@geekmidas/cli 10.0.0-alpha.115 → 10.0.0-alpha.116

package/dist/{bundler-hvCgi0EG.cjs → bundler-B2_2-Dum.cjs}

@@ -55,6 +55,58 @@ async function collectRequiredEnvVars(constructs) {
 	for (const construct of constructs) for (const name of await construct.getEnvironment({ markOptional: true })) if (!name.endsWith("?")) required.add(name);
 	return Array.from(required).sort();
 }
+/** `<dir>/node_modules/<name>`, from `from` up to the root; the first found. */
+function installed(name, from) {
+	for (let dir = from;; dir = (0, node_path.dirname)(dir)) {
+		const candidate = (0, node_path.join)(dir, "node_modules", name, "package.json");
+		if ((0, node_fs.existsSync)(candidate)) return (0, node_fs.realpathSync)((0, node_path.dirname)(candidate));
+		if ((0, node_path.dirname)(dir) === dir) return void 0;
+	}
+}
+/**
+* The optional peers of the @geekmidas packages an app reaches that are not
+* installed where those packages would resolve them.
+*
+* Each is imported only on the path that needs it — `@aws-sdk/client-kms`
+* for a `kms:` key, say — so an app that never takes that path never
+* installs it. esbuild resolves a dynamic import all the same, and fails
+* the bundle on one it cannot find; left external instead, it is only
+* looked for if that path runs, where its absence says what to install.
+*/
+function missingOptionalPeers(from) {
+	const missing = /* @__PURE__ */ new Set();
+	const seen = /* @__PURE__ */ new Set();
+	const visit = (dir) => {
+		if (seen.has(dir)) return;
+		seen.add(dir);
+		const pkg = JSON.parse((0, node_fs.readFileSync)((0, node_path.join)(dir, "package.json"), "utf-8"));
+		for (const [peer, meta] of Object.entries(pkg.peerDependenciesMeta ?? {})) if (meta?.optional && !installed(peer, dir)) missing.add(peer);
+		for (const name of Object.keys({
+			...pkg.dependencies,
+			...pkg.peerDependencies
+		})) {
+			if (!name.startsWith("@geekmidas/")) continue;
+			const found = installed(name, dir);
+			if (found) visit(found);
+		}
+	};
+	for (let dir = from;; dir = (0, node_path.dirname)(dir)) {
+		if ((0, node_fs.existsSync)((0, node_path.join)(dir, "package.json"))) {
+			const pkg = JSON.parse((0, node_fs.readFileSync)((0, node_path.join)(dir, "package.json"), "utf-8"));
+			for (const name of Object.keys({
+				...pkg.dependencies,
+				...pkg.devDependencies
+			})) {
+				if (!name.startsWith("@geekmidas/")) continue;
+				const found = installed(name, dir);
+				if (found) visit(found);
+			}
+			break;
+		}
+		if ((0, node_path.dirname)(dir) === dir) break;
+	}
+	return [...missing].sort();
+}
 /**
 * Bundle the server application using esbuild.
 * Creates a fully standalone bundle with all dependencies included.
@@ -79,7 +131,7 @@ async function bundleServer(options) {
 	];
 	if (minify) args.push("--minify", "--keep-names");
 	if (sourcemap) args.push("--sourcemap");
-	for (const ext of external) args.push(`--external:${ext}`);
+	for (const ext of [...external, ...missingOptionalPeers((0, node_path.dirname)(entryPoint))]) args.push(`--external:${ext}`);
 	let masterKey;
 	if (stage) {
 		const { toEmbeddableSecrets, validateEnvironmentVariables, initStageSecrets } = await Promise.resolve().then(() => require("./seeds-DbKNcs3o.cjs")).then((n) => n.storage_exports);
@@ -166,4 +218,4 @@ async function bundleServer(options) {
 //#endregion
 exports.bundleServer = bundleServer;
 
-//# sourceMappingURL=bundler-hvCgi0EG.cjs.map
+//# sourceMappingURL=bundler-B2_2-Dum.cjs.map

package/dist/bundler-B2_2-Dum.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundler-B2_2-Dum.cjs","names":["require","createRequire","join","dirname","existsSync","realpathSync","readFileSync","mkdir","spawnSync","writeFile"],"sources":["../src/build/bundler.ts"],"sourcesContent":["import { spawnSync } from 'node:child_process';\nimport { existsSync, readFileSync, realpathSync } from 'node:fs';\nimport { mkdir, writeFile } from 'node:fs/promises';\nimport { createRequire } from 'node:module';\nimport { dirname, join } from 'node:path';\nimport type { Construct } from '@geekmidas/constructs';\n\n/**\n * Banner to inject into ESM bundle for CJS compatibility.\n * Creates a `require` function using Node's createRequire for packages\n * that internally use CommonJS require() for Node builtins.