@geekmidas/cli 1.10.30 → 1.10.31

package/dist/index.cjs

@@ -1,16 +1,18 @@
 #!/usr/bin/env -S npx tsx
 const require_chunk = require('./chunk-CUT6urMc.cjs');
-const require_workspace = require('./workspace-4SP3Gx4Y.cjs');
-const require_config = require('./config-D3ORuiUs.cjs');
+const require_workspace = require('./workspace-CGYykWfn.cjs');
+const require_config = require('./config-Cuo8vFsp.cjs');
 const require_credentials = require('./credentials-C8DWtnMY.cjs');
 const require_fullstack_secrets = require('./fullstack-secrets-Bchl2MDd.cjs');
 const require_storage = require('./storage-B1wvztiJ.cjs');
-const require_openapi = require('./openapi-ClA8lIhO.cjs');
-const require_dokploy_api = require('./dokploy-api-Dvyq-LsM.cjs');
-const require_encryption = require('./encryption-DgKS-Dv9.cjs');
-const require_CachedStateProvider = require('./CachedStateProvider-CxsXOKkg.cjs');
-const require_openapi_react_query = require('./openapi-react-query-DYbBq-WJ.cjs');
-const require_sync = require('./sync-DGXXSk2v.cjs');
+const require_client_generator = require('./client-generator-D-T4ypQo.cjs');
+const require_openapi = require('./openapi-w-_smBTO.cjs');
+const require_dokploy_api = require('./dokploy-api-CqOIKHme.cjs');
+const require_encryption = require('./encryption-MfXAiFTm.cjs');
+const require_sniffer = require('./sniffer-CBhzByiY.cjs');
+const require_CachedStateProvider = require('./CachedStateProvider-Cyn17x3x.cjs');
+const require_openapi_react_query = require('./openapi-react-query-CxyQTTdF.cjs');
+const require_sync = require('./sync-BWY6yoUG.cjs');
 const node_fs = require_chunk.__toESM(require("node:fs"));
 const node_path = require_chunk.__toESM(require("node:path"));
 const commander = require_chunk.__toESM(require("commander"));
@@ -30,12 +32,11 @@ const __geekmidas_constructs_subscribers = require_chunk.__toESM(require("@geekm
 const pg = require_chunk.__toESM(require("pg"));
 const node_dns_promises = require_chunk.__toESM(require("node:dns/promises"));
 const node_module = require_chunk.__toESM(require("node:module"));
-const node_url = require_chunk.__toESM(require("node:url"));
 const prompts = require_chunk.__toESM(require("prompts"));
 
 //#region package.json
 var name = "@geekmidas/cli";
-var version = "1.10.29";
+var version = "1.10.30";
 var description = "CLI tools for building Lambda handlers, server applications, and generating OpenAPI specs";
 var private$1 = false;
 var type = "module";
@@ -138,7 +139,7 @@ const logger$14 = console;
 * Validate Dokploy token by making a test API call
 */
 async function validateDokployToken(endpoint, token) {
-	const { DokployApi: DokployApi$1 } = await Promise.resolve().then(() => require("./dokploy-api-BOx71j6F.cjs"));
+	const { DokployApi: DokployApi$1 } = await Promise.resolve().then(() => require("./dokploy-api-BPYkG-ZZ.cjs"));
 	const api = new DokployApi$1({
 		baseUrl: endpoint,
 		token
@@ -152,7 +153,7 @@ async function prompt$1(message, hidden = false) {
 	if (!process.stdin.isTTY) throw new Error("Interactive input required. Please provide --token option.");
 	if (hidden) {
 		process.stdout.write(message);
-		return new Promise((resolve$4, reject) => {
+		return new Promise((resolve$3, reject) => {
 			let value = "";
 			const cleanup = () => {
 				process.stdin.setRawMode(false);
@@ -169,7 +170,7 @@ async function prompt$1(message, hidden = false) {
 				if (c === "\n" || c === "\r") {
 					cleanup();
 					process.stdout.write("\n");
-					resolve$4(value);
+					resolve$3(value);
 				} else if (c === "") {
 					cleanup();
 					process.stdout.write("\n");
@@ -374,15 +375,15 @@ function loadEnvFiles(envConfig, cwd = process.cwd()) {
 * @internal Exported for testing
 */
 async function isPortAvailable(port) {
-	return new Promise((resolve$4) => {
+	return new Promise((resolve$3) => {
 		const server = (0, node_net.createServer)();
 		server.once("error", (err) => {
-			if (err.code === "EADDRINUSE") resolve$4(false);
-			else resolve$4(false);
+			if (err.code === "EADDRINUSE") resolve$3(false);
+			else resolve$3(false);
 		});
 		server.once("listening", () => {
 			server.close();
-			resolve$4(true);
+			resolve$3(true);
 		});
 		server.listen(port);
 	});
@@ -1140,11 +1141,11 @@ async function execCommand(commandArgs, options = {}) {
