@geekmidas/cli 1.10.31 → 1.10.32

package/dist/index.cjs

@@ -5,14 +5,12 @@ const require_config = require('./config-Cuo8vFsp.cjs');
 const require_credentials = require('./credentials-C8DWtnMY.cjs');
 const require_fullstack_secrets = require('./fullstack-secrets-Bchl2MDd.cjs');
 const require_storage = require('./storage-B1wvztiJ.cjs');
-const require_client_generator = require('./client-generator-D-T4ypQo.cjs');
-const require_openapi = require('./openapi-w-_smBTO.cjs');
-const require_dokploy_api = require('./dokploy-api-CqOIKHme.cjs');
-const require_encryption = require('./encryption-MfXAiFTm.cjs');
-const require_sniffer = require('./sniffer-CBhzByiY.cjs');
-const require_CachedStateProvider = require('./CachedStateProvider-Cyn17x3x.cjs');
-const require_openapi_react_query = require('./openapi-react-query-CxyQTTdF.cjs');
-const require_sync = require('./sync-BWY6yoUG.cjs');
+const require_openapi = require('./openapi-BQft1jm8.cjs');
+const require_dokploy_api = require('./dokploy-api-Dvyq-LsM.cjs');
+const require_encryption = require('./encryption-DgKS-Dv9.cjs');
+const require_CachedStateProvider = require('./CachedStateProvider-CxsXOKkg.cjs');
+const require_openapi_react_query = require('./openapi-react-query-DYbBq-WJ.cjs');
+const require_sync = require('./sync-DGXXSk2v.cjs');
 const node_fs = require_chunk.__toESM(require("node:fs"));
 const node_path = require_chunk.__toESM(require("node:path"));
 const commander = require_chunk.__toESM(require("commander"));
@@ -32,11 +30,12 @@ const __geekmidas_constructs_subscribers = require_chunk.__toESM(require("@geekm
 const pg = require_chunk.__toESM(require("pg"));
 const node_dns_promises = require_chunk.__toESM(require("node:dns/promises"));
 const node_module = require_chunk.__toESM(require("node:module"));
+const node_url = require_chunk.__toESM(require("node:url"));
 const prompts = require_chunk.__toESM(require("prompts"));
 
 //#region package.json
 var name = "@geekmidas/cli";
-var version = "1.10.30";
+var version = "1.10.31";
 var description = "CLI tools for building Lambda handlers, server applications, and generating OpenAPI specs";
 var private$1 = false;
 var type = "module";
@@ -139,7 +138,7 @@ const logger$14 = console;
 * Validate Dokploy token by making a test API call
 */
 async function validateDokployToken(endpoint, token) {
-	const { DokployApi: DokployApi$1 } = await Promise.resolve().then(() => require("./dokploy-api-BPYkG-ZZ.cjs"));
+	const { DokployApi: DokployApi$1 } = await Promise.resolve().then(() => require("./dokploy-api-BOx71j6F.cjs"));
 	const api = new DokployApi$1({
 		baseUrl: endpoint,
 		token
@@ -153,7 +152,7 @@ async function prompt$1(message, hidden = false) {
 	if (!process.stdin.isTTY) throw new Error("Interactive input required. Please provide --token option.");
 	if (hidden) {
 		process.stdout.write(message);
-		return new Promise((resolve$3, reject) => {
+		return new Promise((resolve$4, reject) => {
 			let value = "";
 			const cleanup = () => {
 				process.stdin.setRawMode(false);
@@ -170,7 +169,7 @@ async function prompt$1(message, hidden = false) {
 				if (c === "\n" || c === "\r") {
 					cleanup();
 					process.stdout.write("\n");
-					resolve$3(value);
+					resolve$4(value);
 				} else if (c === "") {
 					cleanup();
 					process.stdout.write("\n");
@@ -375,15 +374,15 @@ function loadEnvFiles(envConfig, cwd = process.cwd()) {
 * @internal Exported for testing
 */
 async function isPortAvailable(port) {
-	return new Promise((resolve$3) => {
+	return new Promise((resolve$4) => {
 		const server = (0, node_net.createServer)();
 		server.once("error", (err) => {
-			if (err.code === "EADDRINUSE") resolve$3(false);
-			else resolve$3(false);
+			if (err.code === "EADDRINUSE") resolve$4(false);
+			else resolve$4(false);
 		});
 		server.once("listening", () => {
 			server.close();
-			resolve$3(true);
+			resolve$4(true);
 		});
 		server.listen(port);
 	});
@@ -826,7 +825,7 @@ var CronGenerator = class extends require_openapi.ConstructGenerator {
 				schedule: construct.schedule || "rate(1 hour)",
 				timeout: construct.timeout,
 				memorySize: construct.memorySize,
-				environment: await construct.getEnvironment()
