSSMConfigured(workspace: NormalizedWorkspace): boolean {\n\treturn !!workspace.state && workspace.state.provider === 'ssm';\n}\n"],"mappings":";;;;;;;AAuBA,SAAS,wBAAwBA,eAAuBC,OAAuB;AAC9E,SAAQ,OAAO,cAAc,GAAG,MAAM;AACtC;;;;AAKD,SAAS,gBAAgBC,QAAmC;CAC3D,MAAMC,eAAgC,EACrC,QAAQ,OAAO,OACf;AAED,KAAI,OAAO,SAAS;EACnB,MAAM,EAAE,SAAS,GAAG,QAAQ,gCAAgC;AAC5D,eAAa,cAAc,QAAQ,EAAE,SAAS,OAAO,QAAS,EAAC;CAC/D;AAED,QAAO,IAAIC,+BAAU;AACrB;;;;;;AAOD,eAAsB,YACrBH,OACAI,WACgB;CAChB,MAAM,SAAS,UAAU;AACzB,MAAK,UAAU,OAAO,aAAa,MAClC,OAAM,IAAI,MACT;AAIF,MAAK,UAAU,KACd,OAAM,IAAI,MACT;CAIF,MAAM,SAAS,gBAAgB,OAAyB;CACxD,MAAM,gBAAgB,wBAAwB,UAAU,MAAM,MAAM;CAEpE,MAAM,EAAE,kBAAkB,GAAG,2CAAM;CACnC,MAAM,UAAU,MAAM,iBAAiB,OAAO,UAAU,KAAK;AAE7D,MAAK,QACJ,OAAM,IAAI,OACR,8BAA8B,MAAM,mCAAmC,MAAM;AAIhF,OAAM,OAAO,KACZ,IAAIC,yCAAoB;EACvB,MAAM;EACN,OAAO,KAAK,UAAU,QAAQ;EAC9B,MAAM;EACN,WAAW;EACX,cAAc,kBAAkB,UAAU,KAAK,GAAG,MAAM;CACxD,GACD;AACD;;;;;;AAOD,eAAsB,YACrBL,OACAI,WAC+B;CAC/B,MAAM,SAAS,UAAU;AACzB,MAAK,UAAU,OAAO,aAAa,MAClC,QAAO;AAGR,MAAK,UAAU,KACd,QAAO;CAGR,MAAM,SAAS,gBAAgB,OAAyB;CACxD,MAAM,gBAAgB,wBAAwB,UAAU,MAAM,MAAM;AAEpE,KAAI;EACH,MAAM,WAAW,MAAM,OAAO,KAC7B,IAAIE,yCAAoB;GACvB,MAAM;GACN,gBAAgB;EAChB,GACD;AAED,OAAK,SAAS,WAAW,MACxB,QAAO;AAGR,SAAO,KAAK,MAAM,SAAS,UAAU,MAAM;CAC3C,SAAQ,OAAO;AACf,MAAI,iBAAiBC,uCACpB,QAAO;AAER,QAAM;CACN;AACD;;;;AAKD,SAAgB,gBAAgBH,WAAyC;AACxE,UAAS,UAAU,SAAS,UAAU,MAAM,aAAa;AACzD"}
+{"version":3,"file":"sync-BWY6yoUG.cjs","names":["workspaceName: string","stage: string","config: SSMStateConfig","clientConfig: SSMClientConfig","SSMClient","workspace: NormalizedWorkspace","PutParameterCommand","GetParameterCommand","ParameterNotFound"],"sources":["../src/secrets/sync.ts"],"sourcesContent":["/**\n * Secrets Sync via AWS SSM Parameter Store\n *\n * Stores and retrieves encrypted StageSecrets as SecureString parameters.\n * Reuses the SSM infrastructure from the state provider.\n *\n * Parameter naming: /gkm/{workspaceName}/{stage}/secrets\n */\n\nimport {\n\tGetParameterCommand,\n\tParameterNotFound,\n\tPutParameterCommand,\n\tSSMClient,\n\ttype SSMClientConfig,\n} from '@aws-sdk/client-ssm';\nimport type { SSMStateConfig } from '../deploy/StateProvider.js';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\nimport type { StageSecrets } from './types.js';\n\n/**\n * Get the SSM parameter name for secrets.\n */\nfunction getSecretsParameterName(workspaceName: string, stage: string): string {\n\treturn `/gkm/${workspaceName}/${stage}/secrets`;\n}\n\n/**\n * Create an SSM client from workspace state config.\n */\nfunction createSSMClient(config: SSMStateConfig): SSMClient {\n\tconst clientConfig: SSMClientConfig = {\n\t\tregion: config.region,\n\t};\n\n\tif (config.profile) {\n\t\tconst { fromIni } = require('@aws-sdk/credential-providers');\n\t\tclientConfig.credentials = fromIni({ profile: config.profile });\n\t}\n\n\treturn new SSMClient(clientConfig);\n}\n\n/**\n * Push secrets to SSM Parameter Store.\n *\n * Stores the full StageSecrets object as a SecureString parameter.\n */\nexport async function pushSecrets(\n\tstage: string,\n\tworkspace: NormalizedWorkspace,\n): Promise<void> {\n\tconst config = workspace.state;\n\tif (!config || config.provider !== 'ssm') {\n\t\tthrow new Error(\n\t\t\t'SSM state provider not configured. Add state: { provider: \"ssm\", region: \"...