@geekmidas/cli 1.10.31 → 1.10.32

package/dist/index.mjs

@@ -5,14 +5,12 @@ import { getAppNameFromCwd, loadAppConfig, loadConfig, loadWorkspaceAppInfo, loa
 import { getCredentialsPath, getDokployCredentials, getDokployRegistryId, getDokployToken, removeDokployCredentials, storeDokployCredentials, storeDokployRegistryId } from "./credentials-s1kLcIzK.mjs";
 import { createStageSecrets, generateConnectionUrls, generateDbPassword, generateDbUrl, generateFullstackCustomSecrets, generateLocalStackCredentials, generatePgBossUrl, generateSecurePassword, generateServiceCredentials, rotateServicePassword, writeDockerEnvFromSecrets } from "./fullstack-secrets-P84v8zWn.mjs";
 import { getKeyPath, maskPassword, readStageSecrets, secretsExist, setCustomSecret, toEmbeddableSecrets, writeStageSecrets } from "./storage-dbb9RyBl.mjs";
-import { isPartitionedRoutes } from "./client-generator-CUVVtAOo.mjs";
-import { ConstructGenerator, EndpointGenerator, OPENAPI_OUTPUT_PATH, generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi-DHq5r17U.mjs";
-import { DokployApi } from "./dokploy-api-sfZFlWuE.mjs";
-import { encryptSecrets } from "./encryption-CO5Q4Bhf.mjs";
-import { sniffAllApps, sniffAppEnvironment } from "./sniffer-BqSVVrWA.mjs";
-import { CachedStateProvider } from "./CachedStateProvider-CQr31ups.mjs";
-import { generateReactQueryCommand } from "./openapi-react-query-COpH7Mmz.mjs";
-import { isSSMConfigured, pullSecrets, pushSecrets } from "./sync-Dc-QA4Mx.mjs";
+import { ConstructGenerator, EndpointGenerator, OPENAPI_OUTPUT_PATH, generateOpenApi, isPartitionedRoutes, normalizeRoutes, openapiCommand, resolveOpenApiConfig } from "./openapi-DE8b-vin.mjs";
+import { DokployApi } from "./dokploy-api-BIT0683o.mjs";
+import { encryptSecrets } from "./encryption-DSkIlEZ6.mjs";
+import { CachedStateProvider } from "./CachedStateProvider-C8A-cCm5.mjs";
+import { generateReactQueryCommand } from "./openapi-react-query-C4UdILaI.mjs";
+import { isSSMConfigured, pullSecrets, pushSecrets } from "./sync-D_NowTkZ.mjs";
 import { createRequire } from "node:module";
 import { copyFileSync, existsSync, readFileSync, unlinkSync } from "node:fs";
 import { basename, dirname, join, parse, relative, resolve } from "node:path";
@@ -32,11 +30,12 @@ import { Function } from "@geekmidas/constructs/functions";
 import { Subscriber } from "@geekmidas/constructs/subscribers";
 import { Client } from "pg";
 import { lookup } from "node:dns/promises";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import prompts from "prompts";
 
 //#region package.json
 var name = "@geekmidas/cli";
-var version = "1.10.30";
+var version = "1.10.31";
 var description = "CLI tools for building Lambda handlers, server applications, and generating OpenAPI specs";
 var private$1 = false;
 var type = "module";
@@ -139,7 +138,7 @@ const logger$14 = console;
 * Validate Dokploy token by making a test API call
 */
 async function validateDokployToken(endpoint, token) {
-	const { DokployApi: DokployApi$1 } = await import("./dokploy-api-BiSzWM4v.mjs");
+	const { DokployApi: DokployApi$1 } = await import("./dokploy-api-BZGk-lkD.mjs");
 	const api = new DokployApi$1({
 		baseUrl: endpoint,
 		token
@@ -826,7 +825,7 @@ var CronGenerator = class extends ConstructGenerator {
 				schedule: construct.schedule || "rate(1 hour)",
 				timeout: construct.timeout,
 				memorySize: construct.memorySize,
-				environment: await construct.getEnvironment()
+				environment: await construct.getEnvironment({ markOptional: context.markOptional })
 			});
 			logger$15.log(`Generated cron handler: ${key}`);
 		}
@@ -876,7 +875,7 @@ var FunctionGenerator = class extends ConstructGenerator {
 				handler: relative(process.cwd(), handlerFile).replace(/\.ts$/, ".handler"),
 				timeout: construct.timeout,
 				memorySize: construct.memorySize,