\n */\nconst ESM_CJS_COMPAT_BANNER =\n\t'import { createRequire } from \"module\"; const require = createRequire(import.meta.url);';\n\nexport interface BundleOptions {\n\t/** Entry point file (e.g., .gkm/server/server.ts) */\n\tentryPoint: string;\n\t/** Output directory for bundled files */\n\toutputDir: string;\n\t/** The bundle's file name in `outputDir`. Defaults to `server.mjs`. */\n\toutfile?: string;\n\t/** Minify the output (default: true) */\n\tminify: boolean;\n\t/** Generate sourcemaps (default: false) */\n\tsourcemap: boolean;\n\t/** Packages to exclude from bundling */\n\texternal: string[];\n\t/** Stage for secrets injection (optional) */\n\tstage?: string;\n\t/** Constructs to validate environment variables for */\n\tconstructs?: Construct[];\n}\n\nexport interface BundleResult {\n\t/** Path to the bundled output */\n\toutputPath: string;\n\t/** Ephemeral master key for deployment (only if stage was provided) */\n\tmasterKey?: string;\n}\n\n/**\n * The esbuild binary, resolved from this package rather than from PATH.\n *\n * It used to be `npx esbuild`, which is two assumptions: that esbuild is\n * installed somewhere npx can find, and that the *app's* directory is where to\n * look. Neither holds — the CLI did not depend on esbuild at all, so a deploy\n * run from an app that had not installed it failed at the bundle step with\n * `sh: esbuild: command not found`, after provisioning had already happened.\n *\n * The same fix `bin/gkm.mjs` makes for tsx: resolve from this package's own\n * `node_modules`, so the tool the CLI shells out to is the one it depends on.\n */\nfunction esbuildBinary(): string {\n\tconst require = createRequire(import.meta.url);\n\n\ttry {\n\t\t// The package root, then its bin — `require.resolve('esbuild')` gives the\n\t\t// JS entry point, which is a library rather than the CLI.\n\t\tconst pkg = require.resolve('esbuild/package.json');\n\t\treturn join(dirname(pkg), 'bin', 'esbuild');\n\t} catch {\n\t\t// Better a PATH lookup than a hard failure: a project that installed\n\t\t// esbuild itself still works.\n\t\treturn 'esbuild';\n\t}\n}\n\n/**\n * Collect the environment variables a build cannot proceed without.\n *\n * Uses the SnifferEnvironmentParser to detect which env vars each service\n * reads, and keeps only the ones it cannot do without. `markOptional` is what\n * separates them: the sniffer already knows which reads went through\n * `.optional()` or `.default()`, and asking for that distinction is the\n * difference between a build that stops and one that proceeds correctly.\n *\n * Without it, a key that is *absent by design* failed the build. A surface\n * publishes `AUTH_COOKIE_DOMAIN` only when there is a domain to widen a cookie\n * to — one host has nothing to share it with, so the derivation correctly\n * yields nothing, and Better Auth reads it as optional for exactly that\n * reason. Treating every sniffed read as required made the honest answer\n * indistinguishable from a missing secret.\n *\n * @param constructs - Array of constructs to analyze\n * @returns Deduplicated, sorted names of the required variables\n */\nasync function collectRequiredEnvVars(\n\tconstructs: Construct[],\n): Promise<string[]> {\n\t// A key read optionally by one construct and required by another stays\n\t// required: the strictest read is the one that fails at runtime, and taking\n\t// the union of the required reads is what says so.\n\tconst required = new Set<string>();\n\n\tfor (const construct of constructs) {\n\t\tfor (const name of await construct.getEnvironment({ markOptional: true })) {\n\t\t\tif (!name.endsWith('?')) required.add(name);\n\t\t}\n\t}\n\n\treturn Array.from(required).sort();\n}\n\n/** `<dir>/node_modules/<name>`, from `from` up to the root; the first found. */\nfunction installed(name: string, from: string): string | undefined {\n\tfor (let dir = from; ; dir = dirname(dir)) {\n\t\tconst candidate = join(dir, 'node_modules', name, 'package.json');\n\t\tif (existsSync(candidate)) return realpathSync(dirname(candidate));\n\t\tif (dirname(dir) === dir) return undefined;\n\t}\n}\n\n/**\n * The optional peers of the @geekmidas packages an app reaches that are not\n * installed where those packages would resolve them.\n *\n * Each is imported only on the path that needs it — `@aws-sdk/client-kms`\n * for a `kms:` key, say — so an app that never takes that path never\n * installs it. esbuild resolves a dynamic import all the same, and fails\n * the bundle on one it cannot find; left external instead, it is only\n * looked for if that path runs, where its absence says what to install.\n */\nexport function missingOptionalPeers(from: string): string[] {\n\tconst missing = new Set<string>();\n\tconst seen = new Set<string>();\n\tconst visit = (dir: string) => {\n\t\tif (seen.has(dir)) return;\n\t\tseen.add(dir);\n\t\tconst pkg = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf-8'));\n\t\tfor (const [peer, meta] of Object.entries(\n\t\t\t(pkg.peerDependenciesMeta ?? {}) as Record<\n\t\t\t\tstring,\n\t\t\t\t{ optional?: boolean }\n\t\t\t>,\n\t\t)) {\n\t\t\tif (meta?.optional && !installed(peer, dir)) missing.add(peer);\n\t\t}\n\t\tfor (const name of Object.keys({\n\t\t\t...pkg.dependencies,\n\t\t\t...pkg.peerDependencies,\n\t\t})) {\n\t\t\tif (!name.startsWith('@geekmidas/')) continue;\n\t\t\tconst found = installed(name, dir);\n\t\t\tif (found) visit(found);\n\t\t}\n\t};\n\n\t// The app's own package.json: the nearest above the entry.