@geekmidas/cli 1.10.29 → 1.10.31

package/dist/index.mjs

@@ -1,16 +1,18 @@
 #!/usr/bin/env -S npx tsx
 import { __require } from "./chunk-Duj1WY3L.mjs";
-import { getAppBuildOrder, getDependencyEnvVars, getDeployTargetError, isDeployTargetSupported } from "./workspace-D4z4A4cq.mjs";
-import { getAppNameFromCwd, loadAppConfig, loadConfig, loadWorkspaceAppInfo, loadWorkspaceConfig, parseModuleConfig } from "./config-jsRYHOHU.mjs";
+import { getAppBuildOrder, getDependencyEnvVars, getDeployTargetError, isDeployTargetSupported } from "./workspace-Bi4X7Yzy.mjs";
+import { getAppNameFromCwd, loadAppConfig, loadConfig, loadWorkspaceAppInfo, loadWorkspaceConfig, parseModuleConfig } from "./config-B62g483e.mjs";
 import { getCredentialsPath, getDokployCredentials, getDokployRegistryId, getDokployToken, removeDokployCredentials, storeDokployCredentials, storeDokployRegistryId } from "./credentials-s1kLcIzK.mjs";
 import { createStageSecrets, generateConnectionUrls, generateDbPassword, generateDbUrl, generateFullstackCustomSecrets, generateLocalStackCredentials, generatePgBossUrl, generateSecurePassword, generateServiceCredentials, rotateServicePassword, writeDockerEnvFromSecrets } from "./fullstack-secrets-P84v8zWn.mjs";
 import { getKeyPath, maskPassword, readStageSecrets, secretsExist, setCustomSecret, toEmbeddableSecrets, writeStageSecrets } from "./storage-dbb9RyBl.mjs";
-import { ConstructGenerator, EndpointGenerator, OPENAPI_OUTPUT_PATH, generateOpenApi, isPartitionedRoutes, normalizeRoutes, openapiCommand, resolveOpenApiConfig } from "./openapi-CQCoLuzh.mjs";
-import { DokployApi } from "./dokploy-api-BIT0683o.mjs";
-import { encryptSecrets } from "./encryption-DSkIlEZ6.mjs";
-import { CachedStateProvider } from "./CachedStateProvider-C8A-cCm5.mjs";
-import { generateReactQueryCommand } from "./openapi-react-query-C4UdILaI.mjs";
-import { isSSMConfigured, pullSecrets, pushSecrets } from "./sync-D_NowTkZ.mjs";
+import { isPartitionedRoutes } from "./client-generator-CUVVtAOo.mjs";
+import { ConstructGenerator, EndpointGenerator, OPENAPI_OUTPUT_PATH, generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi-DHq5r17U.mjs";
+import { DokployApi } from "./dokploy-api-sfZFlWuE.mjs";
+import { encryptSecrets } from "./encryption-CO5Q4Bhf.mjs";
+import { sniffAllApps, sniffAppEnvironment } from "./sniffer-BqSVVrWA.mjs";
+import { CachedStateProvider } from "./CachedStateProvider-CQr31ups.mjs";
+import { generateReactQueryCommand } from "./openapi-react-query-COpH7Mmz.mjs";
+import { isSSMConfigured, pullSecrets, pushSecrets } from "./sync-Dc-QA4Mx.mjs";
 import { createRequire } from "node:module";
 import { copyFileSync, existsSync, readFileSync, unlinkSync } from "node:fs";
 import { basename, dirname, join, parse, relative, resolve } from "node:path";
@@ -30,12 +32,11 @@ import { Function } from "@geekmidas/constructs/functions";
 import { Subscriber } from "@geekmidas/constructs/subscribers";
 import { Client } from "pg";
 import { lookup } from "node:dns/promises";
-import { fileURLToPath, pathToFileURL } from "node:url";
 import prompts from "prompts";
 
 //#region package.json
 var name = "@geekmidas/cli";
-var version = "1.10.28";
+var version = "1.10.30";
 var description = "CLI tools for building Lambda handlers, server applications, and generating OpenAPI specs";
 var private$1 = false;
 var type = "module";
@@ -138,7 +139,7 @@ const logger$14 = console;
 * Validate Dokploy token by making a test API call
 */
 async function validateDokployToken(endpoint, token) {
-	const { DokployApi: DokployApi$1 } = await import("./dokploy-api-BZGk-lkD.mjs");