+				environment: await construct.getEnvironment({ markOptional: context.markOptional })
 			});
 			logger$15.log(`Generated cron handler: ${key}`);
 		}
@@ -876,7 +875,7 @@ var FunctionGenerator = class extends require_openapi.ConstructGenerator {
 				handler: (0, node_path.relative)(process.cwd(), handlerFile).replace(/\.ts$/, ".handler"),
 				timeout: construct.timeout,
 				memorySize: construct.memorySize,
-				environment: await construct.getEnvironment()
+				environment: await construct.getEnvironment({ markOptional: context.markOptional })
 			});
 			logger$15.log(`Generated function handler: ${key}`);
 		}
@@ -930,7 +929,7 @@ var SubscriberGenerator = class extends require_openapi.ConstructGenerator {
 				subscribedEvents: construct.subscribedEvents || [],
 				timeout: construct.timeout,
 				memorySize: construct.memorySize,
-				environment: await construct.getEnvironment()
+				environment: await construct.getEnvironment({ markOptional: context.markOptional })
 			});
 			logger$15.log(`Generated subscriber handler: ${key}`);
 		}
@@ -1141,11 +1140,11 @@ async function execCommand(commandArgs, options = {}) {
 			NODE_OPTIONS: nodeOptions
 		}
 	});
-	const exitCode = await new Promise((resolve$3) => {
-		child.on("close", (code) => resolve$3(code ?? 0));
+	const exitCode = await new Promise((resolve$4) => {
+		child.on("close", (code) => resolve$4(code ?? 0));
 		child.on("error", (error) => {
 			logger$12.error(`Failed to run command: ${error.message}`);
-			resolve$3(1);
+			resolve$4(1);
 		});
 	});
 	if (exitCode !== 0) process.exit(exitCode);
@@ -1647,14 +1646,14 @@ async function workspaceDevCommand(workspace, options) {
 	};
 	process.on("SIGINT", shutdown);
 	process.on("SIGTERM", shutdown);
-	return new Promise((resolve$3, reject) => {
+	return new Promise((resolve$4, reject) => {
 		turboProcess.on("error", (error) => {
 			logger$11.error("❌ Turbo error:", error);
 			reject(error);
 		});
 		turboProcess.on("exit", (code) => {
 			if (code !== null && code !== 0) reject(new Error(`Turbo exited with code ${code}`));
-			else resolve$3();
+			else resolve$4();
 		});
 	});
 }
@@ -1766,7 +1765,7 @@ var EntryRunner = class {
 			if (code !== null && code !== 0 && code !== 143) logger$11.error(`❌ Process exited with code ${code}`);
 			this.isRunning = false;
 		});
-		await new Promise((resolve$3) => setTimeout(resolve$3, 500));
+		await new Promise((resolve$4) => setTimeout(resolve$4, 500));
 		if (this.isRunning) {
 			logger$11.log("");
 			logger$11.log(`  \x1b[32m✓ Ready\x1b[0m at \x1b[36mhttp://localhost:${this.port}\x1b[0m`);
@@ -1775,7 +1774,7 @@ var EntryRunner = class {
 	}
 	async restart() {
 		this.stopProcess();
-		await new Promise((resolve$3) => setTimeout(resolve$3, 500));
+		await new Promise((resolve$4) => setTimeout(resolve$4, 500));
 		await this.runProcess();
 	}
 	stop() {
@@ -1910,7 +1909,7 @@ var DevServer = class {
 			if (code !== null && code !== 0 && signal !== "SIGTERM") logger$11.error(`❌ Server exited with code ${code}`);
 			this.isRunning = false;
 		});
-		await new Promise((resolve$3) => setTimeout(resolve$3, 1e3));
+		await new Promise((resolve$4) => setTimeout(resolve$4, 1e3));
 		if (this.isRunning) {
 			const base = `http://localhost:${this.actualPort}`;
 			const lines = [`  Local:     ${base}`];
@@ -1956,7 +1955,7 @@ var DevServer = class {
 		let attempts = 0;
 		while (attempts < 30) {
 			if (await isPortAvailable(portToReuse)) break;
-			await new Promise((resolve$3) => setTimeout(resolve$3, 100));
+			await new Promise((resolve$4) => setTimeout(resolve$4, 100));
 			attempts++;
 		}
 		this.requestedPort = portToReuse;
@@ -2181,7 +2180,8 @@ async function buildCommand(options) {
 		studio,
 		hooks,
 		production,
-		dockerServices
+		dockerServices,
+		markOptional: options.markOptional ?? false
 	};
 	const endpointGenerator = new require_openapi.EndpointGenerator();
 	const functionGenerator = new FunctionGenerator();
@@ -2203,25 +2203,19 @@ async function buildCommand(options) {
 	}
 	const rootOutputDir = (0, node_path.join)(process.cwd(), ".gkm");
 	await (0, node_fs_promises.mkdir)(rootOutputDir, { recursive: true });
-	let optionalVarSet;
-	if (options.markOptional && config.envParser) try {