\" } to gkm.config.ts.',\n\t\t);\n\t}\n\n\tif (!workspace.name) {\n\t\tthrow new Error(\n\t\t\t'Workspace name is required for SSM secrets sync. Set \"name\" in gkm.config.ts.',\n\t\t);\n\t}\n\n\tconst client = createSSMClient(config as SSMStateConfig);\n\tconst parameterName = getSecretsParameterName(workspace.name, stage);\n\n\tconst { readStageSecrets } = await import('./storage.js');\n\tconst secrets = await readStageSecrets(stage, workspace.root);\n\n\tif (!secrets) {\n\t\tthrow new Error(\n\t\t\t`No secrets found for stage \"${stage}\". Run \"gkm secrets:init --stage ${stage}\" first.`,\n\t\t);\n\t}\n\n\tawait client.send(\n\t\tnew PutParameterCommand({\n\t\t\tName: parameterName,\n\t\t\tValue: JSON.stringify(secrets),\n\t\t\tType: 'SecureString',\n\t\t\tOverwrite: true,\n\t\t\tDescription: `GKM secrets for ${workspace.name}/${stage}`,\n\t\t}),\n\t);\n}\n\n/**\n * Pull secrets from SSM Parameter Store.\n *\n * @returns StageSecrets or null if no secrets are stored remotely\n */\nexport async function pullSecrets(\n\tstage: string,\n\tworkspace: NormalizedWorkspace,\n): Promise<StageSecrets | null> {\n\tconst config = workspace.state;\n\tif (!config || config.provider !== 'ssm') {\n\t\treturn null;\n\t}\n\n\tif (!workspace.name) {\n\t\treturn null;\n\t}\n\n\tconst client = createSSMClient(config as SSMStateConfig);\n\tconst parameterName = getSecretsParameterName(workspace.name, stage);\n\n\ttry {\n\t\tconst response = await client.send(\n\t\t\tnew GetParameterCommand({\n\t\t\t\tName: parameterName,\n\t\t\t\tWithDecryption: true,\n\t\t\t}),\n\t\t);\n\n\t\tif (!response.Parameter?.Value) {\n\t\t\treturn null;\n\t\t}\n\n\t\treturn JSON.parse(response.Parameter.Value) as StageSecrets;\n\t} catch (error) {\n\t\tif (error instanceof ParameterNotFound) {\n\t\t\treturn null;\n\t\t}\n\t\tthrow error;\n\t}\n}\n\n/**\n * Check if SSM is configured for the workspace.\n */\nexport function isSSMConfigured(workspace: NormalizedWorkspace): boolean {\n\treturn !!workspace.state && workspace.state.provider === 'ssm';\n}\n"],"mappings":";;;;;;;AAuBA,SAAS,wBAAwBA,eAAuBC,OAAuB;AAC9E,SAAQ,OAAO,cAAc,GAAG,MAAM;AACtC;;;;AAKD,SAAS,gBAAgBC,QAAmC;CAC3D,MAAMC,eAAgC,EACrC,QAAQ,OAAO,OACf;AAED,KAAI,OAAO,SAAS;EACnB,MAAM,EAAE,SAAS,GAAG,QAAQ,gCAAgC;AAC5D,eAAa,cAAc,QAAQ,EAAE,SAAS,OAAO,QAAS,EAAC;CAC/D;AAED,QAAO,IAAIC,+BAAU;AACrB;;;;;;AAOD,eAAsB,YACrBH,OACAI,WACgB;CAChB,MAAM,SAAS,UAAU;AACzB,MAAK,UAAU,OAAO,aAAa,MAClC,OAAM,IAAI,MACT;AAIF,MAAK,UAAU,KACd,OAAM,IAAI,MACT;CAIF,MAAM,SAAS,gBAAgB,OAAyB;CACxD,MAAM,gBAAgB,wBAAwB,UAAU,MAAM,MAAM;CAEpE,MAAM,EAAE,kBAAkB,GAAG,2CAAM;CACnC,MAAM,UAAU,MAAM,iBAAiB,OAAO,UAAU,KAAK;AAE7D,MAAK,QACJ,OAAM,IAAI,OACR,8BAA8B,MAAM,mCAAmC,MAAM;AAIhF,OAAM,OAAO,KACZ,IAAIC,yCAAoB;EACvB,MAAM;EACN,OAAO,KAAK,UAAU,QAAQ;EAC9B,MAAM;EACN,WAAW;EACX,cAAc,kBAAkB,UAAU,KAAK,GAAG,MAAM;CACxD,GACD;AACD;;;;;;AAOD,eAAsB,YACrBL,OACAI,WAC+B;CAC/B,MAAM,SAAS,UAAU;AACzB,MAAK,UAAU,OAAO,aAAa,MAClC,QAAO;AAGR,MAAK,UAAU,KACd,QAAO;CAGR,MAAM,SAAS,gBAAgB,OAAyB;CACxD,MAAM,gBAAgB,wBAAwB,UAAU,MAAM,MAAM;AAEpE,KAAI;EACH,MAAM,WAAW,MAAM,OAAO,KAC7B,IAAIE,yCAAoB;GACvB,MAAM;GACN,gBAAgB;EAChB,GACD;AAED,OAAK,SAAS,WAAW,MACxB,QAAO;AAGR,SAAO,KAAK,MAAM,SAAS,UAAU,MAAM;CAC3C,SAAQ,OAAO;AACf,MAAI,iBAAiBC,uCACpB,QAAO;AAER,QAAM;CACN;AACD;;;;AAKD,SAAgB,gBAAgBH,WAAyC;AACxE,UAAS,UAAU,SAAS,UAAU,MAAM,aAAa;AACzD"}