-				environment: await construct.getEnvironment()
+				environment: await construct.getEnvironment({ markOptional: context.markOptional })
 			});
 			logger$15.log(`Generated function handler: ${key}`);
 		}
@@ -930,7 +929,7 @@ var SubscriberGenerator = class extends ConstructGenerator {
 				subscribedEvents: construct.subscribedEvents || [],
 				timeout: construct.timeout,
 				memorySize: construct.memorySize,
-				environment: await construct.getEnvironment()
+				environment: await construct.getEnvironment({ markOptional: context.markOptional })
 			});
 			logger$15.log(`Generated subscriber handler: ${key}`);
 		}
@@ -2181,7 +2180,8 @@ async function buildCommand(options) {
 		studio,
 		hooks,
 		production,
-		dockerServices
+		dockerServices,
+		markOptional: options.markOptional ?? false
 	};
 	const endpointGenerator = new EndpointGenerator();
 	const functionGenerator = new FunctionGenerator();
@@ -2203,25 +2203,19 @@ async function buildCommand(options) {
 	}
 	const rootOutputDir = join(process.cwd(), ".gkm");
 	await mkdir(rootOutputDir, { recursive: true });
-	let optionalVarSet;
-	if (options.markOptional && config$1.envParser) try {
-		const { _sniffEnvParser } = await import("./sniffer-Cpq_cbyz.mjs");
-		const sniffed = await _sniffEnvParser(config$1.envParser, process.cwd(), process.cwd());
-		if (sniffed.optionalEnvVars.length > 0) optionalVarSet = new Set(sniffed.optionalEnvVars);
-	} catch {}
 	let result = {};
 	for (const provider of resolved.providers) {
-		const providerResult = await buildForProvider(provider, buildContext, rootOutputDir, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, allEndpoints, allFunctions, allCrons, allSubscribers, resolved.enableOpenApi, options.skipBundle ?? false, options.stage, optionalVarSet);
+		const providerResult = await buildForProvider(provider, buildContext, rootOutputDir, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, allEndpoints, allFunctions, allCrons, allSubscribers, resolved.enableOpenApi, options.skipBundle ?? false, options.stage);
 		if (providerResult.masterKey) result = providerResult;
 	}
 	await generateOpenApi(config$1, { bustCache: true });
 	return result;
 }
-async function buildForProvider(provider, context, rootOutputDir, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, endpoints, functions, crons, subscribers, enableOpenApi, skipBundle, stage, optionalVarSet) {
+async function buildForProvider(provider, context, rootOutputDir, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, endpoints, functions, crons, subscribers, enableOpenApi, skipBundle, stage) {
 	const outputDir = join(process.cwd(), ".gkm", provider);
 	await mkdir(outputDir, { recursive: true });
 	logger$9.log(`\nGenerating handlers for provider: ${provider}`);
-	const [rawRoutes, rawFunctions, rawCrons, rawSubscribers] = await Promise.all([
+	const [routes, functionInfos, cronInfos, subscriberInfos] = await Promise.all([
 		endpointGenerator.build(context, endpoints, outputDir, {
 			provider,
 			enableOpenApi
@@ -2230,23 +2224,6 @@ async function buildForProvider(provider, context, rootOutputDir, endpointGenera
 		cronGenerator.build(context, crons, outputDir, { provider }),
 		subscriberGenerator.build(context, subscribers, outputDir, { provider })
 	]);
-	const markEnv = optionalVarSet ? (vars) => vars?.map((v) => optionalVarSet.has(v) ? `${v}?` : v) : (vars) => vars;
-	const routes = rawRoutes.map((r) => ({
-		...r,
-		environment: markEnv(r.environment)
-	}));
-	const functionInfos = rawFunctions.map((f) => ({
-		...f,
-		environment: markEnv(f.environment)
-	}));
-	const cronInfos = rawCrons.map((c) => ({
-		...c,
-		environment: markEnv(c.environment)
-	}));
-	const subscriberInfos = rawSubscribers.map((s) => ({
-		...s,
-		environment: markEnv(s.environment)
-	}));