-		const { _sniffEnvParser } = await Promise.resolve().then(() => require("./sniffer-eZ13G10M.cjs"));
-		const sniffed = await _sniffEnvParser(config.envParser, process.cwd(), process.cwd());
-		if (sniffed.optionalEnvVars.length > 0) optionalVarSet = new Set(sniffed.optionalEnvVars);
-	} catch {}
 	let result = {};
 	for (const provider of resolved.providers) {
-		const providerResult = await buildForProvider(provider, buildContext, rootOutputDir, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, allEndpoints, allFunctions, allCrons, allSubscribers, resolved.enableOpenApi, options.skipBundle ?? false, options.stage, optionalVarSet);
+		const providerResult = await buildForProvider(provider, buildContext, rootOutputDir, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, allEndpoints, allFunctions, allCrons, allSubscribers, resolved.enableOpenApi, options.skipBundle ?? false, options.stage);
 		if (providerResult.masterKey) result = providerResult;
 	}
 	await require_openapi.generateOpenApi(config, { bustCache: true });
 	return result;
 }
-async function buildForProvider(provider, context, rootOutputDir, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, endpoints, functions, crons, subscribers, enableOpenApi, skipBundle, stage, optionalVarSet) {
+async function buildForProvider(provider, context, rootOutputDir, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, endpoints, functions, crons, subscribers, enableOpenApi, skipBundle, stage) {
 	const outputDir = (0, node_path.join)(process.cwd(), ".gkm", provider);
 	await (0, node_fs_promises.mkdir)(outputDir, { recursive: true });
 	logger$9.log(`\nGenerating handlers for provider: ${provider}`);
-	const [rawRoutes, rawFunctions, rawCrons, rawSubscribers] = await Promise.all([
+	const [routes, functionInfos, cronInfos, subscriberInfos] = await Promise.all([
 		endpointGenerator.build(context, endpoints, outputDir, {
 			provider,
 			enableOpenApi
@@ -2230,23 +2224,6 @@ async function buildForProvider(provider, context, rootOutputDir, endpointGenera
 		cronGenerator.build(context, crons, outputDir, { provider }),
 		subscriberGenerator.build(context, subscribers, outputDir, { provider })
 	]);
-	const markEnv = optionalVarSet ? (vars) => vars?.map((v) => optionalVarSet.has(v) ? `${v}?` : v) : (vars) => vars;
-	const routes = rawRoutes.map((r) => ({
-		...r,
-		environment: markEnv(r.environment)
-	}));
-	const functionInfos = rawFunctions.map((f) => ({
-		...f,
-		environment: markEnv(f.environment)
-	}));
-	const cronInfos = rawCrons.map((c) => ({
-		...c,
-		environment: markEnv(c.environment)
-	}));
-	const subscriberInfos = rawSubscribers.map((s) => ({
-		...s,
-		environment: markEnv(s.environment)
-	}));
 	logger$9.log(`Generated ${routes.length} routes, ${functionInfos.length} functions, ${cronInfos.length} crons, ${subscriberInfos.length} subscribers for ${provider}`);
 	const manifestRoutes = assembleManifestField(routes, endpoints);
 	const manifestFunctions = assembleManifestField(functionInfos, functions);
@@ -2268,7 +2245,7 @@ async function buildForProvider(provider, context, rootOutputDir, endpointGenera
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$9.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-CLOenWgi.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-BG6P249p.cjs"));
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -2338,7 +2315,7 @@ async function workspaceBuildCommand(workspace, options) {
 	try {
 		const turboCommand = getTurboCommand(pm);
 		logger$9.log(`Running: ${turboCommand}`);
-		await new Promise((resolve$3, reject) => {
+		await new Promise((resolve$4, reject) => {
 			const child = (0, node_child_process.spawn)(turboCommand, {
 				shell: true,
 				cwd: workspace.root,
@@ -2349,7 +2326,7 @@ async function workspaceBuildCommand(workspace, options) {
 				}
 			});
 			child.on("close", (code) => {
-				if (code === 0) resolve$3();
+				if (code === 0) resolve$4();
 				else reject(new Error(`Turbo build failed with exit code ${code}`));
 			});
 			child.on("error", (err) => {
@@ -2397,7 +2374,7 @@ function getAppOutputPath(workspace, _appName, app) {
 * Format routes for logging, handling PartitionedRoutes.