package/dist/{sync-D_NowTkZ.mjs → sync-Dc-QA4Mx.mjs}

@@ -73,4 +73,4 @@ function isSSMConfigured(workspace) {
 
 //#endregion
 export { isSSMConfigured, pullSecrets, pushSecrets };
-//# sourceMappingURL=sync-D_NowTkZ.mjs.map
+//# sourceMappingURL=sync-Dc-QA4Mx.mjs.map

package/dist/{sync-D_NowTkZ.mjs.map → sync-Dc-QA4Mx.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"sync-D_NowTkZ.mjs","names":["workspaceName: string","stage: string","config: SSMStateConfig","clientConfig: SSMClientConfig","workspace: NormalizedWorkspace"],"sources":["../src/secrets/sync.ts"],"sourcesContent":["/**\n * Secrets Sync via AWS SSM Parameter Store\n *\n * Stores and retrieves encrypted StageSecrets as SecureString parameters.\n * Reuses the SSM infrastructure from the state provider.\n *\n * Parameter naming: /gkm/{workspaceName}/{stage}/secrets\n */\n\nimport {\n\tGetParameterCommand,\n\tParameterNotFound,\n\tPutParameterCommand,\n\tSSMClient,\n\ttype SSMClientConfig,\n} from '@aws-sdk/client-ssm';\nimport type { SSMStateConfig } from '../deploy/StateProvider.js';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\nimport type { StageSecrets } from './types.js';\n\n/**\n * Get the SSM parameter name for secrets.\n */\nfunction getSecretsParameterName(workspaceName: string, stage: string): string {\n\treturn `/gkm/${workspaceName}/${stage}/secrets`;\n}\n\n/**\n * Create an SSM client from workspace state config.\n */\nfunction createSSMClient(config: SSMStateConfig): SSMClient {\n\tconst clientConfig: SSMClientConfig = {\n\t\tregion: config.region,\n\t};\n\n\tif (config.profile) {\n\t\tconst { fromIni } = require('@aws-sdk/credential-providers');\n\t\tclientConfig.credentials = fromIni({ profile: config.profile });\n\t}\n\n\treturn new SSMClient(clientConfig);\n}\n\n/**\n * Push secrets to SSM Parameter Store.\n *\n * Stores the full StageSecrets object as a SecureString parameter.\n */\nexport async function pushSecrets(\n\tstage: string,\n\tworkspace: NormalizedWorkspace,\n): Promise<void> {\n\tconst config = workspace.state;\n\tif (!config || config.provider !== 'ssm') {\n\t\tthrow new Error(\n\t\t\t'SSM state provider not configured. Add state: { provider: \"ssm\", region: \"...\" } to gkm.config.ts.',\n\t\t);\n\t}\n\n\tif (!workspace.name) {\n\t\tthrow new Error(\n\t\t\t'Workspace name is required for SSM secrets sync. Set \"name\" in gkm.config.ts.',\n\t\t);\n\t}\n\n\tconst client = createSSMClient(config as SSMStateConfig);\n\tconst parameterName = getSecretsParameterName(workspace.name, stage);\n\n\tconst { readStageSecrets } = await import('./storage.js');\n\tconst secrets = await readStageSecrets(stage, workspace.root);\n\n\tif (!secrets) {\n\t\tthrow new Error(\n\t\t\t`No secrets found for stage \"${stage}\". Run \"gkm secrets:init --stage ${stage}\" first.`,\n\t\t);\n\t}\n\n\tawait client.send(\n\t\tnew PutParameterCommand({\n\t\t\tName: parameterName,\n\t\t\tValue: JSON.stringify(secrets),\n\t\t\tType: 'SecureString',\n\t\t\tOverwrite: true,\n\t\t\tDescription: `GKM secrets for ${workspace.name}/${stage}`,\n\t\t}),\n\t);\n}\n\n/**\n * Pull secrets from SSM Parameter Store.\n *\n * @returns StageSecrets or null if no secrets are stored remotely\n */\nexport async function pullSecrets(\n\tstage: string,\n\tworkspace: NormalizedWorkspace,\n): Promise<StageSecrets | null> {\n\tconst config = workspace.state;\n\tif (!config || config.provider !