 	logger$9.log(`Generated ${routes.length} routes, ${functionInfos.length} functions, ${cronInfos.length} crons, ${subscriberInfos.length} subscribers for ${provider}`);
 	const manifestRoutes = assembleManifestField(routes, endpoints);
 	const manifestFunctions = assembleManifestField(functionInfos, functions);
@@ -2268,7 +2245,7 @@ async function buildForProvider(provider, context, rootOutputDir, endpointGenera
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$9.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await import("./bundler-E5VcXsPH.mjs");
+			const { bundleServer } = await import("./bundler-c6QvGUBM.mjs");
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -2595,11 +2572,11 @@ async function createDnsProvider(options) {
 	if (isDnsProvider(config$1.provider)) return config$1.provider;
 	const provider = config$1.provider;
 	if (provider === "hostinger") {
-		const { HostingerProvider } = await import("./HostingerProvider-YvCg3Mus.mjs");
+		const { HostingerProvider } = await import("./HostingerProvider-ANWchdiK.mjs");
 		return new HostingerProvider();
 	}
 	if (provider === "route53") {
-		const { Route53Provider } = await import("./Route53Provider-CYlDOrYO.mjs");
+		const { Route53Provider } = await import("./Route53Provider-QoPgcXxn.mjs");
 		const route53Config = config$1;
 		return new Route53Provider({
 			region: route53Config.region,
@@ -5070,20 +5047,20 @@ function isStateProvider(value) {
 async function createStateProvider(options) {
 	const { config: config$1, workspaceRoot, workspaceName } = options;
 	if (!config$1) {
-		const { LocalStateProvider } = await import("./LocalStateProvider-BciOhGR0.mjs");
+		const { LocalStateProvider } = await import("./LocalStateProvider-Dp0KkRcw.mjs");
 		return new LocalStateProvider(workspaceRoot);
 	}
 	if (isStateProvider(config$1.provider)) return config$1.provider;
 	const provider = config$1.provider;
 	if (provider === "local") {
-		const { LocalStateProvider } = await import("./LocalStateProvider-BciOhGR0.mjs");
+		const { LocalStateProvider } = await import("./LocalStateProvider-Dp0KkRcw.mjs");
 		return new LocalStateProvider(workspaceRoot);
 	}
 	if (provider === "ssm") {
 		if (!workspaceName) throw new Error("Workspace name is required for SSM state provider. Set \"name\" in gkm.config.ts.");
-		const { LocalStateProvider } = await import("./LocalStateProvider-BciOhGR0.mjs");
-		const { SSMStateProvider } = await import("./SSMStateProvider-DXT1dIdI.mjs");
-		const { CachedStateProvider: CachedStateProvider$1 } = await import("./CachedStateProvider-C4QqvlPE.mjs");
+		const { LocalStateProvider } = await import("./LocalStateProvider-Dp0KkRcw.mjs");
+		const { SSMStateProvider } = await import("./SSMStateProvider-CksOTB8M.mjs");
+		const { CachedStateProvider: CachedStateProvider$1 } = await import("./CachedStateProvider-CC0DyO09.mjs");
 		const ssmConfig = config$1;
 		const local = new LocalStateProvider(workspaceRoot);
 		const ssm = SSMStateProvider.create({
@@ -5193,6 +5170,353 @@ function generateSecretsReport(encryptedApps, sniffedApps) {
 	};
 }
 
+//#endregion
+//#region src/deploy/sniffer.ts
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+/**
+* Resolve the tsx package path from the CLI package's dependencies.
+* This ensures tsx is available regardless of whether the target project has it installed.
+*/
+function resolveTsxPath() {
+	const require$2 = createRequire(import.meta.url);
+	return require$2.resolve("tsx");
+}
+/**
+* Resolve the path to a sniffer helper file.
+* Handles both dev (.ts with tsx) and production (.mjs from dist).
+*
+* In production: sniffer.ts is bundled into dist/index.mjs, but sniffer helper
+* files are output to dist/deploy/ as standalone modules for subprocess loading.
+*
+* In development: All files are in src/deploy/ and loaded via tsx.