 */
 function formatRoutes(routes) {
-	if (require_client_generator.isPartitionedRoutes(routes)) {
+	if (require_openapi.isPartitionedRoutes(routes)) {
 		const paths = Array.isArray(routes.paths) ? routes.paths.join(", ") : routes.paths;
 		return `${paths} (partitioned)`;
 	}
@@ -2595,11 +2572,11 @@ async function createDnsProvider(options) {
 	if (isDnsProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "hostinger") {
-		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-C5oLa7N7.cjs"));
+		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-5KYmwoK2.cjs"));
 		return new HostingerProvider();
 	}
 	if (provider === "route53") {
-		const { Route53Provider } = await Promise.resolve().then(() => require("./Route53Provider-DISZ6E8f.cjs"));
+		const { Route53Provider } = await Promise.resolve().then(() => require("./Route53Provider-owQQ4pn6.cjs"));
 		const route53Config = config;
 		return new Route53Provider({
 			region: route53Config.region,
@@ -5070,20 +5047,20 @@ function isStateProvider(value) {
 async function createStateProvider(options) {
 	const { config, workspaceRoot, workspaceName } = options;
 	if (!config) {
-		const { LocalStateProvider } = await Promise.resolve().then(() => require("./LocalStateProvider-DI6n11UM.cjs"));
+		const { LocalStateProvider } = await Promise.resolve().then(() => require("./LocalStateProvider-CLifRC0Y.cjs"));
 		return new LocalStateProvider(workspaceRoot);
 	}
 	if (isStateProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "local") {
-		const { LocalStateProvider } = await Promise.resolve().then(() => require("./LocalStateProvider-DI6n11UM.cjs"));
+		const { LocalStateProvider } = await Promise.resolve().then(() => require("./LocalStateProvider-CLifRC0Y.cjs"));
 		return new LocalStateProvider(workspaceRoot);
 	}
 	if (provider === "ssm") {
 		if (!workspaceName) throw new Error("Workspace name is required for SSM state provider. Set \"name\" in gkm.config.ts.");
-		const { LocalStateProvider } = await Promise.resolve().then(() => require("./LocalStateProvider-DI6n11UM.cjs"));
-		const { SSMStateProvider } = await Promise.resolve().then(() => require("./SSMStateProvider-BljH5efc.cjs"));
-		const { CachedStateProvider: CachedStateProvider$1 } = await Promise.resolve().then(() => require("./CachedStateProvider-3couMAQk.cjs"));
+		const { LocalStateProvider } = await Promise.resolve().then(() => require("./LocalStateProvider-CLifRC0Y.cjs"));
+		const { SSMStateProvider } = await Promise.resolve().then(() => require("./SSMStateProvider-CT8tjl9o.cjs"));
+		const { CachedStateProvider: CachedStateProvider$1 } = await Promise.resolve().then(() => require("./CachedStateProvider-37pG1HBx.cjs"));
 		const ssmConfig = config;
 		const local = new LocalStateProvider(workspaceRoot);
 		const ssm = SSMStateProvider.create({
@@ -5193,6 +5170,353 @@ function generateSecretsReport(encryptedApps, sniffedApps) {
 	};
 }
 
+//#endregion
+//#region src/deploy/sniffer.ts
+const __filename$1 = (0, node_url.fileURLToPath)(require("url").pathToFileURL(__filename).href);
+const __dirname$1 = (0, node_path.dirname)(__filename$1);
+/**
+* Resolve the tsx package path from the CLI package's dependencies.
+* This ensures tsx is available regardless of whether the target project has it installed.
+*/
+function resolveTsxPath() {
+	const require$2 = (0, node_module.createRequire)(require("url").pathToFileURL(__filename).href);
+	return require$2.resolve("tsx");
+}
+/**
+* Resolve the path to a sniffer helper file.
+* Handles both dev (.ts with tsx) and production (.mjs from dist).
+*
+* In production: sniffer.ts is bundled into dist/index.mjs, but sniffer helper
+* files are output to dist/deploy/ as standalone modules for subprocess loading.
+*
+* In development: All files are in src/deploy/ and loaded via tsx.
+*/
+function resolveSnifferFile(baseName) {
+	const deployMjsPath = (0, node_path.resolve)(__dirname$1, "deploy", `${baseName}.mjs`);
+	if ((0, node_fs.existsSync)(deployMjsPath)) return deployMjsPath;
+	const mjsPath = (0, node_path.resolve)(__dirname$1, `${baseName}.mjs`);
+	if ((0, node_fs.existsSync)(mjsPath)) return mjsPath;
+	const tsPath = (0, node_path.resolve)(__dirname$1, `${baseName}.ts`);
+	if ((0, node_fs.existsSync)(tsPath)) return tsPath;
+	return tsPath;
+}
+/**
+* Get required environment variables for an app.
+*
+* Detection strategy (in order):
+* 1. Frontend apps: Returns empty (no server secrets)
+* 2. Apps with `requiredEnv`: Uses explicit list from config
+* 3. Entry apps: Imports entry file in subprocess to capture config.parse() calls
+* 4. Route-based apps: Loads route files and calls getEnvironment() on each construct
+* 5. Apps with `envParser` (no routes): Runs SnifferEnvironmentParser to detect usage
+* 6. Apps with neither: Returns empty
+*
+* This function handles "fire and forget" async operations gracefully,
+* capturing errors and unhandled rejections without failing the build.