== 'ssm') {\n\t\treturn null;\n\t}\n\n\tif (!workspace.name) {\n\t\treturn null;\n\t}\n\n\tconst client = createSSMClient(config as SSMStateConfig);\n\tconst parameterName = getSecretsParameterName(workspace.name, stage);\n\n\ttry {\n\t\tconst response = await client.send(\n\t\t\tnew GetParameterCommand({\n\t\t\t\tName: parameterName,\n\t\t\t\tWithDecryption: true,\n\t\t\t}),\n\t\t);\n\n\t\tif (!response.Parameter?.Value) {\n\t\t\treturn null;\n\t\t}\n\n\t\treturn JSON.parse(response.Parameter.Value) as StageSecrets;\n\t} catch (error) {\n\t\tif (error instanceof ParameterNotFound) {\n\t\t\treturn null;\n\t\t}\n\t\tthrow error;\n\t}\n}\n\n/**\n * Check if SSM is configured for the workspace.\n */\nexport function isSSMConfigured(workspace: NormalizedWorkspace): boolean {\n\treturn !!workspace.state && workspace.state.provider === 'ssm';\n}\n"],"mappings":";;;;;;;AAuBA,SAAS,wBAAwBA,eAAuBC,OAAuB;AAC9E,SAAQ,OAAO,cAAc,GAAG,MAAM;AACtC;;;;AAKD,SAAS,gBAAgBC,QAAmC;CAC3D,MAAMC,eAAgC,EACrC,QAAQ,OAAO,OACf;AAED,KAAI,OAAO,SAAS;EACnB,MAAM,EAAE,SAAS,GAAG,UAAQ,gCAAgC;AAC5D,eAAa,cAAc,QAAQ,EAAE,SAAS,OAAO,QAAS,EAAC;CAC/D;AAED,QAAO,IAAI,UAAU;AACrB;;;;;;AAOD,eAAsB,YACrBF,OACAG,WACgB;CAChB,MAAM,SAAS,UAAU;AACzB,MAAK,UAAU,OAAO,aAAa,MAClC,OAAM,IAAI,MACT;AAIF,MAAK,UAAU,KACd,OAAM,IAAI,MACT;CAIF,MAAM,SAAS,gBAAgB,OAAyB;CACxD,MAAM,gBAAgB,wBAAwB,UAAU,MAAM,MAAM;CAEpE,MAAM,EAAE,kBAAkB,GAAG,MAAM,OAAO;CAC1C,MAAM,UAAU,MAAM,iBAAiB,OAAO,UAAU,KAAK;AAE7D,MAAK,QACJ,OAAM,IAAI,OACR,8BAA8B,MAAM,mCAAmC,MAAM;AAIhF,OAAM,OAAO,KACZ,IAAI,oBAAoB;EACvB,MAAM;EACN,OAAO,KAAK,UAAU,QAAQ;EAC9B,MAAM;EACN,WAAW;EACX,cAAc,kBAAkB,UAAU,KAAK,GAAG,MAAM;CACxD,GACD;AACD;;;;;;AAOD,eAAsB,YACrBH,OACAG,WAC+B;CAC/B,MAAM,SAAS,UAAU;AACzB,MAAK,UAAU,OAAO,aAAa,MAClC,QAAO;AAGR,MAAK,UAAU,KACd,QAAO;CAGR,MAAM,SAAS,gBAAgB,OAAyB;CACxD,MAAM,gBAAgB,wBAAwB,UAAU,MAAM,MAAM;AAEpE,KAAI;EACH,MAAM,WAAW,MAAM,OAAO,KAC7B,IAAI,oBAAoB;GACvB,MAAM;GACN,gBAAgB;EAChB,GACD;AAED,OAAK,SAAS,WAAW,MACxB,QAAO;AAGR,SAAO,KAAK,MAAM,SAAS,UAAU,MAAM;CAC3C,SAAQ,OAAO;AACf,MAAI,iBAAiB,kBACpB,QAAO;AAER,QAAM;CACN;AACD;;;;AAKD,SAAgB,gBAAgBA,WAAyC;AACxE,UAAS,UAAU,SAAS,UAAU,MAAM,aAAa;AACzD"}
+{"version":3,"file":"sync-Dc-QA4Mx.mjs","names":["workspaceName: string","stage: string","config: SSMStateConfig","clientConfig: SSMClientConfig","workspace: NormalizedWorkspace"],"sources":["../src/secrets/sync.ts"],"sourcesContent":["/**\n * Secrets Sync via AWS SSM Parameter Store\n *\n * Stores and retrieves encrypted StageSecrets as SecureString parameters.\n * Reuses the SSM infrastructure from the state provider.\n *\n * Parameter naming: /gkm/{workspaceName}/{stage}/secrets\n */\n\nimport {\n\tGetParameterCommand,\n\tParameterNotFound,\n\tPutParameterCommand,\n\tSSMClient,\n\ttype SSMClientConfig,\n} from '@aws-sdk/client-ssm';\nimport type { SSMStateConfig } from '../deploy/StateProvider.js';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\nimport type { StageSecrets } from './types.js';\n\n/**\n * Get the SSM parameter name for secrets.\n */\nfunction getSecretsParameterName(workspaceName: string, stage: string): string {\n\treturn `/gkm/${workspaceName}/${stage}/secrets`;\n}\n\n/**\n * Create an SSM client from workspace state config.\n */\nfunction createSSMClient(config: SSMStateConfig): SSMClient {\n\tconst clientConfig: SSMClientConfig = {\n\t\tregion: config.region,\n\t};\n\n\tif (config.profile) {\n\t\tconst { fromIni } = require('@aws-sdk/credential-providers');\n\t\tclientConfig.credentials = fromIni({ profile: config.profile });\n\t}\n\n\treturn new SSMClient(clientConfig);\n}\n\n/**\n * Push secrets to SSM Parameter Store.\n *\n * Stores the full StageSecrets object as a SecureString parameter.