+*/
+function resolveSnifferFile(baseName) {
+	const deployMjsPath = resolve(__dirname, "deploy", `${baseName}.mjs`);
+	if (existsSync(deployMjsPath)) return deployMjsPath;
+	const mjsPath = resolve(__dirname, `${baseName}.mjs`);
+	if (existsSync(mjsPath)) return mjsPath;
+	const tsPath = resolve(__dirname, `${baseName}.ts`);
+	if (existsSync(tsPath)) return tsPath;
+	return tsPath;
+}
+/**
+* Get required environment variables for an app.
+*
+* Detection strategy (in order):
+* 1. Frontend apps: Returns empty (no server secrets)
+* 2. Apps with `requiredEnv`: Uses explicit list from config
+* 3. Entry apps: Imports entry file in subprocess to capture config.parse() calls
+* 4. Route-based apps: Loads route files and calls getEnvironment() on each construct
+* 5. Apps with `envParser` (no routes): Runs SnifferEnvironmentParser to detect usage
+* 6. Apps with neither: Returns empty
+*
+* This function handles "fire and forget" async operations gracefully,
+* capturing errors and unhandled rejections without failing the build.
+*
+* @param app - The normalized app configuration
+* @param appName - The name of the app
+* @param workspacePath - Absolute path to the workspace root
+* @param options - Optional configuration for sniffing behavior
+* @returns The sniffed environment with required variables
+*/
+async function sniffAppEnvironment(app, appName, workspacePath, options = {}) {
+	const { logWarnings = true, markOptional = false } = options;
+	if (app.type === "frontend") {
+		const depVars = (app.dependencies ?? []).map((dep) => `NEXT_PUBLIC_${dep.toUpperCase()}_URL`);
+		if (app.config) {
+			const sniffedVars = [];
+			const sniffedOptional = [];
+			const configPaths = [];
+			if (app.config.client) configPaths.push(app.config.client);
+			if (app.config.server) configPaths.push(app.config.server);
+			for (const configPath of configPaths) {
+				const result = await sniffEntryFile(configPath, app.path, workspacePath);
+				if (logWarnings && result.error) console.warn(`[sniffer] ${appName}: Config file "${configPath}" threw error during sniffing (env vars still captured): ${result.error.message}`);
+				sniffedVars.push(...result.envVars);
+				sniffedOptional.push(...result.optionalEnvVars);
+			}
+			const optionalEnvVars = [...new Set(sniffedOptional)];
+			const allVars = applyMarkOptional([...new Set([...depVars, ...sniffedVars])], optionalEnvVars, markOptional);
+			return {
+				appName,
+				requiredEnvVars: allVars,
+				optionalEnvVars
+			};
+		}
+		return {
+			appName,
+			requiredEnvVars: depVars,
+			optionalEnvVars: []
+		};
+	}
+	if (app.entry) {
+		const result = await sniffEntryFile(app.entry, app.path, workspacePath);
+		if (logWarnings && result.error) console.warn(`[sniffer] ${appName}: Entry file threw error during sniffing (env vars still captured): ${result.error.message}`);
+		return {
+			appName,
+			requiredEnvVars: applyMarkOptional(result.envVars, result.optionalEnvVars, markOptional),
+			optionalEnvVars: result.optionalEnvVars
+		};
+	}
+	if (app.routes) {
+		const result = await sniffRouteFiles(normalizeRoutes(app.routes), app.path, workspacePath);
+		if (logWarnings && result.error) console.warn(`[sniffer] ${appName}: Route sniffing threw error (env vars still captured): ${result.error.message}`);
+		return {
+			appName,
+			requiredEnvVars: applyMarkOptional(result.envVars, result.optionalEnvVars, markOptional),
+			optionalEnvVars: result.optionalEnvVars
+		};
+	}
+	if (app.envParser) {
+		const result = await sniffEnvParser(app.envParser, app.path, workspacePath);
+		if (logWarnings) {
+			if (result.error) console.warn(`[sniffer] ${appName}: envParser threw error during sniffing (env vars still captured): ${result.error.message}`);
+			if (result.unhandledRejections.length > 0) console.warn(`[sniffer] ${appName}: Fire-and-forget rejections during sniffing (suppressed): ${result.unhandledRejections.map((e) => e.message).join(", ")}`);
+		}
+		return {
+			appName,
+			requiredEnvVars: applyMarkOptional(result.envVars, result.optionalEnvVars, markOptional),
+			optionalEnvVars: result.optionalEnvVars
+		};
+	}
+	return {
+		appName,
+		requiredEnvVars: [],
+		optionalEnvVars: []
+	};
+}
+/**
+* Apply the `?` suffix to optional variables in an env var list.