+*
+* @param app - The normalized app configuration
+* @param appName - The name of the app
+* @param workspacePath - Absolute path to the workspace root
+* @param options - Optional configuration for sniffing behavior
+* @returns The sniffed environment with required variables
+*/
+async function sniffAppEnvironment(app, appName, workspacePath, options = {}) {
+	const { logWarnings = true, markOptional = false } = options;
+	if (app.type === "frontend") {
+		const depVars = (app.dependencies ?? []).map((dep) => `NEXT_PUBLIC_${dep.toUpperCase()}_URL`);
+		if (app.config) {
+			const sniffedVars = [];
+			const sniffedOptional = [];
+			const configPaths = [];
+			if (app.config.client) configPaths.push(app.config.client);
+			if (app.config.server) configPaths.push(app.config.server);
+			for (const configPath of configPaths) {
+				const result = await sniffEntryFile(configPath, app.path, workspacePath);
+				if (logWarnings && result.error) console.warn(`[sniffer] ${appName}: Config file "${configPath}" threw error during sniffing (env vars still captured): ${result.error.message}`);
+				sniffedVars.push(...result.envVars);
+				sniffedOptional.push(...result.optionalEnvVars);
+			}
+			const optionalEnvVars = [...new Set(sniffedOptional)];
+			const allVars = applyMarkOptional([...new Set([...depVars, ...sniffedVars])], optionalEnvVars, markOptional);
+			return {
+				appName,
+				requiredEnvVars: allVars,
+				optionalEnvVars
+			};
+		}
+		return {
+			appName,
+			requiredEnvVars: depVars,
+			optionalEnvVars: []
+		};
+	}
+	if (app.entry) {
+		const result = await sniffEntryFile(app.entry, app.path, workspacePath);
+		if (logWarnings && result.error) console.warn(`[sniffer] ${appName}: Entry file threw error during sniffing (env vars still captured): ${result.error.message}`);
+		return {
+			appName,
+			requiredEnvVars: applyMarkOptional(result.envVars, result.optionalEnvVars, markOptional),
+			optionalEnvVars: result.optionalEnvVars
+		};
+	}
+	if (app.routes) {
+		const result = await sniffRouteFiles(require_openapi.normalizeRoutes(app.routes), app.path, workspacePath);
+		if (logWarnings && result.error) console.warn(`[sniffer] ${appName}: Route sniffing threw error (env vars still captured): ${result.error.message}`);
+		return {
+			appName,
+			requiredEnvVars: applyMarkOptional(result.envVars, result.optionalEnvVars, markOptional),
+			optionalEnvVars: result.optionalEnvVars
+		};
+	}
+	if (app.envParser) {
+		const result = await sniffEnvParser(app.envParser, app.path, workspacePath);
+		if (logWarnings) {
+			if (result.error) console.warn(`[sniffer] ${appName}: envParser threw error during sniffing (env vars still captured): ${result.error.message}`);
+			if (result.unhandledRejections.length > 0) console.warn(`[sniffer] ${appName}: Fire-and-forget rejections during sniffing (suppressed): ${result.unhandledRejections.map((e) => e.message).join(", ")}`);
+		}
+		return {
+			appName,
+			requiredEnvVars: applyMarkOptional(result.envVars, result.optionalEnvVars, markOptional),
+			optionalEnvVars: result.optionalEnvVars
+		};
+	}
+	return {
+		appName,
+		requiredEnvVars: [],
+		optionalEnvVars: []
+	};
+}
+/**
+* Apply the `?` suffix to optional variables in an env var list.
+* Only modifies the list when `markOptional` is true and there are optional vars.
+*/
+function applyMarkOptional(envVars, optionalEnvVars, markOptional) {
+	if (!markOptional || optionalEnvVars.length === 0) return envVars;
+	const optionalSet = new Set(optionalEnvVars);
+	return envVars.map((v) => optionalSet.has(v) ? `${v}?` : v);
+}
+/**
+* Sniff an entry file by importing it in a subprocess.
+*
+* Entry apps call `config.parse()` at module load time. To capture which
+* env vars are accessed, we:
+* 1. Spawn a subprocess with a module loader hook
+* 2. The loader intercepts `@geekmidas/envkit` and replaces EnvironmentParser
+*    with SnifferEnvironmentParser
+* 3. Import the entry file (triggers config.parse())
+* 4. Capture and return the accessed env var names
+*
+* This approach provides process isolation - each app is sniffed in its own
+* subprocess, preventing module cache pollution.