\n */\nexport async function pushSecrets(\n\tstage: string,\n\tworkspace: NormalizedWorkspace,\n): Promise<void> {\n\tconst config = workspace.state;\n\tif (!config || config.provider !== 'ssm') {\n\t\tthrow new Error(\n\t\t\t'SSM state provider not configured. Add state: { provider: \"ssm\", region: \"...\" } to gkm.config.ts.',\n\t\t);\n\t}\n\n\tif (!workspace.name) {\n\t\tthrow new Error(\n\t\t\t'Workspace name is required for SSM secrets sync. Set \"name\" in gkm.config.ts.',\n\t\t);\n\t}\n\n\tconst client = createSSMClient(config as SSMStateConfig);\n\tconst parameterName = getSecretsParameterName(workspace.name, stage);\n\n\tconst { readStageSecrets } = await import('./storage.js');\n\tconst secrets = await readStageSecrets(stage, workspace.root);\n\n\tif (!secrets) {\n\t\tthrow new Error(\n\t\t\t`No secrets found for stage \"${stage}\". Run \"gkm secrets:init --stage ${stage}\" first.`,\n\t\t);\n\t}\n\n\tawait client.send(\n\t\tnew PutParameterCommand({\n\t\t\tName: parameterName,\n\t\t\tValue: JSON.stringify(secrets),\n\t\t\tType: 'SecureString',\n\t\t\tOverwrite: true,\n\t\t\tDescription: `GKM secrets for ${workspace.name}/${stage}`,\n\t\t}),\n\t);\n}\n\n/**\n * Pull secrets from SSM Parameter Store.\n *\n * @returns StageSecrets or null if no secrets are stored remotely\n */\nexport async function pullSecrets(\n\tstage: string,\n\tworkspace: NormalizedWorkspace,\n): Promise<StageSecrets | null> {\n\tconst config = workspace.state;\n\tif (!config || config.provider !== 'ssm') {\n\t\treturn null;\n\t}\n\n\tif (!workspace.name) {\n\t\treturn null;\n\t}\n\n\tconst client = createSSMClient(config as SSMStateConfig);\n\tconst parameterName = getSecretsParameterName(workspace.name, stage);\n\n\ttry {\n\t\tconst response = await client.send(\n\t\t\tnew GetParameterCommand({\n\t\t\t\tName: parameterName,\n\t\t\t\tWithDecryption: true,\n\t\t\t}),\n\t\t);\n\n\t\tif (!response.Parameter?.Value) {\n\t\t\treturn null;\n\t\t}\n\n\t\treturn JSON.parse(response.Parameter.Value) as StageSecrets;\n\t} catch (error) {\n\t\tif (error instanceof ParameterNotFound) {\n\t\t\treturn null;\n\t\t}\n\t\tthrow error;\n\t}\n}\n\n/**\n * Check if SSM is configured for the workspace.\n */\nexport function isSSMConfigured(workspace: NormalizedWorkspace): boolean {\n\treturn !!workspace.state && workspace.state.provider === 'ssm';\n}\n"],"mappings":";;;;;;;AAuBA,SAAS,wBAAwBA,eAAuBC,OAAuB;AAC9E,SAAQ,OAAO,cAAc,GAAG,MAAM;AACtC;;;;AAKD,SAAS,gBAAgBC,QAAmC;CAC3D,MAAMC,eAAgC,EACrC,QAAQ,OAAO,OACf;AAED,KAAI,OAAO,SAAS;EACnB,MAAM,EAAE,SAAS,GAAG,UAAQ,gCAAgC;AAC5D,eAAa,cAAc,QAAQ,EAAE,SAAS,OAAO,QAAS,EAAC;CAC/D;AAED,QAAO,IAAI,UAAU;AACrB;;;;;;AAOD,eAAsB,YACrBF,OACAG,WACgB;CAChB,MAAM,SAAS,UAAU;AACzB,MAAK,UAAU,OAAO,aAAa,MAClC,OAAM,IAAI,MACT;AAIF,MAAK,UAAU,KACd,OAAM,IAAI,MACT;CAIF,MAAM,SAAS,gBAAgB,OAAyB;CACxD,MAAM,gBAAgB,wBAAwB,UAAU,MAAM,MAAM;CAEpE,MAAM,EAAE,kBAAkB,GAAG,MAAM,OAAO;CAC1C,MAAM,UAAU,MAAM,iBAAiB,OAAO,UAAU,KAAK;AAE7D,MAAK,QACJ,OAAM,IAAI,OACR,8BAA8B,MAAM,mCAAmC,MAAM;AAIhF,OAAM,OAAO,KACZ,IAAI,oBAAoB;EACvB,MAAM;EACN,OAAO,KAAK,UAAU,QAAQ;EAC9B,MAAM;EACN,WAAW;EACX,cAAc,kBAAkB,UAAU,KAAK,GAAG,MAAM;CACxD,GACD;AACD;;;;;;AAOD,eAAsB,YACrBH,OACAG,WAC+B;CAC/B,MAAM,SAAS,UAAU;AACzB,MAAK,UAAU,OAAO,aAAa,MAClC,QAAO;AAGR,MAAK,UAAU,KACd,QAAO;CAGR,MAAM,SAAS,gBAAgB,OAAyB;CACxD,MAAM,gBAAgB,wBAAwB,UAAU,MAAM,MAAM;AAEpE,KAAI;EACH,MAAM,WAAW,MAAM,OAAO,KAC7B,IAAI,oBAAoB;GACvB,MAAM;GACN,gBAAgB;EAChB,GACD;AAED,OAAK,SAAS,WAAW,MACxB,QAAO;AAGR,SAAO,KAAK,MAAM,SAAS,UAAU,MAAM;CAC3C,SAAQ,OAAO;AACf,MAAI,iBAAiB,kBACpB,QAAO;AAER,QAAM;CACN;AACD;;;;AAKD,SAAgB,gBAAgBA,WAAyC;AACxE,UAAS,UAAU,SAAS,UAAU,MAAM,aAAa;AACzD"}