+	const { DokployApi: DokployApi$1 } = await import("./dokploy-api-BiSzWM4v.mjs");
 	const api = new DokployApi$1({
 		baseUrl: endpoint,
 		token
@@ -2202,18 +2203,25 @@ async function buildCommand(options) {
 	}
 	const rootOutputDir = join(process.cwd(), ".gkm");
 	await mkdir(rootOutputDir, { recursive: true });
+	let optionalVarSet;
+	if (options.markOptional && config$1.envParser) try {
+		const { _sniffEnvParser } = await import("./sniffer-Cpq_cbyz.mjs");
+		const sniffed = await _sniffEnvParser(config$1.envParser, process.cwd(), process.cwd());
+		if (sniffed.optionalEnvVars.length > 0) optionalVarSet = new Set(sniffed.optionalEnvVars);
+	} catch {}
 	let result = {};
 	for (const provider of resolved.providers) {
-		const providerResult = await buildForProvider(provider, buildContext, rootOutputDir, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, allEndpoints, allFunctions, allCrons, allSubscribers, resolved.enableOpenApi, options.skipBundle ?? false, options.stage);
+		const providerResult = await buildForProvider(provider, buildContext, rootOutputDir, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, allEndpoints, allFunctions, allCrons, allSubscribers, resolved.enableOpenApi, options.skipBundle ?? false, options.stage, optionalVarSet);
 		if (providerResult.masterKey) result = providerResult;
 	}
+	await generateOpenApi(config$1, { bustCache: true });
 	return result;
 }
-async function buildForProvider(provider, context, rootOutputDir, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, endpoints, functions, crons, subscribers, enableOpenApi, skipBundle, stage) {
+async function buildForProvider(provider, context, rootOutputDir, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, endpoints, functions, crons, subscribers, enableOpenApi, skipBundle, stage, optionalVarSet) {
 	const outputDir = join(process.cwd(), ".gkm", provider);
 	await mkdir(outputDir, { recursive: true });
 	logger$9.log(`\nGenerating handlers for provider: ${provider}`);
-	const [routes, functionInfos, cronInfos, subscriberInfos] = await Promise.all([
+	const [rawRoutes, rawFunctions, rawCrons, rawSubscribers] = await Promise.all([
 		endpointGenerator.build(context, endpoints, outputDir, {
 			provider,
 			enableOpenApi
@@ -2222,6 +2230,23 @@ async function buildForProvider(provider, context, rootOutputDir, endpointGenera
 		cronGenerator.build(context, crons, outputDir, { provider }),
 		subscriberGenerator.build(context, subscribers, outputDir, { provider })
 	]);
+	const markEnv = optionalVarSet ? (vars) => vars?.map((v) => optionalVarSet.has(v) ? `${v}?` : v) : (vars) => vars;
+	const routes = rawRoutes.map((r) => ({
+		...r,
+		environment: markEnv(r.environment)
+	}));
+	const functionInfos = rawFunctions.map((f) => ({
+		...f,
+		environment: markEnv(f.environment)
+	}));
+	const cronInfos = rawCrons.map((c) => ({
+		...c,
+		environment: markEnv(c.environment)
+	}));
+	const subscriberInfos = rawSubscribers.map((s) => ({
+		...s,
+		environment: markEnv(s.environment)
+	}));
 	logger$9.log(`Generated ${routes.length} routes, ${functionInfos.length} functions, ${cronInfos.length} crons, ${subscriberInfos.length} subscribers for ${provider}`);
 	const manifestRoutes = assembleManifestField(routes, endpoints);
 	const manifestFunctions = assembleManifestField(functionInfos, functions);
@@ -2243,7 +2268,7 @@ async function buildForProvider(provider, context, rootOutputDir, endpointGenera
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$9.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await import("./bundler-c6QvGUBM.mjs");