+*
+* @param entryPath - Relative path to the entry file (e.g., './src/index.ts')
+* @param appPath - The app's path relative to workspace (e.g., 'apps/auth')
+* @param workspacePath - Absolute path to workspace root
+* @returns EntrySniffResult with env vars and optional error
+*/
+async function sniffEntryFile(entryPath, appPath, workspacePath) {
+	const fullEntryPath = (0, node_path.resolve)(workspacePath, appPath, entryPath);
+	const loaderPath = resolveSnifferFile("sniffer-loader");
+	const workerPath = resolveSnifferFile("sniffer-worker");
+	return new Promise((resolvePromise) => {
+		const child = (0, node_child_process.spawn)("node", [
+			"--import",
+			loaderPath,
+			workerPath,
+			fullEntryPath
+		], {
+			cwd: (0, node_path.resolve)(workspacePath, appPath),
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			env: {
+				...process.env,
+				NODE_OPTIONS: "--import=tsx"
+			}
+		});
+		let stdout = "";
+		let stderr = "";
+		child.stdout.on("data", (data) => {
+			stdout += data.toString();
+		});
+		child.stderr.on("data", (data) => {
+			stderr += data.toString();
+		});
+		child.on("close", (code) => {
+			try {
+				const jsonMatch = stdout.match(/\{[^{}]*"envVars"[^{}]*\}[^{]*$/);
+				if (jsonMatch) {
+					const result = JSON.parse(jsonMatch[0]);
+					resolvePromise({
+						envVars: result.envVars || [],
+						optionalEnvVars: result.optionalEnvVars || [],
+						error: result.error ? new Error(result.error) : void 0
+					});
+					return;
+				}
+			} catch {}
+			resolvePromise({
+				envVars: [],
+				optionalEnvVars: [],
+				error: new Error(`Failed to sniff entry file (exit code ${code}): ${stderr || stdout || "No output"}`)
+			});
+		});
+		child.on("error", (err) => {
+			resolvePromise({
+				envVars: [],
+				optionalEnvVars: [],
+				error: err
+			});
+		});
+	});
+}
+/**
+* Sniff route files by loading constructs and calling getEnvironment().
+*
+* Route-based apps have endpoints, functions, crons, and subscribers that
+* use services. Each service's register() method accesses environment variables.
+*
+* This runs in a subprocess with tsx loader to properly handle TypeScript
+* compilation and path alias resolution (e.g., `src/...` imports).
+*
+* @param routes - Glob pattern(s) for route files
+* @param appPath - The app's path relative to workspace (e.g., 'apps/api')
+* @param workspacePath - Absolute path to workspace root
+* @returns EntrySniffResult with env vars and optional error
+*/
+async function sniffRouteFiles(routes, appPath, workspacePath) {
+	const fullAppPath = (0, node_path.resolve)(workspacePath, appPath);
+	const workerPath = resolveSnifferFile("sniffer-routes-worker");
+	const tsxPath = resolveTsxPath();
+	const routesArray = Array.isArray(routes) ? routes : [routes];
+	const pattern = routesArray[0];
+	if (!pattern) return {
+		envVars: [],
+		optionalEnvVars: [],
+		error: new Error("No route patterns provided")
+	};
+	return new Promise((resolvePromise) => {
+		const child = (0, node_child_process.spawn)("node", [
+			"--import",
+			tsxPath,
+			workerPath,
+			fullAppPath,
+			pattern
+		], {
+			cwd: fullAppPath,
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			env: { ...process.env }
+		});
+		let stdout = "";
+		let stderr = "";
+		child.stdout.on("data", (data) => {
+			stdout += data.toString();
+		});
+		child.stderr.on("data", (data) => {
+			stderr += data.toString();
+		});
+		child.on("close", (code) => {
+			if (stderr) stderr.split("\n").filter((line) => line.trim()).forEach((line) => console.warn(line));
+			try {
+				const jsonMatch = stdout.match(/\{[^{}]*"envVars"[^{}]*\}[^{]*$/);
+				if (jsonMatch) {
+					const result = JSON.parse(jsonMatch[0]);
+					resolvePromise({
+						envVars: result.envVars || [],
+						optionalEnvVars: result.optionalEnvVars || [],
+						error: result.error ? new Error(result.error) : void 0
+					});
+					return;
+				}
+			} catch {}
+			resolvePromise({
+				envVars: [],
+				optionalEnvVars: [],
+				error: new Error(`Failed to sniff route files (exit code ${code}): ${stderr || stdout || "No output"}`)
+			});
+		});
+		child.on("error", (err) => {
+			resolvePromise({
+				envVars: [],
+				optionalEnvVars: [],
+				error: err
+			});
+		});
+	});
+}
+/**
+* Run the SnifferEnvironmentParser on an envParser module to detect
+* which environment variables it accesses.
+*
+* This function handles "fire and forget" async operations by using
+* the shared sniffWithFireAndForget utility from @geekmidas/envkit.