 			NODE_OPTIONS: nodeOptions
 		}
 	});
-	const exitCode = await new Promise((resolve$4) => {
-		child.on("close", (code) => resolve$4(code ?? 0));
+	const exitCode = await new Promise((resolve$3) => {
+		child.on("close", (code) => resolve$3(code ?? 0));
 		child.on("error", (error) => {
 			logger$12.error(`Failed to run command: ${error.message}`);
-			resolve$4(1);
+			resolve$3(1);
 		});
 	});
 	if (exitCode !== 0) process.exit(exitCode);
@@ -1646,14 +1647,14 @@ async function workspaceDevCommand(workspace, options) {
 	};
 	process.on("SIGINT", shutdown);
 	process.on("SIGTERM", shutdown);
-	return new Promise((resolve$4, reject) => {
+	return new Promise((resolve$3, reject) => {
 		turboProcess.on("error", (error) => {
 			logger$11.error("❌ Turbo error:", error);
 			reject(error);
 		});
 		turboProcess.on("exit", (code) => {
 			if (code !== null && code !== 0) reject(new Error(`Turbo exited with code ${code}`));
-			else resolve$4();
+			else resolve$3();
 		});
 	});
 }
@@ -1765,7 +1766,7 @@ var EntryRunner = class {
 			if (code !== null && code !== 0 && code !== 143) logger$11.error(`❌ Process exited with code ${code}`);
 			this.isRunning = false;
 		});
-		await new Promise((resolve$4) => setTimeout(resolve$4, 500));
+		await new Promise((resolve$3) => setTimeout(resolve$3, 500));
 		if (this.isRunning) {
 			logger$11.log("");
 			logger$11.log(`  \x1b[32m✓ Ready\x1b[0m at \x1b[36mhttp://localhost:${this.port}\x1b[0m`);
@@ -1774,7 +1775,7 @@ var EntryRunner = class {
 	}
 	async restart() {
 		this.stopProcess();
-		await new Promise((resolve$4) => setTimeout(resolve$4, 500));
+		await new Promise((resolve$3) => setTimeout(resolve$3, 500));
 		await this.runProcess();
 	}
 	stop() {
@@ -1909,7 +1910,7 @@ var DevServer = class {
 			if (code !== null && code !== 0 && signal !== "SIGTERM") logger$11.error(`❌ Server exited with code ${code}`);
 			this.isRunning = false;
 		});
-		await new Promise((resolve$4) => setTimeout(resolve$4, 1e3));
+		await new Promise((resolve$3) => setTimeout(resolve$3, 1e3));
 		if (this.isRunning) {
 			const base = `http://localhost:${this.actualPort}`;
 			const lines = [`  Local:     ${base}`];
@@ -1955,7 +1956,7 @@ var DevServer = class {
 		let attempts = 0;
 		while (attempts < 30) {
 			if (await isPortAvailable(portToReuse)) break;
-			await new Promise((resolve$4) => setTimeout(resolve$4, 100));
+			await new Promise((resolve$3) => setTimeout(resolve$3, 100));
 			attempts++;
 		}
 		this.requestedPort = portToReuse;
@@ -2202,18 +2203,25 @@ async function buildCommand(options) {
 	}
 	const rootOutputDir = (0, node_path.join)(process.cwd(), ".gkm");
 	await (0, node_fs_promises.mkdir)(rootOutputDir, { recursive: true });
+	let optionalVarSet;
+	if (options.markOptional && config.envParser) try {
+		const { _sniffEnvParser } = await Promise.resolve().then(() => require("./sniffer-eZ13G10M.cjs"));
+		const sniffed = await _sniffEnvParser(config.envParser, process.cwd(), process.cwd());
+		if (sniffed.optionalEnvVars.length > 0) optionalVarSet = new Set(sniffed.optionalEnvVars);
+	} catch {}
 	let result = {};
 	for (const provider of resolved.providers) {
-		const providerResult = await buildForProvider(provider, buildContext, rootOutputDir, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, allEndpoints, allFunctions, allCrons, allSubscribers, resolved.enableOpenApi, options.skipBundle ?? false, options.stage);
+		const providerResult = await buildForProvider(provider, buildContext, rootOutputDir, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, allEndpoints, allFunctions, allCrons, allSubscribers, resolved.enableOpenApi, options.skipBundle ?? false, options.stage, optionalVarSet);
 		if (providerResult.masterKey) result = providerResult;
 	}
+	await require_openapi.generateOpenApi(config, { bustCache: true });
 	return result;
 }
-async function buildForProvider(provider, context, rootOutputDir, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, endpoints, functions, crons, subscribers, enableOpenApi, skipBundle, stage) {
+async function buildForProvider(provider, context, rootOutputDir, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, endpoints, functions, crons, subscribers, enableOpenApi, skipBundle, stage, optionalVarSet) {