+			const { bundleServer } = await import("./bundler-E5VcXsPH.mjs");
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -2341,6 +2366,7 @@ async function workspaceBuildCommand(workspace, options) {
 			});
 		}
 		logger$9.log(`\n✅ Workspace build complete!`);
+		await openapiCommand({ cwd: workspace.root });
 		logger$9.log(`\n📋 Build Summary:`);
 		for (const result of results) {
 			const icon = result.type === "backend" ? "⚙️" : "🌐";
@@ -2569,11 +2595,11 @@ async function createDnsProvider(options) {
 	if (isDnsProvider(config$1.provider)) return config$1.provider;
 	const provider = config$1.provider;
 	if (provider === "hostinger") {
-		const { HostingerProvider } = await import("./HostingerProvider-ANWchdiK.mjs");
+		const { HostingerProvider } = await import("./HostingerProvider-YvCg3Mus.mjs");
 		return new HostingerProvider();
 	}
 	if (provider === "route53") {
-		const { Route53Provider } = await import("./Route53Provider-QoPgcXxn.mjs");
+		const { Route53Provider } = await import("./Route53Provider-CYlDOrYO.mjs");
 		const route53Config = config$1;
 		return new Route53Provider({
 			region: route53Config.region,
@@ -3123,6 +3149,7 @@ services:
     restart: unless-stopped
     environment:
       MP_SMTP_AUTH: \${SMTP_USER:-${imageName}}:\${SMTP_PASS:-${imageName}}
+      MP_SMTP_AUTH_ALLOW_INSECURE: true
     ports:
       - "\${MAILPIT_PORT:-8025}:8025"  # Web UI / API
       - "\${SMTP_PORT:-1025}:1025"  # SMTP
@@ -3287,6 +3314,7 @@ services:
     restart: unless-stopped
     environment:
       MP_SMTP_AUTH: \${SMTP_USER:-${workspace.name}}:\${SMTP_PASS:-${workspace.name}}
+      MP_SMTP_AUTH_ALLOW_INSECURE: true
     ports:
       - "\${MAILPIT_PORT:-8025}:8025"  # Web UI / API
       - "\${SMTP_PORT:-1025}:1025"  # SMTP
@@ -5042,20 +5070,20 @@ function isStateProvider(value) {
 async function createStateProvider(options) {
 	const { config: config$1, workspaceRoot, workspaceName } = options;
 	if (!config$1) {
-		const { LocalStateProvider } = await import("./LocalStateProvider-Dp0KkRcw.mjs");
+		const { LocalStateProvider } = await import("./LocalStateProvider-BciOhGR0.mjs");
 		return new LocalStateProvider(workspaceRoot);
 	}
 	if (isStateProvider(config$1.provider)) return config$1.provider;
 	const provider = config$1.provider;
 	if (provider === "local") {
-		const { LocalStateProvider } = await import("./LocalStateProvider-Dp0KkRcw.mjs");
+		const { LocalStateProvider } = await import("./LocalStateProvider-BciOhGR0.mjs");
 		return new LocalStateProvider(workspaceRoot);
 	}
 	if (provider === "ssm") {
 		if (!workspaceName) throw new Error("Workspace name is required for SSM state provider. Set \"name\" in gkm.config.ts.");
-		const { LocalStateProvider } = await import("./LocalStateProvider-Dp0KkRcw.mjs");
-		const { SSMStateProvider } = await import("./SSMStateProvider-CksOTB8M.mjs");
-		const { CachedStateProvider: CachedStateProvider$1 } = await import("./CachedStateProvider-CC0DyO09.mjs");
+		const { LocalStateProvider } = await import("./LocalStateProvider-BciOhGR0.mjs");
+		const { SSMStateProvider } = await import("./SSMStateProvider-DXT1dIdI.mjs");
+		const { CachedStateProvider: CachedStateProvider$1 } = await import("./CachedStateProvider-C4QqvlPE.mjs");
 		const ssmConfig = config$1;
 		const local = new LocalStateProvider(workspaceRoot);
 		const ssm = SSMStateProvider.create({
@@ -5165,326 +5193,6 @@ function generateSecretsReport(encryptedApps, sniffedApps) {
 	};
 }
 
-//#endregion
-//#region src/deploy/sniffer.ts
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-/**
-* Resolve the tsx package path from the CLI package's dependencies.