package/dist/{sync-COnAugP-.mjs → sync-fzT5WX_y.mjs}

@@ -1,3 +1,3 @@
-import { isSSMConfigured, pullSecrets, pushSecrets } from "./sync-D_NowTkZ.mjs";
+import { isSSMConfigured, pullSecrets, pushSecrets } from "./sync-Dc-QA4Mx.mjs";
 
 export { pullSecrets, pushSecrets };

package/dist/{types-OszPdw9m.d.mts → types-BqAbYt5a.d.mts}

@@ -275,4 +275,4 @@ interface GkmConfig {
 }
 //#endregion
 export { EventsBackend, GkmConfig, HooksConfig, OpenApiConfig, ProvidersConfig, Routes, Runtime, StudioConfig, TelescopeConfig };
-//# sourceMappingURL=types-OszPdw9m.d.mts.map
+//# sourceMappingURL=types-BqAbYt5a.d.mts.map

package/dist/{types-OszPdw9m.d.mts.map → types-BqAbYt5a.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"types-OszPdw9m.d.mts","names":[],"sources":["../src/types.ts"],"sourcesContent":[],"mappings":";;AAYY,UALK,iBAAA,CAKwB;EAaxB,KAAA,EAAA,MAAA,GAAA,MAAc,EAAA;EAKd,SAAA,EAAA,CAAA,QAAA,EAAoB,MAAA,EAAA,GAAQ,MAAA;AAI7C;AAIiB,KA1BL,MAAA,GA0BK,MAAgB,GAAA,MAAA,EAAA,GA1BQ,iBA0BR;AAkDrB,UA/DK,cAAA,CA+DQ;EAGb,OAAA,CAAA,EAAA,OAAA;EASA,SAAA,CAAA,EAAA,MAAA;;AACL,UAvEU,mBAAA,SAA4B,cAuEtC,CAAA;AAA6C,UAnEnC,eAAA,SAAwB,cAmEW,CAAA,CAGpD;AAA6B,UAlEZ,gBAAA,CAkEY;EAAA;EAwBK,OAAG,CAAA,EAAA,OAAA;EAAkB;EAItC,MAAA,CAAA,EAAA,OAAa;EAAA;EAAA,MAIhB,CAAA,EAAA,OAAA;EAAgB;EAJsB,WAAA,CAAA,EAAA,MAAA;EAOxC;EAEK,gBAAA,CAAA,EAAe,OAAA;EAiBf;EASA,QAAA,CAAA,EAAA,MAAa,EAAA;EAWb;EA6BA,WAAA,CAAA,EAAA,SAAA,GAAqB,SAAA;EAarB;EAAe,OAAA,CAAA,EAAA,OAAA;EAAA;;;;;;AAaU;EAGzB,iBAAS,CAAA,EAAA,OAAA;;;AAEb,UA5KI,aAAA,CA4KJ;EAAM;;;;EAeC,KAQY,CAAA,EAAA,MAAA;EAAe;;;;EA2DzB,OAAA,CAAA,EAAA,MAAA;;;;;;;;;;;KAxOV,aAAA;;KAGA,kBAAA;;KASA,qBAAA,WACL,gCAAgC;UAGtB,YAAA;;;;;;;;;;;;;;;;;;;;;;;;eAwBJ,wBAAwB;;;UAIpB,YAAA,SAAqB;;;;eAIxB;;KAGF,OAAA;UAEK,eAAA;;;;;;;;;;;;;;;;UAiBA,YAAA;;;;;;;;UASA,aAAA;;;;;;;;;;UAWA,WAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA6BA,qBAAA;;;;;;;;;;;;UAaA,eAAA;;;qBAGC;qBACA;;;4BAGO;wBACJ;;;qBAGD;;sBAEC;;UAGJ,SAAA;UACR;cACI;UACJ;gBACM;;;cAGF;;;;;;;;;;UAUJ;;;;;;;;iCAQuB;;;;;;;;;;8BAUH;;;;;;;;;;;;;;;;;;;sBAmBR;;YAEV;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA4BD"}
+{"version":3,"file":"types-BqAbYt5a.d.mts","names":[],"sources":["../src/types.ts"],"sourcesContent":[],"mappings":";;AAYY,UALK,iBAAA,CAKwB;EAaxB,KAAA,EAAA,MAAA,GAAA,MAAc,EAAA;EAKd,SAAA,EAAA,CAAA,QAAA,EAAoB,MAAA,EAAA,GAAQ,MAAA;AAI7C;AAIiB,KA1BL,MAAA,GA0BK,MAAgB,GAAA,MAAA,EAAA,GA1BQ,iBA0BR;AAkDrB,UA/DK,cAAA,CA+DQ;EAGb,OAAA,CAAA,EAAA,OAAA;EASA,SAAA,CAAA,EAAA,MAAA;;AACL,UAvEU,mBAAA,SAA4B,cAuEtC,CAAA;AAA6C,UAnEnC,eAAA,SAAwB,cAmEW,CAAA,CAGpD;AAA6B,UAlEZ,gBAAA,CAkEY;EAAA;EAwBK,OAAG,CAAA,EAAA,OAAA;EAAkB;EAItC,MAAA,CAAA,EAAA,OAAa;EAAA;EAAA,MAIhB,CAAA,EAAA,OAAA;EAAgB;EAJsB,WAAA,CAAA,EAAA,MAAA;EAOxC;EAEK,gBAAA,CAAA,EAAe,OAAA;EAiBf;EASA,QAAA,CAAA,EAAA,MAAa,EAAA;EAWb;EA6BA,WAAA,CAAA,EAAA,SAAA,GAAqB,SAAA;EAarB;EAAe,OAAA,CAAA,EAAA,OAAA;EAAA;;;;;;AAaU;EAGzB,iBAAS,CAAA,EAAA,OAAA;;;AAEb,UA5KI,aAAA,CA4KJ;EAAM;;;;EAeC,KAQY,CAAA,EAAA,MAAA;EAAe;;;;EA2DzB,OAAA,CAAA,EAAA,MAAA;;;;;;;;;;;KAxOV,aAAA;;KAGA,kBAAA;;KASA,qBAAA,WACL,gCAAgC;UAGtB,YAAA;;;;;;;;;;;;;;;;;;;;;;;;eAwBJ,wBAAwB;;;UAIpB,YAAA,SAAqB;;;;eAIxB;;KAGF,OAAA;UAEK,eAAA;;;;;;;;;;;;;;;;UAiBA,YAAA;;;;;;;;UASA,aAAA;;;;;;;;;;UAWA,WAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA6BA,qBAAA;;;;;;;;;;;;UAaA,eAAA;;;qBAGC;qBACA;;;4BAGO;wBACJ;;;qBAGD;;sBAEC;;UAGJ,SAAA;UACR;cACI;UACJ;gBACM;;;cAGF;;;;;;;;;;UAUJ;;;;;;;;iCAQuB;;;;;;;;;;8BAUH;;;;;;;;;;;;;;;;;;;sBAmBR;;YAEV;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA4BD"}