 	const outputDir = (0, node_path.join)(process.cwd(), ".gkm", provider);
 	await (0, node_fs_promises.mkdir)(outputDir, { recursive: true });
 	logger$9.log(`\nGenerating handlers for provider: ${provider}`);
-	const [routes, functionInfos, cronInfos, subscriberInfos] = await Promise.all([
+	const [rawRoutes, rawFunctions, rawCrons, rawSubscribers] = await Promise.all([
 		endpointGenerator.build(context, endpoints, outputDir, {
 			provider,
 			enableOpenApi
@@ -2222,6 +2230,23 @@ async function buildForProvider(provider, context, rootOutputDir, endpointGenera
 		cronGenerator.build(context, crons, outputDir, { provider }),
 		subscriberGenerator.build(context, subscribers, outputDir, { provider })
 	]);
+	const markEnv = optionalVarSet ? (vars) => vars?.map((v) => optionalVarSet.has(v) ? `${v}?` : v) : (vars) => vars;
+	const routes = rawRoutes.map((r) => ({
+		...r,
+		environment: markEnv(r.environment)
+	}));
+	const functionInfos = rawFunctions.map((f) => ({
+		...f,
+		environment: markEnv(f.environment)
+	}));
+	const cronInfos = rawCrons.map((c) => ({
+		...c,
+		environment: markEnv(c.environment)
+	}));
+	const subscriberInfos = rawSubscribers.map((s) => ({
+		...s,
+		environment: markEnv(s.environment)
+	}));
 	logger$9.log(`Generated ${routes.length} routes, ${functionInfos.length} functions, ${cronInfos.length} crons, ${subscriberInfos.length} subscribers for ${provider}`);
 	const manifestRoutes = assembleManifestField(routes, endpoints);
 	const manifestFunctions = assembleManifestField(functionInfos, functions);
@@ -2243,7 +2268,7 @@ async function buildForProvider(provider, context, rootOutputDir, endpointGenera
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$9.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-BG6P249p.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-CLOenWgi.cjs"));
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -2313,7 +2338,7 @@ async function workspaceBuildCommand(workspace, options) {
 	try {
 		const turboCommand = getTurboCommand(pm);
 		logger$9.log(`Running: ${turboCommand}`);
-		await new Promise((resolve$4, reject) => {
+		await new Promise((resolve$3, reject) => {
 			const child = (0, node_child_process.spawn)(turboCommand, {
 				shell: true,
 				cwd: workspace.root,
@@ -2324,7 +2349,7 @@ async function workspaceBuildCommand(workspace, options) {
 				}
 			});
 			child.on("close", (code) => {
-				if (code === 0) resolve$4();
+				if (code === 0) resolve$3();
 				else reject(new Error(`Turbo build failed with exit code ${code}`));
 			});
 			child.on("error", (err) => {
@@ -2341,6 +2366,7 @@ async function workspaceBuildCommand(workspace, options) {
 			});
 		}
 		logger$9.log(`\n✅ Workspace build complete!`);
+		await require_openapi.openapiCommand({ cwd: workspace.root });
 		logger$9.log(`\n📋 Build Summary:`);
 		for (const result of results) {
 			const icon = result.type === "backend" ? "⚙️" : "🌐";
@@ -2371,7 +2397,7 @@ function getAppOutputPath(workspace, _appName, app) {
 * Format routes for logging, handling PartitionedRoutes.
 */
 function formatRoutes(routes) {
-	if (require_openapi.isPartitionedRoutes(routes)) {
+	if (require_client_generator.isPartitionedRoutes(routes)) {
 		const paths = Array.isArray(routes.paths) ? routes.paths.join(", ") : routes.paths;
 		return `${paths} (partitioned)`;
 	}
@@ -2569,11 +2595,11 @@ async function createDnsProvider(options) {
 	if (isDnsProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "hostinger") {
-		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-5KYmwoK2.cjs"));
+		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-C5oLa7N7.cjs"));
 		return new HostingerProvider();
 	}
 	if (provider === "route53") {
-		const { Route53Provider } = await Promise.resolve().then(() => require("./Route53Provider-owQQ4pn6.cjs"));
+		const { Route53Provider } = await Promise.resolve().then(() => require("./Route53Provider-DISZ6E8f.cjs"));
 		const route53Config = config;
 		return new Route53Provider({
 			region: route53Config.region,
@@ -3123,6 +3149,7 @@ services:
     restart: unless-stopped
     environment:
       MP_SMTP_AUTH: \${SMTP_USER:-${imageName}}:\${SMTP_PASS:-${imageName}}
+      MP_SMTP_AUTH_ALLOW_INSECURE: true
     ports:
       - "\${MAILPIT_PORT:-8025}:8025"  # Web UI / API
       - "\${SMTP_PORT:-1025}:1025"  # SMTP