-* This ensures tsx is available regardless of whether the target project has it installed.
-*/
-function resolveTsxPath() {
-	const require$2 = createRequire(import.meta.url);
-	return require$2.resolve("tsx");
-}
-/**
-* Resolve the path to a sniffer helper file.
-* Handles both dev (.ts with tsx) and production (.mjs from dist).
-*
-* In production: sniffer.ts is bundled into dist/index.mjs, but sniffer helper
-* files are output to dist/deploy/ as standalone modules for subprocess loading.
-*
-* In development: All files are in src/deploy/ and loaded via tsx.
-*/
-function resolveSnifferFile(baseName) {
-	const deployMjsPath = resolve(__dirname, "deploy", `${baseName}.mjs`);
-	if (existsSync(deployMjsPath)) return deployMjsPath;
-	const mjsPath = resolve(__dirname, `${baseName}.mjs`);
-	if (existsSync(mjsPath)) return mjsPath;
-	const tsPath = resolve(__dirname, `${baseName}.ts`);
-	if (existsSync(tsPath)) return tsPath;
-	return tsPath;
-}
-/**
-* Get required environment variables for an app.
-*
-* Detection strategy (in order):
-* 1. Frontend apps: Returns empty (no server secrets)
-* 2. Apps with `requiredEnv`: Uses explicit list from config
-* 3. Entry apps: Imports entry file in subprocess to capture config.parse() calls
-* 4. Route-based apps: Loads route files and calls getEnvironment() on each construct
-* 5. Apps with `envParser` (no routes): Runs SnifferEnvironmentParser to detect usage
-* 6. Apps with neither: Returns empty
-*
-* This function handles "fire and forget" async operations gracefully,
-* capturing errors and unhandled rejections without failing the build.
-*
-* @param app - The normalized app configuration
-* @param appName - The name of the app
-* @param workspacePath - Absolute path to the workspace root
-* @param options - Optional configuration for sniffing behavior
-* @returns The sniffed environment with required variables
-*/
-async function sniffAppEnvironment(app, appName, workspacePath, options = {}) {
-	const { logWarnings = true } = options;
-	if (app.type === "frontend") {
-		const depVars = (app.dependencies ?? []).map((dep) => `NEXT_PUBLIC_${dep.toUpperCase()}_URL`);
-		if (app.config) {
-			const sniffedVars = [];
-			const configPaths = [];
-			if (app.config.client) configPaths.push(app.config.client);
-			if (app.config.server) configPaths.push(app.config.server);
-			for (const configPath of configPaths) {
-				const result = await sniffEntryFile(configPath, app.path, workspacePath);
-				if (logWarnings && result.error) console.warn(`[sniffer] ${appName}: Config file "${configPath}" threw error during sniffing (env vars still captured): ${result.error.message}`);
-				sniffedVars.push(...result.envVars);
-			}
-			const allVars = [...new Set([...depVars, ...sniffedVars])];
-			return {
-				appName,
-				requiredEnvVars: allVars
-			};
-		}
-		return {
-			appName,
-			requiredEnvVars: depVars
-		};
-	}
-	if (app.entry) {
-		const result = await sniffEntryFile(app.entry, app.path, workspacePath);
-		if (logWarnings && result.error) console.warn(`[sniffer] ${appName}: Entry file threw error during sniffing (env vars still captured): ${result.error.message}`);
-		return {
-			appName,
-			requiredEnvVars: result.envVars
-		};
-	}
-	if (app.routes) {
-		const result = await sniffRouteFiles(normalizeRoutes(app.routes), app.path, workspacePath);
-		if (logWarnings && result.error) console.warn(`[sniffer] ${appName}: Route sniffing threw error (env vars still captured): ${result.error.message}`);
-		return {
-			appName,
-			requiredEnvVars: result.envVars
-		};
-	}
-	if (app.envParser) {
-		const result = await sniffEnvParser(app.envParser, app.path, workspacePath);
-		if (logWarnings) {
-			if (result.error) console.warn(`[sniffer] ${appName}: envParser threw error during sniffing (env vars still captured): ${result.error.message}`);
-			if (result.unhandledRejections.length > 0) console.warn(`[sniffer] ${appName}: Fire-and-forget rejections during sniffing (suppressed): ${result.unhandledRejections.map((e) => e.message).join(", ")}`);
-		}
-		return {
-			appName,
-			requiredEnvVars: result.envVars
-		};
-	}
-	return {
-		appName,
-		requiredEnvVars: []
-	};
-}
-/**
-* Sniff an entry file by importing it in a subprocess.