package/dist/workspace/index.cjs

@@ -1,4 +1,4 @@
-const require_workspace = require('../workspace-4SP3Gx4Y.cjs');
+const require_workspace = require('../workspace-CGYykWfn.cjs');
 
 exports.PHASE_2_DEPLOY_TARGETS = require_workspace.PHASE_2_DEPLOY_TARGETS;
 exports.SUPPORTED_DEPLOY_TARGETS = require_workspace.SUPPORTED_DEPLOY_TARGETS;

package/dist/workspace/index.d.cts

@@ -1,3 +1,3 @@
 import "../types-DdHfUbxk.cjs";
-import { AppConfig, AppConfigInput, AppInput, AppsRecord, BackendFramework, ClientConfig, ConstrainedApps, DeployConfig, DeployTarget, DokployWorkspaceConfig, FrontendFramework, InferAppNames, InferredWorkspaceConfig, LoadedConfig, MailServiceConfig, ModelsConfig, NormalizedAppConfig, NormalizedWorkspace, PHASE_2_DEPLOY_TARGETS, SUPPORTED_DEPLOY_TARGETS, SecretsConfig, ServiceImageConfig, ServicesConfig, SharedConfig, WorkspaceConfig, WorkspaceConfigSchema, WorkspaceInput, defineWorkspace, formatValidationErrors, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getDeployTargetError, getEndpointForStage, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, normalizeWorkspace, processConfig, safeValidateWorkspaceConfig, validateWorkspaceConfig, wrapSingleAppAsWorkspace } from "../index-BkibYzso.cjs";
-export { AppConfig, AppConfigInput, AppInput, AppsRecord, BackendFramework, ClientConfig, ConstrainedApps, DeployConfig, DeployTarget, DokployWorkspaceConfig, FrontendFramework, InferAppNames, InferredWorkspaceConfig, LoadedConfig, MailServiceConfig, ModelsConfig, NormalizedAppConfig, NormalizedWorkspace, PHASE_2_DEPLOY_TARGETS, SUPPORTED_DEPLOY_TARGETS, SecretsConfig, ServiceImageConfig, ServicesConfig, SharedConfig, WorkspaceConfig, WorkspaceConfigSchema, WorkspaceInput, defineWorkspace, formatValidationErrors, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getDeployTargetError, getEndpointForStage, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, normalizeWorkspace, processConfig, safeValidateWorkspaceConfig, validateWorkspaceConfig, wrapSingleAppAsWorkspace };
+import { AppConfig, AppConfigInput, AppInput, AppsRecord, BackendFramework, ConstrainedApps, DeployConfig, DeployTarget, DokployWorkspaceConfig, FrontendFramework, InferAppNames, InferredWorkspaceConfig, LoadedConfig, MailServiceConfig, ModelsConfig, NormalizedAppConfig, NormalizedWorkspace, PHASE_2_DEPLOY_TARGETS, SUPPORTED_DEPLOY_TARGETS, SecretsConfig, ServiceImageConfig, ServicesConfig, SharedConfig, WorkspaceConfig, WorkspaceConfigSchema, WorkspaceInput, defineWorkspace, formatValidationErrors, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getDeployTargetError, getEndpointForStage, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, normalizeWorkspace, processConfig, safeValidateWorkspaceConfig, validateWorkspaceConfig, wrapSingleAppAsWorkspace } from "../index-C3t5VL4R.cjs";
+export { AppConfig, AppConfigInput, AppInput, AppsRecord, BackendFramework, ConstrainedApps, DeployConfig, DeployTarget, DokployWorkspaceConfig, FrontendFramework, InferAppNames, InferredWorkspaceConfig, LoadedConfig, MailServiceConfig, ModelsConfig, NormalizedAppConfig, NormalizedWorkspace, PHASE_2_DEPLOY_TARGETS, SUPPORTED_DEPLOY_TARGETS, SecretsConfig, ServiceImageConfig, ServicesConfig, SharedConfig, WorkspaceConfig, WorkspaceConfigSchema, WorkspaceInput, defineWorkspace, formatValidationErrors, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getDeployTargetError, getEndpointForStage, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, normalizeWorkspace, processConfig, safeValidateWorkspaceConfig, validateWorkspaceConfig, wrapSingleAppAsWorkspace };