@@ -3287,6 +3314,7 @@ services:
     restart: unless-stopped
     environment:
       MP_SMTP_AUTH: \${SMTP_USER:-${workspace.name}}:\${SMTP_PASS:-${workspace.name}}
+      MP_SMTP_AUTH_ALLOW_INSECURE: true
     ports:
       - "\${MAILPIT_PORT:-8025}:8025"  # Web UI / API
       - "\${SMTP_PORT:-1025}:1025"  # SMTP
@@ -5042,20 +5070,20 @@ function isStateProvider(value) {
 async function createStateProvider(options) {
 	const { config, workspaceRoot, workspaceName } = options;
 	if (!config) {
-		const { LocalStateProvider } = await Promise.resolve().then(() => require("./LocalStateProvider-CLifRC0Y.cjs"));
+		const { LocalStateProvider } = await Promise.resolve().then(() => require("./LocalStateProvider-DI6n11UM.cjs"));
 		return new LocalStateProvider(workspaceRoot);
 	}
 	if (isStateProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "local") {
-		const { LocalStateProvider } = await Promise.resolve().then(() => require("./LocalStateProvider-CLifRC0Y.cjs"));
+		const { LocalStateProvider } = await Promise.resolve().then(() => require("./LocalStateProvider-DI6n11UM.cjs"));
 		return new LocalStateProvider(workspaceRoot);
 	}
 	if (provider === "ssm") {
 		if (!workspaceName) throw new Error("Workspace name is required for SSM state provider. Set \"name\" in gkm.config.ts.");
-		const { LocalStateProvider } = await Promise.resolve().then(() => require("./LocalStateProvider-CLifRC0Y.cjs"));
-		const { SSMStateProvider } = await Promise.resolve().then(() => require("./SSMStateProvider-CT8tjl9o.cjs"));
-		const { CachedStateProvider: CachedStateProvider$1 } = await Promise.resolve().then(() => require("./CachedStateProvider-37pG1HBx.cjs"));
+		const { LocalStateProvider } = await Promise.resolve().then(() => require("./LocalStateProvider-DI6n11UM.cjs"));
+		const { SSMStateProvider } = await Promise.resolve().then(() => require("./SSMStateProvider-BljH5efc.cjs"));
+		const { CachedStateProvider: CachedStateProvider$1 } = await Promise.resolve().then(() => require("./CachedStateProvider-3couMAQk.cjs"));
 		const ssmConfig = config;
 		const local = new LocalStateProvider(workspaceRoot);
 		const ssm = SSMStateProvider.create({
@@ -5165,326 +5193,6 @@ function generateSecretsReport(encryptedApps, sniffedApps) {
 	};
 }
 
-//#endregion
-//#region src/deploy/sniffer.ts
-const __filename$1 = (0, node_url.fileURLToPath)(require("url").pathToFileURL(__filename).href);
-const __dirname$1 = (0, node_path.dirname)(__filename$1);
-/**
-* Resolve the tsx package path from the CLI package's dependencies.
-* This ensures tsx is available regardless of whether the target project has it installed.
-*/
-function resolveTsxPath() {
-	const require$2 = (0, node_module.createRequire)(require("url").pathToFileURL(__filename).href);
-	return require$2.resolve("tsx");
-}
-/**
-* Resolve the path to a sniffer helper file.
-* Handles both dev (.ts with tsx) and production (.mjs from dist).
-*
-* In production: sniffer.ts is bundled into dist/index.mjs, but sniffer helper
-* files are output to dist/deploy/ as standalone modules for subprocess loading.
-*
-* In development: All files are in src/deploy/ and loaded via tsx.
-*/
-function resolveSnifferFile(baseName) {
-	const deployMjsPath = (0, node_path.resolve)(__dirname$1, "deploy", `${baseName}.mjs`);
-	if ((0, node_fs.existsSync)(deployMjsPath)) return deployMjsPath;
-	const mjsPath = (0, node_path.resolve)(__dirname$1, `${baseName}.mjs`);
-	if ((0, node_fs.existsSync)(mjsPath)) return mjsPath;
-	const tsPath = (0, node_path.resolve)(__dirname$1, `${baseName}.ts`);
-	if ((0, node_fs.existsSync)(tsPath)) return tsPath;
-	return tsPath;
-}
-/**
-* Get required environment variables for an app.
-*
-* Detection strategy (in order):
-* 1. Frontend apps: Returns empty (no server secrets)
-* 2. Apps with `requiredEnv`: Uses explicit list from config
-* 3. Entry apps: Imports entry file in subprocess to capture config.parse() calls
-* 4. Route-based apps: Loads route files and calls getEnvironment() on each construct
-* 5. Apps with `envParser` (no routes): Runs SnifferEnvironmentParser to detect usage
-* 6. Apps with neither: Returns empty
-*
-* This function handles "fire and forget" async operations gracefully,
-* capturing errors and unhandled rejections without failing the build.