-*
-* Entry apps call `config.parse()` at module load time. To capture which
-* env vars are accessed, we:
-* 1. Spawn a subprocess with a module loader hook
-* 2. The loader intercepts `@geekmidas/envkit` and replaces EnvironmentParser
-*    with SnifferEnvironmentParser
-* 3. Import the entry file (triggers config.parse())
-* 4. Capture and return the accessed env var names
-*
-* This approach provides process isolation - each app is sniffed in its own
-* subprocess, preventing module cache pollution.
-*
-* @param entryPath - Relative path to the entry file (e.g., './src/index.ts')
-* @param appPath - The app's path relative to workspace (e.g., 'apps/auth')
-* @param workspacePath - Absolute path to workspace root
-* @returns EntrySniffResult with env vars and optional error
-*/
-async function sniffEntryFile(entryPath, appPath, workspacePath) {
-	const fullEntryPath = resolve(workspacePath, appPath, entryPath);
-	const loaderPath = resolveSnifferFile("sniffer-loader");
-	const workerPath = resolveSnifferFile("sniffer-worker");
-	return new Promise((resolvePromise) => {
-		const child = spawn("node", [
-			"--import",
-			loaderPath,
-			workerPath,
-			fullEntryPath
-		], {
-			cwd: resolve(workspacePath, appPath),
-			stdio: [
-				"ignore",
-				"pipe",
-				"pipe"
-			],
-			env: {
-				...process.env,
-				NODE_OPTIONS: "--import=tsx"
-			}
-		});
-		let stdout$1 = "";
-		let stderr = "";
-		child.stdout.on("data", (data) => {
-			stdout$1 += data.toString();
-		});
-		child.stderr.on("data", (data) => {
-			stderr += data.toString();
-		});
-		child.on("close", (code) => {
-			try {
-				const jsonMatch = stdout$1.match(/\{[^{}]*"envVars"[^{}]*\}[^{]*$/);
-				if (jsonMatch) {
-					const result = JSON.parse(jsonMatch[0]);
-					resolvePromise({
-						envVars: result.envVars || [],
-						error: result.error ? new Error(result.error) : void 0
-					});
-					return;
-				}
-			} catch {}
-			resolvePromise({
-				envVars: [],
-				error: new Error(`Failed to sniff entry file (exit code ${code}): ${stderr || stdout$1 || "No output"}`)
-			});
-		});
-		child.on("error", (err) => {
-			resolvePromise({
-				envVars: [],
-				error: err
-			});
-		});
-	});
-}
-/**
-* Sniff route files by loading constructs and calling getEnvironment().
-*
-* Route-based apps have endpoints, functions, crons, and subscribers that
-* use services. Each service's register() method accesses environment variables.
-*
-* This runs in a subprocess with tsx loader to properly handle TypeScript
-* compilation and path alias resolution (e.g., `src/...` imports).