+*
+* @param envParserPath - The envParser config (e.g., './src/config/env#envParser')
+* @param appPath - The app's path relative to workspace
+* @param workspacePath - Absolute path to workspace root
+* @returns SniffResult with env vars and any errors encountered
+*/
+async function sniffEnvParser(envParserPath, appPath, workspacePath) {
+	const [modulePath, exportName = "default"] = envParserPath.split("#");
+	if (!modulePath) return {
+		envVars: [],
+		optionalEnvVars: [],
+		unhandledRejections: []
+	};
+	const fullPath = (0, node_path.resolve)(workspacePath, appPath, modulePath);
+	let SnifferEnvironmentParser;
+	let sniffWithFireAndForget;
+	try {
+		const envkitModule = await import("@geekmidas/envkit/sniffer");
+		SnifferEnvironmentParser = envkitModule.SnifferEnvironmentParser;
+		sniffWithFireAndForget = envkitModule.sniffWithFireAndForget;
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		console.warn(`[sniffer] Failed to import SnifferEnvironmentParser: ${message}`);
+		return {
+			envVars: [],
+			optionalEnvVars: [],
+			unhandledRejections: []
+		};
+	}
+	const sniffer = new SnifferEnvironmentParser();
+	return sniffWithFireAndForget(sniffer, async () => {
+		const moduleUrl = (0, node_url.pathToFileURL)(fullPath).href;
+		const module$1 = await import(moduleUrl);
+		const envParser = module$1[exportName];
+		if (typeof envParser !== "function") {
+			console.warn(`[sniffer] Export "${exportName}" from "${modulePath}" is not a function`);
+			return;
+		}
+		const result = envParser(sniffer);
+		if (result && typeof result.parse === "function") try {
+			result.parse();
+		} catch {}
+	});
+}
+/**
+* Sniff environment requirements for multiple apps.
+*
+* @param apps - Map of app name to app config
+* @param workspacePath - Absolute path to workspace root
+* @param options - Optional configuration for sniffing behavior
+* @returns Map of app name to sniffed environment
+*/
+async function sniffAllApps(apps, workspacePath, options = {}) {
+	const results = /* @__PURE__ */ new Map();
+	for (const [appName, app] of Object.entries(apps)) {
+		const sniffed = await sniffAppEnvironment(app, appName, workspacePath, options);
+		results.set(appName, sniffed);
+	}
+	return results;
+}
+
 //#endregion
 //#region src/deploy/index.ts
 const logger$3 = console;
@@ -5203,7 +5527,7 @@ async function prompt(message, hidden = false) {
 	if (!process.stdin.isTTY) throw new Error("Interactive input required. Please configure manually.");
 	if (hidden) {
 		process.stdout.write(message);
-		return new Promise((resolve$3) => {
+		return new Promise((resolve$4) => {
 			let value = "";
 			const onData = (char) => {
 				const c = char.toString();
@@ -5212,7 +5536,7 @@ async function prompt(message, hidden = false) {
 					process.stdin.pause();
 					process.stdin.removeListener("data", onData);
 					process.stdout.write("\n");
-					resolve$3(value);
+					resolve$4(value);
 				} else if (c === "") {
 					process.stdin.setRawMode(false);
 					process.stdin.pause();
@@ -5687,7 +6011,7 @@ async function workspaceDeployCommand(workspace, options) {
 		logger$3.log(`   ⚠️  No secrets found for stage "${stage}"`);
 		logger$3.log(`      Run "gkm secrets:init --stage ${stage}" to create secrets`);
 	}
-	const sniffedApps = await require_sniffer.sniffAllApps(workspace.apps, workspace.root);
+	const sniffedApps = await sniffAllApps(workspace.apps, workspace.root);
 	const encryptedSecrets = stageSecrets ? prepareSecretsForAllApps(stageSecrets, sniffedApps) : /* @__PURE__ */ new Map();
 	if (stageSecrets) {
 		const report = generateSecretsReport(encryptedSecrets, sniffedApps);
@@ -5862,7 +6186,7 @@ async function workspaceDeployCommand(workspace, options) {
 	}
 	if (workspace.deploy?.backups && provisionedPostgres) {
 		logger$3.log("\n💾 Provisioning backup destination...");
-		const { provisionBackupDestination } = await Promise.resolve().then(() => require("./backup-provisioner-CpirEvO1.cjs"));
+		const { provisionBackupDestination } = await Promise.resolve().then(() => require("./backup-provisioner-C4noe75O.cjs"));
 		const backupState = await provisionBackupDestination({
 			api,
 			projectId: project.projectId,
@@ -6517,7 +6841,7 @@ const GEEKMIDAS_VERSIONS = {
 	"@geekmidas/constructs": "~3.0.7",
 	"@geekmidas/db": "~1.0.1",
 	"@geekmidas/emailkit": "~1.0.0",