-*
-* @param app - The normalized app configuration
-* @param appName - The name of the app
-* @param workspacePath - Absolute path to the workspace root
-* @param options - Optional configuration for sniffing behavior
-* @returns The sniffed environment with required variables
-*/
-async function sniffAppEnvironment(app, appName, workspacePath, options = {}) {
-	const { logWarnings = true } = options;
-	if (app.type === "frontend") {
-		const depVars = (app.dependencies ?? []).map((dep) => `NEXT_PUBLIC_${dep.toUpperCase()}_URL`);
-		if (app.config) {
-			const sniffedVars = [];
-			const configPaths = [];
-			if (app.config.client) configPaths.push(app.config.client);
-			if (app.config.server) configPaths.push(app.config.server);
-			for (const configPath of configPaths) {
-				const result = await sniffEntryFile(configPath, app.path, workspacePath);
-				if (logWarnings && result.error) console.warn(`[sniffer] ${appName}: Config file "${configPath}" threw error during sniffing (env vars still captured): ${result.error.message}`);
-				sniffedVars.push(...result.envVars);
-			}
-			const allVars = [...new Set([...depVars, ...sniffedVars])];
-			return {
-				appName,
-				requiredEnvVars: allVars
-			};
-		}
-		return {
-			appName,
-			requiredEnvVars: depVars
-		};
-	}
-	if (app.entry) {
-		const result = await sniffEntryFile(app.entry, app.path, workspacePath);
-		if (logWarnings && result.error) console.warn(`[sniffer] ${appName}: Entry file threw error during sniffing (env vars still captured): ${result.error.message}`);
-		return {
-			appName,
-			requiredEnvVars: result.envVars
-		};
-	}
-	if (app.routes) {
-		const result = await sniffRouteFiles(require_openapi.normalizeRoutes(app.routes), app.path, workspacePath);
-		if (logWarnings && result.error) console.warn(`[sniffer] ${appName}: Route sniffing threw error (env vars still captured): ${result.error.message}`);
-		return {
-			appName,
-			requiredEnvVars: result.envVars
-		};
-	}
-	if (app.envParser) {
-		const result = await sniffEnvParser(app.envParser, app.path, workspacePath);
-		if (logWarnings) {
-			if (result.error) console.warn(`[sniffer] ${appName}: envParser threw error during sniffing (env vars still captured): ${result.error.message}`);
-			if (result.unhandledRejections.length > 0) console.warn(`[sniffer] ${appName}: Fire-and-forget rejections during sniffing (suppressed): ${result.unhandledRejections.map((e) => e.message).join(", ")}`);
-		}
-		return {
-			appName,
-			requiredEnvVars: result.envVars
-		};
-	}
-	return {
-		appName,
-		requiredEnvVars: []
-	};
-}
-/**
-* Sniff an entry file by importing it in a subprocess.
-*
-* Entry apps call `config.parse()` at module load time. To capture which
-* env vars are accessed, we:
-* 1. Spawn a subprocess with a module loader hook
-* 2. The loader intercepts `@geekmidas/envkit` and replaces EnvironmentParser
-*    with SnifferEnvironmentParser
-* 3. Import the entry file (triggers config.parse())
-* 4. Capture and return the accessed env var names
-*
-* This approach provides process isolation - each app is sniffed in its own
-* subprocess, preventing module cache pollution.
-*
-* @param entryPath - Relative path to the entry file (e.g., './src/index.ts')
-* @param appPath - The app's path relative to workspace (e.g., 'apps/auth')
-* @param workspacePath - Absolute path to workspace root
-* @returns EntrySniffResult with env vars and optional error
-*/
-async function sniffEntryFile(entryPath, appPath, workspacePath) {
-	const fullEntryPath = (0, node_path.resolve)(workspacePath, appPath, entryPath);
-	const loaderPath = resolveSnifferFile("sniffer-loader");
-	const workerPath = resolveSnifferFile("sniffer-worker");
-	return new Promise((resolvePromise) => {
-		const child = (0, node_child_process.spawn)("node", [
-			"--import",
-			loaderPath,
-			workerPath,
-			fullEntryPath
-		], {
-			cwd: (0, node_path.resolve)(workspacePath, appPath),
-			stdio: [
-				"ignore",
-				"pipe",
-				"pipe"
-			],
-			env: {
-				...process.env,
-				NODE_OPTIONS: "--import=tsx"
-			}
-		});
-		let stdout = "";
-		let stderr = "";
-		child.stdout.on("data", (data) => {
-			stdout += data.toString();
-		});
-		child.stderr.on("data", (data) => {
-			stderr += data.toString();
-		});
-		child.on("close", (code) => {
-			try {
-				const jsonMatch = stdout.match(/\{[^{}]*"envVars"[^{}]*\}[^{]*$/);
-				if (jsonMatch) {
-					const result = JSON.parse(jsonMatch[0]);
-					resolvePromise({
-						envVars: result.envVars || [],
-						error: result.error ? new Error(result.error) : void 0
-					});
-					return;
-				}
-			} catch {}
-			resolvePromise({
-				envVars: [],
-				error: new Error(`Failed to sniff entry file (exit code ${code}): ${stderr || stdout || "No output"}`)
-			});
-		});
-		child.on("error", (err) => {
-			resolvePromise({
-				envVars: [],
-				error: err
-			});
-		});
-	});
-}
-/**
-* Sniff route files by loading constructs and calling getEnvironment().