-*
-* @param routes - Glob pattern(s) for route files
-* @param appPath - The app's path relative to workspace (e.g., 'apps/api')
-* @param workspacePath - Absolute path to workspace root
-* @returns EntrySniffResult with env vars and optional error
-*/
-async function sniffRouteFiles(routes, appPath, workspacePath) {
-	const fullAppPath = resolve(workspacePath, appPath);
-	const workerPath = resolveSnifferFile("sniffer-routes-worker");
-	const tsxPath = resolveTsxPath();
-	const routesArray = Array.isArray(routes) ? routes : [routes];
-	const pattern = routesArray[0];
-	if (!pattern) return {
-		envVars: [],
-		error: new Error("No route patterns provided")
-	};
-	return new Promise((resolvePromise) => {
-		const child = spawn("node", [
-			"--import",
-			tsxPath,
-			workerPath,
-			fullAppPath,
-			pattern
-		], {
-			cwd: fullAppPath,
-			stdio: [
-				"ignore",
-				"pipe",
-				"pipe"
-			],
-			env: { ...process.env }
-		});
-		let stdout$1 = "";
-		let stderr = "";
-		child.stdout.on("data", (data) => {
-			stdout$1 += data.toString();
-		});
-		child.stderr.on("data", (data) => {
-			stderr += data.toString();
-		});
-		child.on("close", (code) => {
-			if (stderr) stderr.split("\n").filter((line) => line.trim()).forEach((line) => console.warn(line));
-			try {
-				const jsonMatch = stdout$1.match(/\{[^{}]*"envVars"[^{}]*\}[^{]*$/);
-				if (jsonMatch) {
-					const result = JSON.parse(jsonMatch[0]);
-					resolvePromise({
-						envVars: result.envVars || [],
-						error: result.error ? new Error(result.error) : void 0
-					});
-					return;
-				}
-			} catch {}
-			resolvePromise({
-				envVars: [],
-				error: new Error(`Failed to sniff route files (exit code ${code}): ${stderr || stdout$1 || "No output"}`)
-			});
-		});
-		child.on("error", (err) => {
-			resolvePromise({
-				envVars: [],
-				error: err
-			});
-		});
-	});
-}
-/**
-* Run the SnifferEnvironmentParser on an envParser module to detect
-* which environment variables it accesses.
-*
-* This function handles "fire and forget" async operations by using
-* the shared sniffWithFireAndForget utility from @geekmidas/envkit.
-*
-* @param envParserPath - The envParser config (e.g., './src/config/env#envParser')
-* @param appPath - The app's path relative to workspace
-* @param workspacePath - Absolute path to workspace root
-* @returns SniffResult with env vars and any errors encountered
-*/
-async function sniffEnvParser(envParserPath, appPath, workspacePath) {
-	const [modulePath, exportName = "default"] = envParserPath.split("#");
-	if (!modulePath) return {
-		envVars: [],
-		unhandledRejections: []
-	};
-	const fullPath = resolve(workspacePath, appPath, modulePath);
-	let SnifferEnvironmentParser;
-	let sniffWithFireAndForget;
-	try {
-		const envkitModule = await import("@geekmidas/envkit/sniffer");
-		SnifferEnvironmentParser = envkitModule.SnifferEnvironmentParser;
-		sniffWithFireAndForget = envkitModule.sniffWithFireAndForget;
-	} catch (error) {
-		const message = error instanceof Error ? error.message : String(error);
-		console.warn(`[sniffer] Failed to import SnifferEnvironmentParser: ${message}`);
-		return {
-			envVars: [],
-			unhandledRejections: []
-		};
-	}
-	const sniffer = new SnifferEnvironmentParser();
-	return sniffWithFireAndForget(sniffer, async () => {
-		const moduleUrl = pathToFileURL(fullPath).href;
-		const module = await import(moduleUrl);
-		const envParser = module[exportName];
-		if (typeof envParser !== "function") {
-			console.warn(`[sniffer] Export "${exportName}" from "${modulePath}" is not a function`);
-			return;
-		}
-		const result = envParser(sniffer);
-		if (result && typeof result.parse === "function") try {
-			result.parse();
-		} catch {}
-	});
-}
-/**
-* Sniff environment requirements for multiple apps.