\n\tfor (let dir = from; ; dir = dirname(dir)) {\n\t\tif (existsSync(join(dir, 'package.json'))) {\n\t\t\tconst pkg = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf-8'));\n\t\t\tfor (const name of Object.keys({\n\t\t\t\t...pkg.dependencies,\n\t\t\t\t...pkg.devDependencies,\n\t\t\t})) {\n\t\t\t\tif (!name.startsWith('@geekmidas/')) continue;\n\t\t\t\tconst found = installed(name, dir);\n\t\t\t\tif (found) visit(found);\n\t\t\t}\n\t\t\tbreak;\n\t\t}\n\t\tif (dirname(dir) === dir) break;\n\t}\n\treturn [...missing].sort();\n}\n\n/**\n * Bundle the server application using esbuild.\n * Creates a fully standalone bundle with all dependencies included.\n *\n * @param options - Bundle configuration options\n * @returns Bundle result with output path and optional master key\n */\n\nexport async function bundleServer(\n\toptions: BundleOptions,\n): Promise<BundleResult> {\n\tconst {\n\t\tentryPoint,\n\t\toutputDir,\n\t\tminify,\n\t\tsourcemap,\n\t\texternal,\n\t\tstage,\n\t\tconstructs,\n\t} = options;\n\n\t// Ensure output directory exists\n\tawait mkdir(outputDir, { recursive: true });\n\n\tconst mjsOutput = join(outputDir, options.outfile ?? 'server.mjs');\n\n\t// Build command-line arguments for esbuild\n\tconst args = [\n\t\tesbuildBinary(),\n\t\tentryPoint,\n\t\t'--bundle',\n\t\t'--platform=node',\n\t\t'--target=node22',\n\t\t'--format=esm',\n\t\t`--outfile=${mjsOutput}`,\n\t\t'--packages=bundle', // Bundle all dependencies for standalone output\n\t\t`--banner:js=${ESM_CJS_COMPAT_BANNER}`, // CJS compatibility for packages like pino\n\t];\n\n\tif (minify) {\n\t\t// Names kept: an error's class name is what a log line's `err.type` and\n\t\t// a response's `name` say, and minified they read `_6`.\n\t\targs.push('--minify', '--keep-names');\n\t}\n\n\tif (sourcemap) {\n\t\targs.push('--sourcemap');\n\t}\n\n\t// Add external packages (user-specified), and the optional peers a\n\t// @geekmidas package only loads on a path this app may never take\n\tfor (const ext of [\n\t\t...external,\n\t\t...missingOptionalPeers(dirname(entryPoint)),\n\t]) {\n\t\targs.push(`--external:${ext}`);\n\t}\n\n\t// Handle secrets injection if stage is provided\n\tlet masterKey: string | undefined;\n\n\tif (stage) {\n\t\tconst {\n\t\t\ttoEmbeddableSecrets,\n\t\t\tvalidateEnvironmentVariables,\n\t\t\tinitStageSecrets,\n\t\t} = await import('../secrets/storage');\n\t\tconst { FileSecretsStore, secretsStoreFor } = await import(\n\t\t\t'../secrets/store'\n\t\t);\n\t\tconst { ConfigNotFound, loadWorkspaceSettings } = await import('../config');\n\t\tconst { encryptSecrets, generateDefineOptions } = await import(\n\t\t\t'../secrets/encryption'\n\t\t);\n\n\t\t// The stage's own store — SSM or Secrets Manager for a deployed stage\n\t\t// kept there. Outside\n\t\t// any workspace nothing names one, so it is the file.\n\t\tconst store = await loadWorkspaceSettings().then(\n\t\t\t(workspace) => secretsStoreFor(workspace, stage),\n\t\t\t(error) => {\n\t\t\t\tif (error instanceof ConfigNotFound) {\n\t\t\t\t\treturn new FileSecretsStore(process.cwd());\n\t\t\t\t}\n\t\t\t\tthrow error;\n\t\t\t},\n\t\t);\n\t\tlet secrets = await store.read(stage);\n\n\t\tif (!secrets) {\n\t\t\t// Auto-initialize secrets for the stage\n\t\t\tconsole.log(`  Initializing secrets for stage \"${stage}\"...`);\n\t\t\tsecrets = initStageSecrets(stage);\n\t\t\tawait store.write(stage, secrets);\n\t\t\tconsole.log(`  ✓ Created the \"${stage}\" secrets (${store.name})`);\n\t\t}\n\n\t\t// Validate environment variables if constructs are provided\n\t\tif (constructs && constructs.length > 0) {\n\t\t\tconsole.log('  Analyzing environment variable requirements...');\n\t\t\tconst requiredVars = await collectRequiredEnvVars(constructs);\n\n\t\t\tif (requiredVars.length > 0) {\n\t\t\t\tconst validation = validateEnvironmentVariables(requiredVars, secrets);\n\n\t\t\t\tif (!validation.valid) {\n\t\t\t\t\tconst errorMessage = [\n\t\t\t\t\t\t`Missing environment variables for stage \"${stage}\":`,\n\t\t\t\t\t\t'',\n\t\t\t\t\t\t...validation.missing.map((v) => `  ❌ ${v}`),\n\t\t\t\t\t\t'',\n\t\t\t\t\t\t'To fix this, either:',\n\t\t\t\t\t\t`  1. Add the missing variables to the \"${stage}\" secrets using:`,\n\t\t\t\t\t\t`     gkm secrets:set <KEY> <VALUE> --stage ${stage}`,\n\t\t\t\t\t\t'',\n\t\t\t\t\t\t`  2. Or import from a JSON file:`,\n\t\t\t\t\t\t`     gkm secrets:import secrets.json --stage ${stage}`,\n\t\t\t\t\t\t'',\n\t\t\t\t\t\t'Required variables:',\n\t\t\t\t\t\t...validation.required.map((v) =>\n\t\t\t\t\t\t\tvalidation.missing.includes(v) ? `  ❌ ${v}` : `  ✓ ${v}`,\n\t\t\t\t\t\t),\n\t\t\t\t\t].join('\\n');\n\n\t\t\t\t\tthrow new Error(errorMessage);\n\t\t\t\t}\n\n\t\t\t\tconsole.log(\n\t\t\t\t\t`  ✓ All ${requiredVars.length} required environment variables found`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\t// Convert to embeddable format and encrypt\n\t\tconst embeddable = toEmbeddableSecrets(secrets);\n\t\tconst encrypted = encryptSecrets(embeddable);\n\t\tmasterKey = encrypted.masterKey;\n\n\t\t// Add define options for build-time injection using esbuild's --define:KEY=VALUE format\n\t\tconst defines = generateDefineOptions(encrypted);\n\t\tfor (const [key, value] of Object.entries(defines)) {\n\t\t\t// `value` is already a JS string literal; quoting it again would\n\t\t\t// embed the quotes, and the IV would not parse as hex.\n\t\t\targs.push(`--define:${key}=${value}`);\n\t\t}\n\n\t\tconsole.log(`  Secrets encrypted for stage \"${stage}\"`);\n\t} else {\n\t\t// Credentials encrypted elsewhere — an image build hands them in as a\n\t\t// BuildKit secret and writes them beside the app's `.gkm/server` — are\n\t\t// embedded as they are; whoever encrypted them holds the key.\n\t\tconst gkmDir = join(outputDir, '..', '..');\n\t\tconst encryptedPath = join(gkmDir, 'credentials.enc');\n\t\tconst ivPath = join(gkmDir, 'credentials.iv');\n\t\tif (existsSync(encryptedPath) && existsSync(ivPath)) {\n\t\t\tconst { generateDefineOptions } = await import('../secrets/encryption');\n\t\t\tconst defines = generateDefineOptions({\n\t\t\t\tencrypted: readFileSync(encryptedPath, 'utf-8').trim(),\n\t\t\t\tiv: readFileSync(ivPath, 'utf-8').trim(),\n\t\t\t\tmasterKey: '',\n\t\t\t});\n\t\t\tfor (const [key, value] of Object.entries(defines)) {\n\t\t\t\targs.push(`--define:${key}=${value}`);\n\t\t\t}\n\t\t\tconsole.log('  Embedded the encrypted credentials the build was given');\n\t\t}\n\t}\n\n\ttry {\n\t\t// Run esbuild with command-line arguments\n\t\tconst [cmd, ...cmdArgs] = args as [string, ...string[]];\n\t\tconst result = spawnSync(cmd, cmdArgs, {\n\t\t\tcwd: process.cwd(),\n\t\t\tstdio: 'inherit',\n\t\t\tshell: process.platform === 'win32', // Only use shell on Windows for npx resolution\n\t\t});\n\n\t\tif (result.error) {\n\t\t\tthrow result.error;\n\t\t}\n\t\tif (result.status !== 0) {\n\t\t\tthrow new Error(`esbuild exited with code ${result.status}`);\n\t\t}\n\n\t\t// Add shebang to the bundled file\n\t\tconst { readFile } = await import('node:fs/promises');\n\t\tconst content = await readFile(mjsOutput, 'utf-8');\n\t\tif (!content.startsWith('#!')) {\n\t\t\tawait writeFile(mjsOutput, `#!/usr/bin/env node\\n${content}`);\n\t\t}\n\t} catch (error) {\n\t\tthrow new Error(\n\t\t\t`Failed to bundle server: ${error instanceof Error ? error.message : 'Unknown error'}`,\n\t\t);\n\t}\n\n\treturn {\n\t\toutputPath: mjsOutput,\n\t\tmasterKey,\n\t};\n}\n"],"mappings":";;;;;;;;;;;AAYA,MAAM,wBACL;;;;;;;;;;;;;AAwCD,SAAS,gBAAwB;CAChC,MAAMA,aAAAA,GAAUC,YAAAA,cAAAA,CAAAA,QAAAA,KAAAA,CAAAA,CAAAA,cAAAA,UAAAA,CAAAA,CAAAA,IAA6B;CAE7C,IAAI;EAGH,MAAM,MAAMD,UAAQ,QAAQ,sBAAsB;EAClD,QAAA,GAAOE,UAAAA,KAAAA,EAAAA,GAAKC,UAAAA,QAAAA,CAAQ,GAAG,GAAG,OAAO,SAAS;CAC3C,QAAQ;EAGP,OAAO;CACR;AACD;;;;;;;;;;;;;;;;;;;;AAqBA,eAAe,uBACd,YACoB;CAIpB,MAAM,2BAAW,IAAI,IAAY;CAEjC,KAAK,MAAM,aAAa,YACvB,KAAK,MAAM,QAAQ,MAAM,UAAU,eAAe,EAAE,cAAc,KAAK,CAAC,GACvE,IAAI,CAAC,KAAK,SAAS,GAAG,GAAG,SAAS,IAAI,IAAI;CAI5C,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,KAAK;AAClC;;AAGA,SAAS,UAAU,MAAc,MAAkC;CAClE,KAAK,IAAI,MAAM,OAAQ,OAAA,GAAMA,UAAAA,QAAAA,CAAQ,GAAG,GAAG;EAC1C,MAAM,aAAA,GAAYD,UAAAA,KAAAA,CAAK,KAAK,gBAAgB,MAAM,cAAc;EAChE,KAAA,GAAIE,QAAAA,WAAAA,CAAW,SAAS,GAAG,QAAA,GAAOC,QAAAA,aAAAA,EAAAA,GAAaF,UAAAA,QAAAA,CAAQ,SAAS,CAAC;EACjE,KAAA,GAAIA,UAAAA,QAAAA,CAAQ,GAAG,MAAM,KAAK,OAAO,KAAA;CAClC;AACD;;;;;;;;;;;AAYA,SAAgB,qBAAqB,MAAwB;CAC5D,MAAM,0BAAU,IAAI,IAAY;CAChC,MAAM,uBAAO,IAAI,IAAY;CAC7B,MAAM,SAAS,QAAgB;EAC9B,IAAI,KAAK,IAAI,GAAG,GAAG;EACnB,KAAK,IAAI,GAAG;EACZ,MAAM,MAAM,KAAK,OAAA,GAAMG,QAAAA,aAAAA,EAAAA,GAAaJ,UAAAA,KAAAA,CAAK,KAAK,cAAc,GAAG,OAAO,CAAC;EACvE,KAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAChC,IAAI,wBAAwB,CAAC,CAI/B,GACC,IAAI,MAAM,YAAY,CAAC,UAAU,MAAM,GAAG,GAAG,QAAQ,IAAI,IAAI;EAE9D,KAAK,MAAM,QAAQ,OAAO,KAAK;GAC9B,GAAG,IAAI;GACP,GAAG,IAAI;EACR,CAAC,GAAG;GACH,IAAI,CAAC,KAAK,WAAW,aAAa,GAAG;GACrC,MAAM,QAAQ,UAAU,MAAM,GAAG;GACjC,IAAI,OAAO,MAAM,KAAK;EACvB;CACD;CAGA,KAAK,IAAI,MAAM,OAAQ,OAAA,GAAMC,UAAAA,QAAAA,CAAQ,GAAG,GAAG;EAC1C,KAAA,GAAIC,QAAAA,WAAAA,EAAAA,GAAWF,UAAAA,KAAAA,CAAK,KAAK,cAAc,CAAC,GAAG;GAC1C,MAAM,MAAM,KAAK,OAAA,GAAMI,QAAAA,aAAAA,EAAAA,GAAaJ,UAAAA,KAAAA,CAAK,KAAK,cAAc,GAAG,OAAO,CAAC;GACvE,KAAK,MAAM,QAAQ,OAAO,KAAK;IAC9B,GAAG,IAAI;IACP,GAAG,IAAI;GACR,CAAC,GAAG;IACH,IAAI,CAAC,KAAK,WAAW,aAAa,GAAG;IACrC,MAAM,QAAQ,UAAU,MAAM,GAAG;IACjC,IAAI,OAAO,MAAM,KAAK;GACvB;GACA;EACD;EACA,KAAA,GAAIC,UAAAA,QAAAA,CAAQ,GAAG,MAAM,KAAK;CAC3B;CACA,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,KAAK;AAC1B;;;;;;;;AAUA,eAAsB,aACrB,SACwB;CACxB,MAAM,EACL,YACA,WACA,QACA,WACA,UACA,OACA,eACG;CAGJ,OAAA,GAAMI,iBAAAA,MAAAA,CAAM,WAAW,EAAE,WAAW,KAAK,CAAC;CAE1C,MAAM,aAAA,GAAYL,UAAAA,KAAAA,CAAK,WAAW,QAAQ,WAAW,YAAY;CAGjE,MAAM,OAAO;EACZ,cAAc;EACd;EACA;EACA;EACA;EACA;EACA,aAAa;EACb;EACA,eAAe;CAChB;CAEA,IAAI,QAGH,KAAK,KAAK,YAAY,cAAc;CAGrC,IAAI,WACH,KAAK,KAAK,aAAa;CAKxB,KAAK,MAAM,OAAO,CACjB,GAAG,UACH,GAAG,sBAAA,GAAqBC,UAAAA,QAAAA,CAAQ,UAAU,CAAC,CAC5C,GACC,KAAK,KAAK,cAAc,KAAK;CAI9B,IAAI;CAEJ,IAAI,OAAO;EACV,MAAM,EACL,qBACA,8BACA,qBACG,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,QAAM,sBAAA,CAAA,CAAA,CAAA,MAAA,MAAA,EAAA,eAAA;EACV,MAAM,EAAE,kBAAkB,oBAAoB,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,QAAM,sBAAA,CAAA,CAAA,CAAA,MAAA,MAAA,EAAA,aAAA;EAGpD,MAAM,EAAE,gBAAgB,0BAA0B,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,QAAM,cAAA,CAAA;EACxD,MAAM,EAAE,gBAAgB,0BAA0B,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,QAAM,wBAAA,CAAA,CAAA,CAAA,MAAA,MAAA,EAAA,kBAAA;EAOxD,MAAM,QAAQ,MAAM,sBAAsB,CAAC,CAAC,MAC1C,cAAc,gBAAgB,WAAW,KAAK,IAC9C,UAAU;GACV,IAAI,iBAAiB,gBACpB,OAAO,IAAI,iBAAiB,QAAQ,IAAI,CAAC;GAE1C,MAAM;EACP,CACD;EACA,IAAI,UAAU,MAAM,MAAM,KAAK,KAAK;EAEpC,IAAI,CAAC,SAAS;GAEb,QAAQ,IAAI,qCAAqC,MAAM,KAAK;GAC5D,UAAU,iBAAiB,KAAK;GAChC,MAAM,MAAM,MAAM,OAAO,OAAO;GAChC,QAAQ,IAAI,oBAAoB,MAAM,aAAa,MAAM,KAAK,EAAE;EACjE;EAGA,IAAI,cAAc,WAAW,SAAS,GAAG;GACxC,QAAQ,IAAI,kDAAkD;GAC9D,MAAM,eAAe,MAAM,uBAAuB,UAAU;GAE5D,IAAI,aAAa,SAAS,GAAG;IAC5B,MAAM,aAAa,6BAA6B,cAAc,OAAO;IAErE,IAAI,CAAC,WAAW,OAAO;KACtB,MAAM,eAAe;MACpB,4CAA4C,MAAM;MAClD;MACA,GAAG,WAAW,QAAQ,KAAK,MAAM,OAAO,GAAG;MAC3C;MACA;MACA,0CAA0C,MAAM;MAChD,8CAA8C;MAC9C;MACA;MACA,gDAAgD;MAChD;MACA;MACA,GAAG,WAAW,SAAS,KAAK,MAC3B,WAAW,QAAQ,SAAS,CAAC,IAAI,OAAO,MAAM,OAAO,GACtD;KACD,CAAC,CAAC,KAAK,IAAI;KAEX,MAAM,IAAI,MAAM,YAAY;IAC7B;IAEA,QAAQ,IACP,WAAW,aAAa,OAAO,sCAChC;GACD;EACD;EAIA,MAAM,YAAY,eADC,oBAAoB,OACG,CAAC;EAC3C,YAAY,UAAU;EAGtB,MAAM,UAAU,sBAAsB,SAAS;EAC/C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAGhD,KAAK,KAAK,YAAY,IAAI,GAAG,OAAO;EAGrC,QAAQ,IAAI,kCAAkC,MAAM,EAAE;CACvD,OAAO;EAIN,MAAM,UAAA,GAASD,UAAAA,KAAAA,CAAK,WAAW,MAAM,IAAI;EACzC,MAAM,iBAAA,GAAgBA,UAAAA,KAAAA,CAAK,QAAQ,iBAAiB;EACpD,MAAM,UAAA,GAASA,UAAAA,KAAAA,CAAK,QAAQ,gBAAgB;EAC5C,KAAA,GAAIE,QAAAA,WAAAA,CAAW,aAAa,MAAA,GAAKA,QAAAA,WAAAA,CAAW,MAAM,GAAG;GACpD,MAAM,EAAE,0BAA0B,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,QAAM,wBAAA,CAAA,CAAA,CAAA,MAAA,MAAA,EAAA,kBAAA;GACxC,MAAM,UAAU,sBAAsB;IACrC,YAAA,GAAWE,QAAAA,aAAAA,CAAa,eAAe,OAAO,CAAC,CAAC,KAAK;IACrD,KAAA,GAAIA,QAAAA,aAAAA,CAAa,QAAQ,OAAO,CAAC,CAAC,KAAK;IACvC,WAAW;GACZ,CAAC;GACD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAChD,KAAK,KAAK,YAAY,IAAI,GAAG,OAAO;GAErC,QAAQ,IAAI,0DAA0D;EACvE;CACD;CAEA,IAAI;EAEH,MAAM,CAAC,KAAK,GAAG,WAAW;EAC1B,MAAM,UAAA,GAASE,mBAAAA,UAAAA,CAAU,KAAK,SAAS;GACtC,KAAK,QAAQ,IAAI;GACjB,OAAO;GACP,OAAO,QAAQ,aAAa;EAC7B,CAAC;EAED,IAAI,OAAO,OACV,MAAM,OAAO;EAEd,IAAI,OAAO,WAAW,GACrB,MAAM,IAAI,MAAM,4BAA4B,OAAO,QAAQ;EAI5D,MAAM,EAAE,aAAa,MAAM,OAAO;EAClC,MAAM,UAAU,MAAM,SAAS,WAAW,OAAO;EACjD,IAAI,CAAC,QAAQ,WAAW,IAAI,GAC3B,OAAA,GAAMC,iBAAAA,UAAAA,CAAU,WAAW,wBAAwB,SAAS;CAE9D,SAAS,OAAO;EACf,MAAM,IAAI,MACT,4BAA4B,iBAAiB,QAAQ,MAAM,UAAU,iBACtE;CACD;CAEA,OAAO;EACN,YAAY;EACZ;CACD;AACD"}

package/dist/{bundler-B2ysiCTa.mjs → bundler-CgcwaVI0.mjs}

@@ -1,6 +1,6 @@
 import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { mkdir, writeFile } from "node:fs/promises";
 import { spawnSync } from "node:child_process";
 //#region src/build/bundler.ts
@@ -55,6 +55,58 @@ async function collectRequiredEnvVars(constructs) {
 	for (const construct of constructs) for (const name of await construct.getEnvironment({ markOptional: true })) if (!name.endsWith("?")) required.add(name);
 	return Array.from(required).sort();
 }
+/** `<dir>/node_modules/<name>`, from `from` up to the root; the first found. */
+function installed(name, from) {
+	for (let dir = from;; dir = dirname(dir)) {
+		const candidate = join(dir, "node_modules", name, "package.json");
+		if (existsSync(candidate)) return realpathSync(dirname(candidate));
+		if (dirname(dir) === dir) return void 0;
+	}
+}
+/**
+* The optional peers of the @geekmidas packages an app reaches that are not
+* installed where those packages would resolve them.
+*
+* Each is imported only on the path that needs it — `@aws-sdk/client-kms`
+* for a `kms:` key, say — so an app that never takes that path never
+* installs it. esbuild resolves a dynamic import all the same, and fails
+* the bundle on one it cannot find; left external instead, it is only
+* looked for if that path runs, where its absence says what to install.