+* Only modifies the list when `markOptional` is true and there are optional vars.
+*/
+function applyMarkOptional(envVars, optionalEnvVars, markOptional) {
+	if (!markOptional || optionalEnvVars.length === 0) return envVars;
+	const optionalSet = new Set(optionalEnvVars);
+	return envVars.map((v) => optionalSet.has(v) ? `${v}?` : v);
+}
+/**
+* Sniff an entry file by importing it in a subprocess.
+*
+* Entry apps call `config.parse()` at module load time. To capture which
+* env vars are accessed, we:
+* 1. Spawn a subprocess with a module loader hook
+* 2. The loader intercepts `@geekmidas/envkit` and replaces EnvironmentParser
+*    with SnifferEnvironmentParser
+* 3. Import the entry file (triggers config.parse())
+* 4. Capture and return the accessed env var names
+*
+* This approach provides process isolation - each app is sniffed in its own
+* subprocess, preventing module cache pollution.
+*
+* @param entryPath - Relative path to the entry file (e.g., './src/index.ts')
+* @param appPath - The app's path relative to workspace (e.g., 'apps/auth')
+* @param workspacePath - Absolute path to workspace root
+* @returns EntrySniffResult with env vars and optional error
+*/
+async function sniffEntryFile(entryPath, appPath, workspacePath) {
+	const fullEntryPath = resolve(workspacePath, appPath, entryPath);
+	const loaderPath = resolveSnifferFile("sniffer-loader");
+	const workerPath = resolveSnifferFile("sniffer-worker");
+	return new Promise((resolvePromise) => {
+		const child = spawn("node", [
+			"--import",
+			loaderPath,
+			workerPath,
+			fullEntryPath
+		], {
+			cwd: resolve(workspacePath, appPath),
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			env: {
+				...process.env,
+				NODE_OPTIONS: "--import=tsx"
+			}
+		});
+		let stdout$1 = "";
+		let stderr = "";
+		child.stdout.on("data", (data) => {
+			stdout$1 += data.toString();
+		});
+		child.stderr.on("data", (data) => {
+			stderr += data.toString();
+		});
+		child.on("close", (code) => {
+			try {
+				const jsonMatch = stdout$1.match(/\{[^{}]*"envVars"[^{}]*\}[^{]*$/);
+				if (jsonMatch) {
+					const result = JSON.parse(jsonMatch[0]);
+					resolvePromise({
+						envVars: result.envVars || [],
+						optionalEnvVars: result.optionalEnvVars || [],
+						error: result.error ? new Error(result.error) : void 0
+					});
+					return;
+				}
+			} catch {}
+			resolvePromise({
+				envVars: [],
+				optionalEnvVars: [],
+				error: new Error(`Failed to sniff entry file (exit code ${code}): ${stderr || stdout$1 || "No output"}`)
+			});
+		});
+		child.on("error", (err) => {
+			resolvePromise({
+				envVars: [],
+				optionalEnvVars: [],
+				error: err
+			});
+		});
+	});
+}
+/**
+* Sniff route files by loading constructs and calling getEnvironment().
+*
+* Route-based apps have endpoints, functions, crons, and subscribers that
+* use services. Each service's register() method accesses environment variables.
+*
+* This runs in a subprocess with tsx loader to properly handle TypeScript
+* compilation and path alias resolution (e.g., `src/...` imports).