-*
-* @param apps - Map of app name to app config
-* @param workspacePath - Absolute path to workspace root
-* @param options - Optional configuration for sniffing behavior
-* @returns Map of app name to sniffed environment
-*/
-async function sniffAllApps(apps, workspacePath, options = {}) {
-	const results = /* @__PURE__ */ new Map();
-	for (const [appName, app] of Object.entries(apps)) {
-		const sniffed = await sniffAppEnvironment(app, appName, workspacePath, options);
-		results.set(appName, sniffed);
-	}
-	return results;
-}
-
 //#endregion
 //#region src/deploy/index.ts
 const logger$3 = console;
@@ -6154,7 +5862,7 @@ async function workspaceDeployCommand(workspace, options) {
 	}
 	if (workspace.deploy?.backups && provisionedPostgres) {
 		logger$3.log("\n💾 Provisioning backup destination...");
-		const { provisionBackupDestination } = await import("./backup-provisioner-BEXoHTuC.mjs");
+		const { provisionBackupDestination } = await import("./backup-provisioner-CCUcj28C.mjs");
 		const backupState = await provisionBackupDestination({
 			api,
 			projectId: project.projectId,
@@ -6806,7 +6514,7 @@ const GEEKMIDAS_VERSIONS = {
 	"@geekmidas/cache": "~1.1.0",
 	"@geekmidas/client": "~4.0.4",
 	"@geekmidas/cloud": "~1.0.0",
-	"@geekmidas/constructs": "~3.0.5",
+	"@geekmidas/constructs": "~3.0.7",
 	"@geekmidas/db": "~1.0.1",
 	"@geekmidas/emailkit": "~1.0.0",
 	"@geekmidas/envkit": "~1.0.4",
@@ -8068,7 +7776,7 @@ export default defineWorkspace({
       schema: 'zod',
     },
   },`;
-	if (services.db || services.cache || services.mail) {
+	if (services.db || services.cache || services.mail || services.storage || services.events) {
 		config$1 += `
   services: {`;
 		if (services.db) config$1 += `
@@ -8077,6 +7785,10 @@ export default defineWorkspace({
     cache: true,`;
 		if (services.mail) config$1 += `
     mail: true,`;
+		if (services.storage) config$1 += `
+    storage: true,`;
+		if (services.events) config$1 += `
+    events: '${services.events}',`;
 		config$1 += `
   },`;
 	}
@@ -8933,6 +8645,10 @@ export const telescope = new Telescope({
 */
 const OPENAPI_OUTPUT_PATH$1 = "./.gkm/openapi.ts";
 /**
+* Endpoints output path (generated by gkm dev/build)
+*/
+const ENDPOINTS_OUTPUT_PATH = "./.gkm/server/endpoints.ts";
+/**
 * All available templates
 */
 const templates = {
@@ -9132,7 +8848,10 @@ function generatePackageJson(options, template) {
 		version: "0.0.1",
 		private: true,
 		type: "module",
-		exports: { "./client": OPENAPI_OUTPUT_PATH$1 },
+		exports: {
+			"./client": OPENAPI_OUTPUT_PATH$1,
+			"./endpoints": ENDPOINTS_OUTPUT_PATH
+		},
 		scripts: scripts$1,
 		dependencies: sortObject(dependencies$1),
 		devDependencies: sortObject(devDependencies$1)
@@ -11299,7 +11018,7 @@ async function initCommand(projectName, options = {}) {
 		"mail",
 		"storage"
 	] : answers.services || [];
-	const eventsBackend = options.yes ? isFullstack ? "pgboss" : void 0 : answers.eventsBackend;
+	const eventsBackend = options.yes ? "pgboss" : answers.eventsBackend;
 	const services = {
 		db: servicesArray.includes("db"),
 		cache: servicesArray.includes("cache"),
@@ -12228,7 +11947,7 @@ program.command("setup").description("Setup development environment (secrets, Do
 		process.exit(1);
 	}
 });
-program.command("build").description("Build handlers from endpoints, functions, and crons").option("--provider <provider>", "Target provider for generated handlers (aws, server)").option("--providers <providers>", "[DEPRECATED] Use --provider instead. Target providers for generated handlers (comma-separated)").option("--enable-openapi", "Enable OpenAPI documentation generation for server builds").option("--production", "Build for production (no dev tools, bundled output)").option("--skip-bundle", "Skip bundling step in production build").option("--stage <stage>", "Inject encrypted secrets for deployment stage").action(async (options) => {