+*/
+function missingOptionalPeers(from) {
+	const missing = /* @__PURE__ */ new Set();
+	const seen = /* @__PURE__ */ new Set();
+	const visit = (dir) => {
+		if (seen.has(dir)) return;
+		seen.add(dir);
+		const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf-8"));
+		for (const [peer, meta] of Object.entries(pkg.peerDependenciesMeta ?? {})) if (meta?.optional && !installed(peer, dir)) missing.add(peer);
+		for (const name of Object.keys({
+			...pkg.dependencies,
+			...pkg.peerDependencies
+		})) {
+			if (!name.startsWith("@geekmidas/")) continue;
+			const found = installed(name, dir);
+			if (found) visit(found);
+		}
+	};
+	for (let dir = from;; dir = dirname(dir)) {
+		if (existsSync(join(dir, "package.json"))) {
+			const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf-8"));
+			for (const name of Object.keys({
+				...pkg.dependencies,
+				...pkg.devDependencies
+			})) {
+				if (!name.startsWith("@geekmidas/")) continue;
+				const found = installed(name, dir);
+				if (found) visit(found);
+			}
+			break;
+		}
+		if (dirname(dir) === dir) break;
+	}
+	return [...missing].sort();
+}
 /**
 * Bundle the server application using esbuild.
 * Creates a fully standalone bundle with all dependencies included.
@@ -79,7 +131,7 @@ async function bundleServer(options) {
 	];
 	if (minify) args.push("--minify", "--keep-names");
 	if (sourcemap) args.push("--sourcemap");
-	for (const ext of external) args.push(`--external:${ext}`);
+	for (const ext of [...external, ...missingOptionalPeers(dirname(entryPoint))]) args.push(`--external:${ext}`);
 	let masterKey;
 	if (stage) {
 		const { toEmbeddableSecrets, validateEnvironmentVariables, initStageSecrets } = await import("./seeds-CRkKeyW0.mjs").then((n) => n.Vt);
@@ -166,4 +218,4 @@ async function bundleServer(options) {
 //#endregion
 export { bundleServer };
 
-//# sourceMappingURL=bundler-B2ysiCTa.mjs.map
+//# sourceMappingURL=bundler-CgcwaVI0.mjs.map

package/dist/bundler-CgcwaVI0.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundler-CgcwaVI0.mjs","names":[],"sources":["../src/build/bundler.ts"],"sourcesContent":["import { spawnSync } from 'node:child_process';\nimport { existsSync, readFileSync, realpathSync } from 'node:fs';\nimport { mkdir, writeFile } from 'node:fs/promises';\nimport { createRequire } from 'node:module';\nimport { dirname, join } from 'node:path';\nimport type { Construct } from '@geekmidas/constructs';\n\n/**\n * Banner to inject into ESM bundle for CJS compatibility.\n * Creates a `require` function using Node's createRequire for packages\n * that internally use CommonJS require() for Node builtins.\n */\nconst ESM_CJS_COMPAT_BANNER =\n\t'import { createRequire } from \"module\"; const require = createRequire(import.meta.url);';\n\nexport interface BundleOptions {\n\t/** Entry point file (e.g., .gkm/server/server.ts) */\n\tentryPoint: string;\n\t/** Output directory for bundled files */\n\toutputDir: string;\n\t/** The bundle's file name in `outputDir`. Defaults to `server.mjs`. */\n\toutfile?: string;\n\t/** Minify the output (default: true) */\n\tminify: boolean;\n\t/** Generate sourcemaps (default: false) */\n\tsourcemap: boolean;\n\t/** Packages to exclude from bundling */\n\texternal: string[];\n\t/** Stage for secrets injection (optional) */\n\tstage?: string;\n\t/** Constructs to validate environment variables for */\n\tconstructs?: Construct[];\n}\n\nexport interface BundleResult {\n\t/** Path to the bundled output */\n\toutputPath: string;\n\t/** Ephemeral master key for deployment (only if stage was provided) */\n\tmasterKey?: string;\n}\n\n/**\n * The esbuild binary, resolved from this package rather than from PATH.\n *\n * It used to be `npx esbuild`, which is two assumptions: that esbuild is\n * installed somewhere npx can find, and that the *app's* directory is where to\n * look. Neither holds — the CLI did not depend on esbuild at all, so a deploy\n * run from an app that had not installed it failed at the bundle step with\n * `sh: esbuild: command not found`, after provisioning had already happened.\n *\n * The same fix `bin/gkm.mjs` makes for tsx: resolve from this package's own\n * `node_modules`, so the tool the CLI shells out to is the one it depends on.\n */\nfunction esbuildBinary(): string {\n\tconst require = createRequire(import.meta.url);\n\n\ttry {\n\t\t// The package root, then its bin — `require.resolve('esbuild')` gives the\n\t\t// JS entry point, which is a library rather than the CLI.\n\t\tconst pkg = require.resolve('esbuild/package.json');\n\t\treturn join(dirname(pkg), 'bin', 'esbuild');\n\t} catch {\n\t\t// Better a PATH lookup than a hard failure: a project that installed\n\t\t// esbuild itself still works.\n\t\treturn 'esbuild';\n\t}\n}\n\n/**\n * Collect the environment variables a build cannot proceed without.\n *\n * Uses the SnifferEnvironmentParser to detect which env vars each service\n * reads, and keeps only the ones it cannot do without. `markOptional` is what\n * separates them: the sniffer already knows which reads went through\n * `.optional()` or `.default()`, and asking for that distinction is the\n * difference between a build that stops and one that proceeds correctly.\n *\n * Without it, a key that is *absent by design* failed the build. A surface\n * publishes `AUTH_COOKIE_DOMAIN` only when there is a domain to widen a cookie\n * to — one host has nothing to share it with, so the derivation correctly\n * yields nothing, and Better Auth reads it as optional for exactly that\n * reason. Treating every sniffed read as required made the honest answer\n * indistinguishable from a missing secret.