-*
-* Route-based apps have endpoints, functions, crons, and subscribers that
-* use services. Each service's register() method accesses environment variables.
-*
-* This runs in a subprocess with tsx loader to properly handle TypeScript
-* compilation and path alias resolution (e.g., `src/...` imports).
-*
-* @param routes - Glob pattern(s) for route files
-* @param appPath - The app's path relative to workspace (e.g., 'apps/api')
-* @param workspacePath - Absolute path to workspace root
-* @returns EntrySniffResult with env vars and optional error
-*/
-async function sniffRouteFiles(routes, appPath, workspacePath) {
-	const fullAppPath = (0, node_path.resolve)(workspacePath, appPath);
-	const workerPath = resolveSnifferFile("sniffer-routes-worker");
-	const tsxPath = resolveTsxPath();
-	const routesArray = Array.isArray(routes) ? routes : [routes];
-	const pattern = routesArray[0];
-	if (!pattern) return {
-		envVars: [],
-		error: new Error("No route patterns provided")
-	};
-	return new Promise((resolvePromise) => {
-		const child = (0, node_child_process.spawn)("node", [
-			"--import",
-			tsxPath,
-			workerPath,
-			fullAppPath,
-			pattern
-		], {
-			cwd: fullAppPath,
-			stdio: [
-				"ignore",
-				"pipe",
-				"pipe"
-			],
-			env: { ...process.env }
-		});
-		let stdout = "";
-		let stderr = "";
-		child.stdout.on("data", (data) => {
-			stdout += data.toString();
-		});
-		child.stderr.on("data", (data) => {
-			stderr += data.toString();
-		});
-		child.on("close", (code) => {
-			if (stderr) stderr.split("\n").filter((line) => line.trim()).forEach((line) => console.warn(line));
-			try {
-				const jsonMatch = stdout.match(/\{[^{}]*"envVars"[^{}]*\}[^{]*$/);
-				if (jsonMatch) {
-					const result = JSON.parse(jsonMatch[0]);
-					resolvePromise({
-						envVars: result.envVars || [],
-						error: result.error ? new Error(result.error) : void 0
-					});
-					return;
-				}
-			} catch {}
-			resolvePromise({
-				envVars: [],
-				error: new Error(`Failed to sniff route files (exit code ${code}): ${stderr || stdout || "No output"}`)
-			});
-		});
-		child.on("error", (err) => {
-			resolvePromise({
-				envVars: [],
-				error: err
-			});
-		});
-	});
-}
-/**
-* Run the SnifferEnvironmentParser on an envParser module to detect
-* which environment variables it accesses.
-*
-* This function handles "fire and forget" async operations by using
-* the shared sniffWithFireAndForget utility from @geekmidas/envkit.
-*
-* @param envParserPath - The envParser config (e.g., './src/config/env#envParser')
-* @param appPath - The app's path relative to workspace
-* @param workspacePath - Absolute path to workspace root
-* @returns SniffResult with env vars and any errors encountered
-*/
-async function sniffEnvParser(envParserPath, appPath, workspacePath) {
-	const [modulePath, exportName = "default"] = envParserPath.split("#");
-	if (!modulePath) return {
-		envVars: [],
-		unhandledRejections: []
-	};
-	const fullPath = (0, node_path.resolve)(workspacePath, appPath, modulePath);
-	let SnifferEnvironmentParser;
-	let sniffWithFireAndForget;
-	try {
-		const envkitModule = await import("@geekmidas/envkit/sniffer");
-		SnifferEnvironmentParser = envkitModule.SnifferEnvironmentParser;
-		sniffWithFireAndForget = envkitModule.sniffWithFireAndForget;
-	} catch (error) {
-		const message = error instanceof Error ? error.message : String(error);
-		console.warn(`[sniffer] Failed to import SnifferEnvironmentParser: ${message}`);
-		return {
-			envVars: [],
-			unhandledRejections: []
-		};
-	}
-	const sniffer = new SnifferEnvironmentParser();
-	return sniffWithFireAndForget(sniffer, async () => {
-		const moduleUrl = (0, node_url.pathToFileURL)(fullPath).href;
-		const module$1 = await import(moduleUrl);
-		const envParser = module$1[exportName];
-		if (typeof envParser !== "function") {
-			console.warn(`[sniffer] Export "${exportName}" from "${modulePath}" is not a function`);
-			return;
-		}
-		const result = envParser(sniffer);
-		if (result && typeof result.parse === "function") try {
-			result.parse();
-		} catch {}
-	});
-}
-/**
-* Sniff environment requirements for multiple apps.