package/dist/workspace/index.d.mts

@@ -1,3 +1,3 @@
-import "../types-OszPdw9m.mjs";
-import { AppConfig, AppConfigInput, AppInput, AppsRecord, BackendFramework, ClientConfig, ConstrainedApps, DeployConfig, DeployTarget, DokployWorkspaceConfig, FrontendFramework, InferAppNames, InferredWorkspaceConfig, LoadedConfig, MailServiceConfig, ModelsConfig, NormalizedAppConfig, NormalizedWorkspace, PHASE_2_DEPLOY_TARGETS, SUPPORTED_DEPLOY_TARGETS, SecretsConfig, ServiceImageConfig, ServicesConfig, SharedConfig, WorkspaceConfig, WorkspaceConfigSchema, WorkspaceInput, defineWorkspace, formatValidationErrors, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getDeployTargetError, getEndpointForStage, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, normalizeWorkspace, processConfig, safeValidateWorkspaceConfig, validateWorkspaceConfig, wrapSingleAppAsWorkspace } from "../index-CY-ieuRp.mjs";
-export { AppConfig, AppConfigInput, AppInput, AppsRecord, BackendFramework, ClientConfig, ConstrainedApps, DeployConfig, DeployTarget, DokployWorkspaceConfig, FrontendFramework, InferAppNames, InferredWorkspaceConfig, LoadedConfig, MailServiceConfig, ModelsConfig, NormalizedAppConfig, NormalizedWorkspace, PHASE_2_DEPLOY_TARGETS, SUPPORTED_DEPLOY_TARGETS, SecretsConfig, ServiceImageConfig, ServicesConfig, SharedConfig, WorkspaceConfig, WorkspaceConfigSchema, WorkspaceInput, defineWorkspace, formatValidationErrors, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getDeployTargetError, getEndpointForStage, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, normalizeWorkspace, processConfig, safeValidateWorkspaceConfig, validateWorkspaceConfig, wrapSingleAppAsWorkspace };
+import "../types-BqAbYt5a.mjs";
+import { AppConfig, AppConfigInput, AppInput, AppsRecord, BackendFramework, ConstrainedApps, DeployConfig, DeployTarget, DokployWorkspaceConfig, FrontendFramework, InferAppNames, InferredWorkspaceConfig, LoadedConfig, MailServiceConfig, ModelsConfig, NormalizedAppConfig, NormalizedWorkspace, PHASE_2_DEPLOY_TARGETS, SUPPORTED_DEPLOY_TARGETS, SecretsConfig, ServiceImageConfig, ServicesConfig, SharedConfig, WorkspaceConfig, WorkspaceConfigSchema, WorkspaceInput, defineWorkspace, formatValidationErrors, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getDeployTargetError, getEndpointForStage, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, normalizeWorkspace, processConfig, safeValidateWorkspaceConfig, validateWorkspaceConfig, wrapSingleAppAsWorkspace } from "../index-C-_rW4KF.mjs";
+export { AppConfig, AppConfigInput, AppInput, AppsRecord, BackendFramework, ConstrainedApps, DeployConfig, DeployTarget, DokployWorkspaceConfig, FrontendFramework, InferAppNames, InferredWorkspaceConfig, LoadedConfig, MailServiceConfig, ModelsConfig, NormalizedAppConfig, NormalizedWorkspace, PHASE_2_DEPLOY_TARGETS, SUPPORTED_DEPLOY_TARGETS, SecretsConfig, ServiceImageConfig, ServicesConfig, SharedConfig, WorkspaceConfig, WorkspaceConfigSchema, WorkspaceInput, defineWorkspace, formatValidationErrors, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getDeployTargetError, getEndpointForStage, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, normalizeWorkspace, processConfig, safeValidateWorkspaceConfig, validateWorkspaceConfig, wrapSingleAppAsWorkspace };

package/dist/workspace/index.mjs

@@ -1,3 +1,3 @@
-import { PHASE_2_DEPLOY_TARGETS, SUPPORTED_DEPLOY_TARGETS, WorkspaceConfigSchema, defineWorkspace, formatValidationErrors, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getDeployTargetError, getEndpointForStage, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, normalizeWorkspace, processConfig, safeValidateWorkspaceConfig, validateWorkspaceConfig, wrapSingleAppAsWorkspace } from "../workspace-D4z4A4cq.mjs";
+import { PHASE_2_DEPLOY_TARGETS, SUPPORTED_DEPLOY_TARGETS, WorkspaceConfigSchema, defineWorkspace, formatValidationErrors, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getDeployTargetError, getEndpointForStage, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, normalizeWorkspace, processConfig, safeValidateWorkspaceConfig, validateWorkspaceConfig, wrapSingleAppAsWorkspace } from "../workspace-Bi4X7Yzy.mjs";
 
 export { PHASE_2_DEPLOY_TARGETS, SUPPORTED_DEPLOY_TARGETS, WorkspaceConfigSchema, defineWorkspace, formatValidationErrors, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getDeployTargetError, getEndpointForStage, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, normalizeWorkspace, processConfig, safeValidateWorkspaceConfig, validateWorkspaceConfig, wrapSingleAppAsWorkspace };

package/dist/{workspace-D4z4A4cq.mjs → workspace-Bi4X7Yzy.mjs}

@@ -3401,10 +3401,6 @@ const OpenApiConfigSchema = object({
 */
 const HooksConfigSchema = object({ server: string().optional() });
 /**
-* Client generation configuration schema.
-*/
-const ClientConfigSchema = object({ output: string().optional() });
-/**
 * Auth provider schema.
 * Currently only 'better-auth' is supported.
 */
@@ -3768,7 +3764,6 @@ const AppConfigSchema = object({
 	env: union([string(), array(string())]).optional(),
 	entry: string().optional(),
 	framework: FrameworkSchema.optional(),
-	client: ClientConfigSchema.optional(),
 	config: object({
 		client: string().optional(),
 		server: string().optional()
@@ -4176,4 +4171,4 @@ function getEndpointForStage(dokployConfig, stage) {
 
 //#endregion
 export { PHASE_2_DEPLOY_TARGETS, SUPPORTED_DEPLOY_TARGETS, WorkspaceConfigSchema, defineWorkspace, formatValidationErrors, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getDeployTargetError, getEndpointForStage, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, normalizeWorkspace, processConfig, safeValidateWorkspaceConfig, validateWorkspaceConfig, wrapSingleAppAsWorkspace };
-//# sourceMappingURL=workspace-D4z4A4cq.mjs.map
+//# sourceMappingURL=workspace-Bi4X7Yzy.mjs.map