\n *\n * @param constructs - Array of constructs to analyze\n * @returns Deduplicated, sorted names of the required variables\n */\nasync function collectRequiredEnvVars(\n\tconstructs: Construct[],\n): Promise<string[]> {\n\t// A key read optionally by one construct and required by another stays\n\t// required: the strictest read is the one that fails at runtime, and taking\n\t// the union of the required reads is what says so.\n\tconst required = new Set<string>();\n\n\tfor (const construct of constructs) {\n\t\tfor (const name of await construct.getEnvironment({ markOptional: true })) {\n\t\t\tif (!name.endsWith('?')) required.add(name);\n\t\t}\n\t}\n\n\treturn Array.from(required).sort();\n}\n\n/** `<dir>/node_modules/<name>`, from `from` up to the root; the first found. */\nfunction installed(name: string, from: string): string | undefined {\n\tfor (let dir = from; ; dir = dirname(dir)) {\n\t\tconst candidate = join(dir, 'node_modules', name, 'package.json');\n\t\tif (existsSync(candidate)) return realpathSync(dirname(candidate));\n\t\tif (dirname(dir) === dir) return undefined;\n\t}\n}\n\n/**\n * The optional peers of the @geekmidas packages an app reaches that are not\n * installed where those packages would resolve them.\n *\n * Each is imported only on the path that needs it — `@aws-sdk/client-kms`\n * for a `kms:` key, say — so an app that never takes that path never\n * installs it. esbuild resolves a dynamic import all the same, and fails\n * the bundle on one it cannot find; left external instead, it is only\n * looked for if that path runs, where its absence says what to install.\n */\nexport function missingOptionalPeers(from: string): string[] {\n\tconst missing = new Set<string>();\n\tconst seen = new Set<string>();\n\tconst visit = (dir: string) => {\n\t\tif (seen.has(dir)) return;\n\t\tseen.add(dir);\n\t\tconst pkg = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf-8'));\n\t\tfor (const [peer, meta] of Object.entries(\n\t\t\t(pkg.peerDependenciesMeta ?? {}) as Record<\n\t\t\t\tstring,\n\t\t\t\t{ optional?: boolean }\n\t\t\t>,\n\t\t)) {\n\t\t\tif (meta?.optional && !installed(peer, dir)) missing.add(peer);\n\t\t}\n\t\tfor (const name of Object.keys({\n\t\t\t...pkg.dependencies,\n\t\t\t...pkg.peerDependencies,\n\t\t})) {\n\t\t\tif (!name.startsWith('@geekmidas/')) continue;\n\t\t\tconst found = installed(name, dir);\n\t\t\tif (found) visit(found);\n\t\t}\n\t};\n\n\t// The app's own package.json: the nearest above the entry.\n\tfor (let dir = from; ; dir = dirname(dir)) {\n\t\tif (existsSync(join(dir, 'package.json'))) {\n\t\t\tconst pkg = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf-8'));\n\t\t\tfor (const name of Object.keys({\n\t\t\t\t...pkg.dependencies,\n\t\t\t\t...pkg.devDependencies,\n\t\t\t})) {\n\t\t\t\tif (!name.startsWith('@geekmidas/')) continue;\n\t\t\t\tconst found = installed(name, dir);\n\t\t\t\tif (found) visit(found);\n\t\t\t}\n\t\t\tbreak;\n\t\t}\n\t\tif (dirname(dir) === dir) break;\n\t}\n\treturn [...missing].sort();\n}\n\n/**\n * Bundle the server application using esbuild.\n * Creates a fully standalone bundle with all dependencies included.\n *\n * @param options - Bundle configuration options\n * @returns Bundle result with output path and optional master key\n */\n\nexport async function bundleServer(\n\toptions: BundleOptions,\n): Promise<BundleResult> {\n\tconst {\n\t\tentryPoint,\n\t\toutputDir,\n\t\tminify,\n\t\tsourcemap,\n\t\texternal,\n\t\tstage,\n\t\tconstructs,\n\t} = options;\n\n\t// Ensure output directory exists\n\tawait mkdir(outputDir, { recursive: true });\n\n\tconst mjsOutput = join(outputDir, options.outfile ?? 'server.mjs');\n\n\t// Build command-line arguments for esbuild\n\tconst args = [\n\t\tesbuildBinary(),\n\t\tentryPoint,\n\t\t'--bundle',\n\t\t'--platform=node',\n\t\t'--target=node22',\n\t\t'--format=esm',\n\t\t`--outfile=${mjsOutput}`,\n\t\t'--packages=bundle', // Bundle all dependencies for standalone output\n\t\t`--banner:js=${ESM_CJS_COMPAT_BANNER}`, // CJS compatibility for packages like pino\n\t];\n\n\tif (minify) {\n\t\t// Names kept: an error's class name is what a log line's `err.type` and\n\t\t// a response's `name` say, and minified they read `_6`.\n\t\targs.push('--minify', '--keep-names');\n\t}\n\n\tif (sourcemap) {\n\t\targs.push('--sourcemap');\n\t}\n\n\t// Add external packages (user-specified), and the optional peers a\n\t// @geekmidas package only loads on a path this app may never take\n\tfor (const ext of [\n\t\t...external,\n\t\t...missingOptionalPeers(dirname(entryPoint)),\n\t]) {\n\t\targs.push(`--external:${ext}`);\n\t}\n\n\t// Handle secrets injection if stage is provided\n\tlet masterKey: string | undefined;\n\n\tif (stage) {\n\t\tconst {\n\t\t\ttoEmbeddableSecrets,\n\t\t\tvalidateEnvironmentVariables,\n\t\t\tinitStageSecrets,\n\t\t} = await import('../secrets/storage');\n\t\tconst { FileSecretsStore, secretsStoreFor } = await import(\n\t\t\t'../secrets/store'\n\t\t);\n\t\tconst { ConfigNotFound, loadWorkspaceSettings } = await import('../config');\n\t\tconst { encryptSecrets, generateDefineOptions } = await import(\n\t\t\t'../secrets/encryption'\n\t\t);\n\n\t\t// The stage's own store — SSM or Secrets Manager for a deployed stage\n\t\t// kept there. Outside\n\t\t// any workspace nothing names one, so it is the file.