-*
-* @param apps - Map of app name to app config
-* @param workspacePath - Absolute path to workspace root
-* @param options - Optional configuration for sniffing behavior
-* @returns Map of app name to sniffed environment
-*/
-async function sniffAllApps(apps, workspacePath, options = {}) {
-	const results = /* @__PURE__ */ new Map();
-	for (const [appName, app] of Object.entries(apps)) {
-		const sniffed = await sniffAppEnvironment(app, appName, workspacePath, options);
-		results.set(appName, sniffed);
-	}
-	return results;
-}
-
 //#endregion
 //#region src/deploy/index.ts
 const logger$3 = console;
@@ -5495,7 +5203,7 @@ async function prompt(message, hidden = false) {
 	if (!process.stdin.isTTY) throw new Error("Interactive input required. Please configure manually.");
 	if (hidden) {
 		process.stdout.write(message);
-		return new Promise((resolve$4) => {
+		return new Promise((resolve$3) => {
 			let value = "";
 			const onData = (char) => {
 				const c = char.toString();
@@ -5504,7 +5212,7 @@ async function prompt(message, hidden = false) {
 					process.stdin.pause();
 					process.stdin.removeListener("data", onData);
 					process.stdout.write("\n");
-					resolve$4(value);
+					resolve$3(value);
 				} else if (c === "") {
 					process.stdin.setRawMode(false);
 					process.stdin.pause();
@@ -5979,7 +5687,7 @@ async function workspaceDeployCommand(workspace, options) {
 		logger$3.log(`   ⚠️  No secrets found for stage "${stage}"`);
 		logger$3.log(`      Run "gkm secrets:init --stage ${stage}" to create secrets`);
 	}
-	const sniffedApps = await sniffAllApps(workspace.apps, workspace.root);
+	const sniffedApps = await require_sniffer.sniffAllApps(workspace.apps, workspace.root);
 	const encryptedSecrets = stageSecrets ? prepareSecretsForAllApps(stageSecrets, sniffedApps) : /* @__PURE__ */ new Map();
 	if (stageSecrets) {
 		const report = generateSecretsReport(encryptedSecrets, sniffedApps);
@@ -6154,7 +5862,7 @@ async function workspaceDeployCommand(workspace, options) {
 	}
 	if (workspace.deploy?.backups && provisionedPostgres) {
 		logger$3.log("\n💾 Provisioning backup destination...");
-		const { provisionBackupDestination } = await Promise.resolve().then(() => require("./backup-provisioner-C4noe75O.cjs"));
+		const { provisionBackupDestination } = await Promise.resolve().then(() => require("./backup-provisioner-CpirEvO1.cjs"));
 		const backupState = await provisionBackupDestination({
 			api,
 			projectId: project.projectId,
@@ -6806,7 +6514,7 @@ const GEEKMIDAS_VERSIONS = {
 	"@geekmidas/cache": "~1.1.0",
 	"@geekmidas/client": "~4.0.4",
 	"@geekmidas/cloud": "~1.0.0",
-	"@geekmidas/constructs": "~3.0.6",
+	"@geekmidas/constructs": "~3.0.7",
 	"@geekmidas/db": "~1.0.1",
 	"@geekmidas/emailkit": "~1.0.0",
 	"@geekmidas/envkit": "~1.0.4",
@@ -8068,7 +7776,7 @@ export default defineWorkspace({
       schema: 'zod',
     },
   },`;
-	if (services.db || services.cache || services.mail) {
+	if (services.db || services.cache || services.mail || services.storage || services.events) {
 		config += `
   services: {`;
 		if (services.db) config += `
@@ -8077,6 +7785,10 @@ export default defineWorkspace({
     cache: true,`;
 		if (services.mail) config += `
     mail: true,`;
+		if (services.storage) config += `
+    storage: true,`;
+		if (services.events) config += `
+    events: '${services.events}',`;
 		config += `
   },`;
 	}
@@ -11306,7 +11018,7 @@ async function initCommand(projectName, options = {}) {
 		"mail",
 		"storage"
 	] : answers.services || [];
-	const eventsBackend = options.yes ? isFullstack ? "pgboss" : void 0 : answers.eventsBackend;
+	const eventsBackend = options.yes ? "pgboss" : answers.eventsBackend;
 	const services = {
 		db: servicesArray.includes("db"),
 		cache: servicesArray.includes("cache"),
@@ -11995,7 +11707,7 @@ async function testCommand(options = {}) {
 	});
 	let finalCredentials = { ...result.credentials };
 	if (result.appInfo) {
-		const sniffed = await sniffAppEnvironment(result.appInfo.app, result.appInfo.appName, result.appInfo.workspaceRoot, { logWarnings: false });
+		const sniffed = await require_sniffer.sniffAppEnvironment(result.appInfo.app, result.appInfo.appName, result.appInfo.workspaceRoot, { logWarnings: false });
 		if (sniffed.requiredEnvVars.length > 0) {
 			const needed = new Set(sniffed.requiredEnvVars);
 			const filtered = {};
@@ -12034,9 +11746,9 @@ async function testCommand(options = {}) {
 			NODE_OPTIONS: nodeOptions
 		}
 	});
-	return new Promise((resolve$4, reject) => {
+	return new Promise((resolve$3, reject) => {
 		vitestProcess.on("close", (code) => {
-			if (code === 0) resolve$4();
+			if (code === 0) resolve$3();
 			else reject(new Error(`Tests failed with exit code ${code}`));
 		});
 		vitestProcess.on("error", (error) => {
@@ -12235,7 +11947,7 @@ program.command("setup").description("Setup development environment (secrets, Do
 		process.exit(1);
 	}
 });