-	"@geekmidas/envkit": "~1.0.4",
+	"@geekmidas/envkit": "~1.0.5",
 	"@geekmidas/errors": "~1.0.0",
 	"@geekmidas/events": "~1.1.0",
 	"@geekmidas/logger": "~1.0.0",
@@ -7162,7 +7486,7 @@ ${volumes.join("\n")}
 /**
 * Generate .env file for docker-compose with database passwords
 */
-function generateDockerEnv(apps, eventsBackend) {
+function generateDockerEnv(apps, _eventsBackend) {
 	const envVars = apps.map((app) => {
 		const envVar = `${app.name.toUpperCase()}_DB_PASSWORD`;
 		return `${envVar}=${app.password}`;
@@ -7181,7 +7505,7 @@ ${envVars.join("\n")}
 * - auth user: uses auth schema with search_path=auth
 * - pgboss user: uses pgboss schema (when events === 'pgboss')
 */
-function generatePostgresInitScript(apps, eventsBackend) {
+function generatePostgresInitScript(apps, _eventsBackend) {
 	const userCreations = apps.map((app) => {
 		const userName = app.name.replace(/-/g, "_");
 		const envVar = `${app.name.toUpperCase()}_DB_PASSWORD`;
@@ -11707,7 +12031,7 @@ async function testCommand(options = {}) {
 	});
 	let finalCredentials = { ...result.credentials };
 	if (result.appInfo) {
-		const sniffed = await require_sniffer.sniffAppEnvironment(result.appInfo.app, result.appInfo.appName, result.appInfo.workspaceRoot, { logWarnings: false });
+		const sniffed = await sniffAppEnvironment(result.appInfo.app, result.appInfo.appName, result.appInfo.workspaceRoot, { logWarnings: false });
 		if (sniffed.requiredEnvVars.length > 0) {
 			const needed = new Set(sniffed.requiredEnvVars);
 			const filtered = {};
@@ -11746,9 +12070,9 @@ async function testCommand(options = {}) {
 			NODE_OPTIONS: nodeOptions
 		}
 	});
-	return new Promise((resolve$3, reject) => {
+	return new Promise((resolve$4, reject) => {
 		vitestProcess.on("close", (code) => {
-			if (code === 0) resolve$3();
+			if (code === 0) resolve$4();
 			else reject(new Error(`Tests failed with exit code ${code}`));
 		});
 		vitestProcess.on("error", (error) => {
@@ -12151,8 +12475,8 @@ program.command("secrets:push").description("Push secrets to remote provider (SS
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig: loadWorkspaceConfig$1 } = await Promise.resolve().then(() => require("./config.cjs"));
-		const { pushSecrets: pushSecrets$1 } = await Promise.resolve().then(() => require("./sync-B2CN_KS5.cjs"));
-		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-C8KIy4Uy.cjs"));
+		const { pushSecrets: pushSecrets$1 } = await Promise.resolve().then(() => require("./sync-D1Pa30oV.cjs"));
+		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-CZtzdrnc.cjs"));
 		const { readStageSecrets: readStageSecrets$1, writeStageSecrets: writeStageSecrets$1 } = await Promise.resolve().then(() => require("./storage-DOEtT2Hr.cjs"));
 		const { workspace } = await loadWorkspaceConfig$1();
 		const secrets = await readStageSecrets$1(options.stage, workspace.root);
@@ -12176,9 +12500,9 @@ program.command("secrets:pull").description("Pull secrets from remote provider (
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig: loadWorkspaceConfig$1 } = await Promise.resolve().then(() => require("./config.cjs"));
-		const { pullSecrets: pullSecrets$1 } = await Promise.resolve().then(() => require("./sync-B2CN_KS5.cjs"));
+		const { pullSecrets: pullSecrets$1 } = await Promise.resolve().then(() => require("./sync-D1Pa30oV.cjs"));
 		const { writeStageSecrets: writeStageSecrets$1 } = await Promise.resolve().then(() => require("./storage-DOEtT2Hr.cjs"));
-		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-C8KIy4Uy.cjs"));
+		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-CZtzdrnc.cjs"));
 		const { workspace } = await loadWorkspaceConfig$1();
 		let secrets = await pullSecrets$1(options.stage, workspace);
 		if (!secrets) {
@@ -12203,7 +12527,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig: loadWorkspaceConfig$1 } = await Promise.resolve().then(() => require("./config.cjs"));
-		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-C8KIy4Uy.cjs"));
+		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-CZtzdrnc.cjs"));
 		const { readStageSecrets: readStageSecrets$1, writeStageSecrets: writeStageSecrets$1 } = await Promise.resolve().then(() => require("./storage-DOEtT2Hr.cjs"));
 		const { workspace } = await loadWorkspaceConfig$1();
 		const secrets = await readStageSecrets$1(options.stage, workspace.root);