+program.command("build").description("Build handlers from endpoints, functions, and crons").option("--provider <provider>", "Target provider for generated handlers (aws, server)").option("--providers <providers>", "[DEPRECATED] Use --provider instead. Target providers for generated handlers (comma-separated)").option("--enable-openapi", "Enable OpenAPI documentation generation for server builds").option("--production", "Build for production (no dev tools, bundled output)").option("--skip-bundle", "Skip bundling step in production build").option("--stage <stage>", "Inject encrypted secrets for deployment stage").option("--mark-optional", "Suffix optional env vars with ? in manifest envVars field (e.g. PORT?)").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -12239,7 +11958,8 @@ program.command("build").description("Build handlers from endpoints, functions,
 				enableOpenApi: options.enableOpenapi || false,
 				production: options.production || false,
 				skipBundle: options.skipBundle || false,
-				stage: options.stage
+				stage: options.stage,
+				markOptional: options.markOptional || false
 			});
 		} else if (options.providers) {
 			const providerList = [...new Set(options.providers.split(",").map((p) => p.trim()))];
@@ -12248,13 +11968,15 @@ program.command("build").description("Build handlers from endpoints, functions,
 				enableOpenApi: options.enableOpenapi || false,
 				production: options.production || false,
 				skipBundle: options.skipBundle || false,
-				stage: options.stage
+				stage: options.stage,
+				markOptional: options.markOptional || false
 			});
 		} else await buildCommand({
 			enableOpenApi: options.enableOpenapi || false,
 			production: options.production || false,
 			skipBundle: options.skipBundle || false,
-			stage: options.stage
+			stage: options.stage,
+			markOptional: options.markOptional || false
 		});
 	} catch (error) {
 		console.error(formatError(error));
@@ -12429,8 +12151,8 @@ program.command("secrets:push").description("Push secrets to remote provider (SS
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig: loadWorkspaceConfig$1 } = await import("./config.mjs");
-		const { pushSecrets: pushSecrets$1 } = await import("./sync-COnAugP-.mjs");
-		const { reconcileMissingSecrets } = await import("./reconcile-DAAKa0YR.mjs");
+		const { pushSecrets: pushSecrets$1 } = await import("./sync-fzT5WX_y.mjs");
+		const { reconcileMissingSecrets } = await import("./reconcile-D423q2QW.mjs");
 		const { readStageSecrets: readStageSecrets$1, writeStageSecrets: writeStageSecrets$1 } = await import("./storage-Cs4WBsc4.mjs");
 		const { workspace } = await loadWorkspaceConfig$1();
 		const secrets = await readStageSecrets$1(options.stage, workspace.root);
@@ -12454,9 +12176,9 @@ program.command("secrets:pull").description("Pull secrets from remote provider (
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig: loadWorkspaceConfig$1 } = await import("./config.mjs");
-		const { pullSecrets: pullSecrets$1 } = await import("./sync-COnAugP-.mjs");
+		const { pullSecrets: pullSecrets$1 } = await import("./sync-fzT5WX_y.mjs");
 		const { writeStageSecrets: writeStageSecrets$1 } = await import("./storage-Cs4WBsc4.mjs");
-		const { reconcileMissingSecrets } = await import("./reconcile-DAAKa0YR.mjs");
+		const { reconcileMissingSecrets } = await import("./reconcile-D423q2QW.mjs");
 		const { workspace } = await loadWorkspaceConfig$1();
 		let secrets = await pullSecrets$1(options.stage, workspace);
 		if (!secrets) {
@@ -12481,7 +12203,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig: loadWorkspaceConfig$1 } = await import("./config.mjs");
-		const { reconcileMissingSecrets } = await import("./reconcile-DAAKa0YR.mjs");
+		const { reconcileMissingSecrets } = await import("./reconcile-D423q2QW.mjs");
 		const { readStageSecrets: readStageSecrets$1, writeStageSecrets: writeStageSecrets$1 } = await import("./storage-Cs4WBsc4.mjs");
 		const { workspace } = await loadWorkspaceConfig$1();
 		const secrets = await readStageSecrets$1(options.stage, workspace.root);