+*
+* @param routes - Glob pattern(s) for route files
+* @param appPath - The app's path relative to workspace (e.g., 'apps/api')
+* @param workspacePath - Absolute path to workspace root
+* @returns EntrySniffResult with env vars and optional error
+*/
+async function sniffRouteFiles(routes, appPath, workspacePath) {
+	const fullAppPath = resolve(workspacePath, appPath);
+	const workerPath = resolveSnifferFile("sniffer-routes-worker");
+	const tsxPath = resolveTsxPath();
+	const routesArray = Array.isArray(routes) ? routes : [routes];
+	const pattern = routesArray[0];
+	if (!pattern) return {
+		envVars: [],
+		optionalEnvVars: [],
+		error: new Error("No route patterns provided")
+	};
+	return new Promise((resolvePromise) => {
+		const child = spawn("node", [
+			"--import",
+			tsxPath,
+			workerPath,
+			fullAppPath,
+			pattern
+		], {
+			cwd: fullAppPath,
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			env: { ...process.env }
+		});
+		let stdout$1 = "";
+		let stderr = "";
+		child.stdout.on("data", (data) => {
+			stdout$1 += data.toString();
+		});
+		child.stderr.on("data", (data) => {
+			stderr += data.toString();
+		});
+		child.on("close", (code) => {
+			if (stderr) stderr.split("\n").filter((line) => line.trim()).forEach((line) => console.warn(line));
+			try {
+				const jsonMatch = stdout$1.match(/\{[^{}]*"envVars"[^{}]*\}[^{]*$/);
+				if (jsonMatch) {
+					const result = JSON.parse(jsonMatch[0]);
+					resolvePromise({
+						envVars: result.envVars || [],
+						optionalEnvVars: result.optionalEnvVars || [],
+						error: result.error ? new Error(result.error) : void 0
+					});
+					return;
+				}
+			} catch {}
+			resolvePromise({
+				envVars: [],
+				optionalEnvVars: [],
+				error: new Error(`Failed to sniff route files (exit code ${code}): ${stderr || stdout$1 || "No output"}`)
+			});
+		});
+		child.on("error", (err) => {
+			resolvePromise({
+				envVars: [],
+				optionalEnvVars: [],
+				error: err
+			});
+		});
+	});
+}
+/**
+* Run the SnifferEnvironmentParser on an envParser module to detect
+* which environment variables it accesses.
+*
+* This function handles "fire and forget" async operations by using
+* the shared sniffWithFireAndForget utility from @geekmidas/envkit.
+*
+* @param envParserPath - The envParser config (e.g., './src/config/env#envParser')
+* @param appPath - The app's path relative to workspace
+* @param workspacePath - Absolute path to workspace root
+* @returns SniffResult with env vars and any errors encountered
+*/
+async function sniffEnvParser(envParserPath, appPath, workspacePath) {
+	const [modulePath, exportName = "default"] = envParserPath.split("#");
+	if (!modulePath) return {
+		envVars: [],
+		optionalEnvVars: [],
+		unhandledRejections: []
+	};
+	const fullPath = resolve(workspacePath, appPath, modulePath);
+	let SnifferEnvironmentParser;
+	let sniffWithFireAndForget;
+	try {
+		const envkitModule = await import("@geekmidas/envkit/sniffer");
+		SnifferEnvironmentParser = envkitModule.SnifferEnvironmentParser;
+		sniffWithFireAndForget = envkitModule.sniffWithFireAndForget;
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		console.warn(`[sniffer] Failed to import SnifferEnvironmentParser: ${message}`);
+		return {
+			envVars: [],
+			optionalEnvVars: [],
+			unhandledRejections: []
+		};
+	}
+	const sniffer = new SnifferEnvironmentParser();
+	return sniffWithFireAndForget(sniffer, async () => {
+		const moduleUrl = pathToFileURL(fullPath).href;
+		const module = await import(moduleUrl);
+		const envParser = module[exportName];
+		if (typeof envParser !== "function") {
+			console.warn(`[sniffer] Export "${exportName}" from "${modulePath}" is not a function`);
+			return;
+		}
+		const result = envParser(sniffer);
+		if (result && typeof result.parse === "function") try {
+			result.parse();
+		} catch {}
+	});
+}
+/**
+* Sniff environment requirements for multiple apps.