-program.command("build").description("Build handlers from endpoints, functions, and crons").option("--provider <provider>", "Target provider for generated handlers (aws, server)").option("--providers <providers>", "[DEPRECATED] Use --provider instead. Target providers for generated handlers (comma-separated)").option("--enable-openapi", "Enable OpenAPI documentation generation for server builds").option("--production", "Build for production (no dev tools, bundled output)").option("--skip-bundle", "Skip bundling step in production build").option("--stage <stage>", "Inject encrypted secrets for deployment stage").action(async (options) => {
+program.command("build").description("Build handlers from endpoints, functions, and crons").option("--provider <provider>", "Target provider for generated handlers (aws, server)").option("--providers <providers>", "[DEPRECATED] Use --provider instead. Target providers for generated handlers (comma-separated)").option("--enable-openapi", "Enable OpenAPI documentation generation for server builds").option("--production", "Build for production (no dev tools, bundled output)").option("--skip-bundle", "Skip bundling step in production build").option("--stage <stage>", "Inject encrypted secrets for deployment stage").option("--mark-optional", "Suffix optional env vars with ? in manifest envVars field (e.g. PORT?)").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -12246,7 +11958,8 @@ program.command("build").description("Build handlers from endpoints, functions,
 				enableOpenApi: options.enableOpenapi || false,
 				production: options.production || false,
 				skipBundle: options.skipBundle || false,
-				stage: options.stage
+				stage: options.stage,
+				markOptional: options.markOptional || false
 			});
 		} else if (options.providers) {
 			const providerList = [...new Set(options.providers.split(",").map((p) => p.trim()))];
@@ -12255,13 +11968,15 @@ program.command("build").description("Build handlers from endpoints, functions,
 				enableOpenApi: options.enableOpenapi || false,
 				production: options.production || false,
 				skipBundle: options.skipBundle || false,
-				stage: options.stage
+				stage: options.stage,
+				markOptional: options.markOptional || false
 			});
 		} else await buildCommand({
 			enableOpenApi: options.enableOpenapi || false,
 			production: options.production || false,
 			skipBundle: options.skipBundle || false,
-			stage: options.stage
+			stage: options.stage,
+			markOptional: options.markOptional || false
 		});
 	} catch (error) {
 		console.error(formatError(error));
@@ -12436,8 +12151,8 @@ program.command("secrets:push").description("Push secrets to remote provider (SS
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig: loadWorkspaceConfig$1 } = await Promise.resolve().then(() => require("./config.cjs"));
-		const { pushSecrets: pushSecrets$1 } = await Promise.resolve().then(() => require("./sync-D1Pa30oV.cjs"));
-		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-CZtzdrnc.cjs"));
+		const { pushSecrets: pushSecrets$1 } = await Promise.resolve().then(() => require("./sync-B2CN_KS5.cjs"));
+		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-C8KIy4Uy.cjs"));
 		const { readStageSecrets: readStageSecrets$1, writeStageSecrets: writeStageSecrets$1 } = await Promise.resolve().then(() => require("./storage-DOEtT2Hr.cjs"));
 		const { workspace } = await loadWorkspaceConfig$1();
 		const secrets = await readStageSecrets$1(options.stage, workspace.root);
@@ -12461,9 +12176,9 @@ program.command("secrets:pull").description("Pull secrets from remote provider (
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig: loadWorkspaceConfig$1 } = await Promise.resolve().then(() => require("./config.cjs"));
-		const { pullSecrets: pullSecrets$1 } = await Promise.resolve().then(() => require("./sync-D1Pa30oV.cjs"));
+		const { pullSecrets: pullSecrets$1 } = await Promise.resolve().then(() => require("./sync-B2CN_KS5.cjs"));
 		const { writeStageSecrets: writeStageSecrets$1 } = await Promise.resolve().then(() => require("./storage-DOEtT2Hr.cjs"));
-		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-CZtzdrnc.cjs"));
+		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-C8KIy4Uy.cjs"));
 		const { workspace } = await loadWorkspaceConfig$1();
 		let secrets = await pullSecrets$1(options.stage, workspace);
 		if (!secrets) {
@@ -12488,7 +12203,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig: loadWorkspaceConfig$1 } = await Promise.resolve().then(() => require("./config.cjs"));
-		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-CZtzdrnc.cjs"));
+		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-C8KIy4Uy.cjs"));
 		const { readStageSecrets: readStageSecrets$1, writeStageSecrets: writeStageSecrets$1 } = await Promise.resolve().then(() => require("./storage-DOEtT2Hr.cjs"));
 		const { workspace } = await loadWorkspaceConfig$1();
 		const secrets = await readStageSecrets$1(options.stage, workspace.root);