+*
+* @param apps - Map of app name to app config
+* @param workspacePath - Absolute path to workspace root
+* @param options - Optional configuration for sniffing behavior
+* @returns Map of app name to sniffed environment
+*/
+async function sniffAllApps(apps, workspacePath, options = {}) {
+	const results = /* @__PURE__ */ new Map();
+	for (const [appName, app] of Object.entries(apps)) {
+		const sniffed = await sniffAppEnvironment(app, appName, workspacePath, options);
+		results.set(appName, sniffed);
+	}
+	return results;
+}
+
 //#endregion
 //#region src/deploy/index.ts
 const logger$3 = console;
@@ -5862,7 +6186,7 @@ async function workspaceDeployCommand(workspace, options) {
 	}
 	if (workspace.deploy?.backups && provisionedPostgres) {
 		logger$3.log("\n💾 Provisioning backup destination...");
-		const { provisionBackupDestination } = await import("./backup-provisioner-CCUcj28C.mjs");
+		const { provisionBackupDestination } = await import("./backup-provisioner-BEXoHTuC.mjs");
 		const backupState = await provisionBackupDestination({
 			api,
 			projectId: project.projectId,
@@ -6517,7 +6841,7 @@ const GEEKMIDAS_VERSIONS = {
 	"@geekmidas/constructs": "~3.0.7",
 	"@geekmidas/db": "~1.0.1",
 	"@geekmidas/emailkit": "~1.0.0",
-	"@geekmidas/envkit": "~1.0.4",
+	"@geekmidas/envkit": "~1.0.5",
 	"@geekmidas/errors": "~1.0.0",
 	"@geekmidas/events": "~1.1.0",
 	"@geekmidas/logger": "~1.0.0",
@@ -7162,7 +7486,7 @@ ${volumes.join("\n")}
 /**
 * Generate .env file for docker-compose with database passwords
 */
-function generateDockerEnv(apps, eventsBackend) {
+function generateDockerEnv(apps, _eventsBackend) {
 	const envVars = apps.map((app) => {
 		const envVar = `${app.name.toUpperCase()}_DB_PASSWORD`;
 		return `${envVar}=${app.password}`;
@@ -7181,7 +7505,7 @@ ${envVars.join("\n")}
 * - auth user: uses auth schema with search_path=auth
 * - pgboss user: uses pgboss schema (when events === 'pgboss')
 */
-function generatePostgresInitScript(apps, eventsBackend) {
+function generatePostgresInitScript(apps, _eventsBackend) {
 	const userCreations = apps.map((app) => {
 		const userName = app.name.replace(/-/g, "_");
 		const envVar = `${app.name.toUpperCase()}_DB_PASSWORD`;
@@ -12151,8 +12475,8 @@ program.command("secrets:push").description("Push secrets to remote provider (SS
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig: loadWorkspaceConfig$1 } = await import("./config.mjs");
-		const { pushSecrets: pushSecrets$1 } = await import("./sync-fzT5WX_y.mjs");
-		const { reconcileMissingSecrets } = await import("./reconcile-D423q2QW.mjs");
+		const { pushSecrets: pushSecrets$1 } = await import("./sync-COnAugP-.mjs");
+		const { reconcileMissingSecrets } = await import("./reconcile-DAAKa0YR.mjs");
 		const { readStageSecrets: readStageSecrets$1, writeStageSecrets: writeStageSecrets$1 } = await import("./storage-Cs4WBsc4.mjs");
 		const { workspace } = await loadWorkspaceConfig$1();
 		const secrets = await readStageSecrets$1(options.stage, workspace.root);
@@ -12176,9 +12500,9 @@ program.command("secrets:pull").description("Pull secrets from remote provider (
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig: loadWorkspaceConfig$1 } = await import("./config.mjs");
-		const { pullSecrets: pullSecrets$1 } = await import("./sync-fzT5WX_y.mjs");
+		const { pullSecrets: pullSecrets$1 } = await import("./sync-COnAugP-.mjs");
 		const { writeStageSecrets: writeStageSecrets$1 } = await import("./storage-Cs4WBsc4.mjs");
-		const { reconcileMissingSecrets } = await import("./reconcile-D423q2QW.mjs");
+		const { reconcileMissingSecrets } = await import("./reconcile-DAAKa0YR.mjs");
 		const { workspace } = await loadWorkspaceConfig$1();
 		let secrets = await pullSecrets$1(options.stage, workspace);
 		if (!secrets) {
@@ -12203,7 +12527,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig: loadWorkspaceConfig$1 } = await import("./config.mjs");
-		const { reconcileMissingSecrets } = await import("./reconcile-D423q2QW.mjs");
+		const { reconcileMissingSecrets } = await import("./reconcile-DAAKa0YR.mjs");
 		const { readStageSecrets: readStageSecrets$1, writeStageSecrets: writeStageSecrets$1 } = await import("./storage-Cs4WBsc4.mjs");
 		const { workspace } = await loadWorkspaceConfig$1();
 		const secrets = await readStageSecrets$1(options.stage, workspace.root);