\n\t\tconst store = await loadWorkspaceSettings().then(\n\t\t\t(workspace) => secretsStoreFor(workspace, stage),\n\t\t\t(error) => {\n\t\t\t\tif (error instanceof ConfigNotFound) {\n\t\t\t\t\treturn new FileSecretsStore(process.cwd());\n\t\t\t\t}\n\t\t\t\tthrow error;\n\t\t\t},\n\t\t);\n\t\tlet secrets = await store.read(stage);\n\n\t\tif (!secrets) {\n\t\t\t// Auto-initialize secrets for the stage\n\t\t\tconsole.log(`  Initializing secrets for stage \"${stage}\"...`);\n\t\t\tsecrets = initStageSecrets(stage);\n\t\t\tawait store.write(stage, secrets);\n\t\t\tconsole.log(`  ✓ Created the \"${stage}\" secrets (${store.name})`);\n\t\t}\n\n\t\t// Validate environment variables if constructs are provided\n\t\tif (constructs && constructs.length > 0) {\n\t\t\tconsole.log('  Analyzing environment variable requirements...');\n\t\t\tconst requiredVars = await collectRequiredEnvVars(constructs);\n\n\t\t\tif (requiredVars.length > 0) {\n\t\t\t\tconst validation = validateEnvironmentVariables(requiredVars, secrets);\n\n\t\t\t\tif (!validation.valid) {\n\t\t\t\t\tconst errorMessage = [\n\t\t\t\t\t\t`Missing environment variables for stage \"${stage}\":`,\n\t\t\t\t\t\t'',\n\t\t\t\t\t\t...validation.missing.map((v) => `  ❌ ${v}`),\n\t\t\t\t\t\t'',\n\t\t\t\t\t\t'To fix this, either:',\n\t\t\t\t\t\t`  1. Add the missing variables to the \"${stage}\" secrets using:`,\n\t\t\t\t\t\t`     gkm secrets:set <KEY> <VALUE> --stage ${stage}`,\n\t\t\t\t\t\t'',\n\t\t\t\t\t\t`  2. Or import from a JSON file:`,\n\t\t\t\t\t\t`     gkm secrets:import secrets.json --stage ${stage}`,\n\t\t\t\t\t\t'',\n\t\t\t\t\t\t'Required variables:',\n\t\t\t\t\t\t...validation.required.map((v) =>\n\t\t\t\t\t\t\tvalidation.missing.includes(v) ? `  ❌ ${v}` : `  ✓ ${v}`,\n\t\t\t\t\t\t),\n\t\t\t\t\t].join('\\n');\n\n\t\t\t\t\tthrow new Error(errorMessage);\n\t\t\t\t}\n\n\t\t\t\tconsole.log(\n\t\t\t\t\t`  ✓ All ${requiredVars.length} required environment variables found`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\t// Convert to embeddable format and encrypt\n\t\tconst embeddable = toEmbeddableSecrets(secrets);\n\t\tconst encrypted = encryptSecrets(embeddable);\n\t\tmasterKey = encrypted.masterKey;\n\n\t\t// Add define options for build-time injection using esbuild's --define:KEY=VALUE format\n\t\tconst defines = generateDefineOptions(encrypted);\n\t\tfor (const [key, value] of Object.entries(defines)) {\n\t\t\t// `value` is already a JS string literal; quoting it again would\n\t\t\t// embed the quotes, and the IV would not parse as hex.\n\t\t\targs.push(`--define:${key}=${value}`);\n\t\t}\n\n\t\tconsole.log(`  Secrets encrypted for stage \"${stage}\"`);\n\t} else {\n\t\t// Credentials encrypted elsewhere — an image build hands them in as a\n\t\t// BuildKit secret and writes them beside the app's `.gkm/server` — are\n\t\t// embedded as they are; whoever encrypted them holds the key.\n\t\tconst gkmDir = join(outputDir, '..', '..');\n\t\tconst encryptedPath = join(gkmDir, 'credentials.enc');\n\t\tconst ivPath = join(gkmDir, 'credentials.iv');\n\t\tif (existsSync(encryptedPath) && existsSync(ivPath)) {\n\t\t\tconst { generateDefineOptions } = await import('../secrets/encryption');\n\t\t\tconst defines = generateDefineOptions({\n\t\t\t\tencrypted: readFileSync(encryptedPath, 'utf-8').trim(),\n\t\t\t\tiv: readFileSync(ivPath, 'utf-8').trim(),\n\t\t\t\tmasterKey: '',\n\t\t\t});\n\t\t\tfor (const [key, value] of Object.entries(defines)) {\n\t\t\t\targs.push(`--define:${key}=${value}`);\n\t\t\t}\n\t\t\tconsole.log('  Embedded the encrypted credentials the build was given');\n\t\t}\n\t}\n\n\ttry {\n\t\t// Run esbuild with command-line arguments\n\t\tconst [cmd, ...cmdArgs] = args as [string, ...string[]];\n\t\tconst result = spawnSync(cmd, cmdArgs, {\n\t\t\tcwd: process.cwd(),\n\t\t\tstdio: 'inherit',\n\t\t\tshell: process.platform === 'win32', // Only use shell on Windows for npx resolution\n\t\t});\n\n\t\tif (result.error) {\n\t\t\tthrow result.error;\n\t\t}\n\t\tif (result.status !== 0) {\n\t\t\tthrow new Error(`esbuild exited with code ${result.status}`);\n\t\t}\n\n\t\t// Add shebang to the bundled file\n\t\tconst { readFile } = await import('node:fs/promises');\n\t\tconst content = await readFile(mjsOutput, 'utf-8');\n\t\tif (!content.startsWith('#!')) {\n\t\t\tawait writeFile(mjsOutput, `#!/usr/bin/env node\\n${content}`);\n\t\t}\n\t} catch (error) {\n\t\tthrow new Error(\n\t\t\t`Failed to bundle server: ${error instanceof Error ? error.message : 'Unknown error'}`,\n\t\t);\n\t}\n\n\treturn {\n\t\toutputPath: mjsOutput,\n\t\tmasterKey,\n\t};\n}\n"],"mappings":";;;;;;;;;;;AAYA,MAAM,wBACL;;;;;;;;;;;;;AAwCD,SAAS,gBAAwB;CAChC,MAAM,UAAU,cAAc,YAAY,GAAG;CAE7C,IAAI;EAGH,MAAM,MAAM,QAAQ,QAAQ,sBAAsB;EAClD,OAAO,KAAK,QAAQ,GAAG,GAAG,OAAO,SAAS;CAC3C,QAAQ;EAGP,OAAO;CACR;AACD;;;;;;;;;;;;;;;;;;;;AAqBA,eAAe,uBACd,YACoB;CAIpB,MAAM,2BAAW,IAAI,IAAY;CAEjC,KAAK,MAAM,aAAa,YACvB,KAAK,MAAM,QAAQ,MAAM,UAAU,eAAe,EAAE,cAAc,KAAK,CAAC,GACvE,IAAI,CAAC,KAAK,SAAS,GAAG,GAAG,SAAS,IAAI,IAAI;CAI5C,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,KAAK;AAClC;;AAGA,SAAS,UAAU,MAAc,MAAkC;CAClE,KAAK,IAAI,MAAM,OAAQ,MAAM,QAAQ,GAAG,GAAG;EAC1C,MAAM,YAAY,KAAK,KAAK,gBAAgB,MAAM,cAAc;EAChE,IAAI,WAAW,SAAS,GAAG,OAAO,aAAa,QAAQ,SAAS,CAAC;EACjE,IAAI,QAAQ,GAAG,MAAM,KAAK,OAAO,KAAA;CAClC;AACD;;;;;;;;;;;AAYA,SAAgB,qBAAqB,MAAwB;CAC5D,MAAM,0BAAU,IAAI,IAAY;CAChC,MAAM,uBAAO,IAAI,IAAY;CAC7B,MAAM,SAAS,QAAgB;EAC9B,IAAI,KAAK,IAAI,GAAG,GAAG;EACnB,KAAK,IAAI,GAAG;EACZ,MAAM,MAAM,KAAK,MAAM,aAAa,KAAK,KAAK,cAAc,GAAG,OAAO,CAAC;EACvE,KAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAChC,IAAI,wBAAwB,CAAC,CAI/B,GACC,IAAI,MAAM,YAAY,CAAC,UAAU,MAAM,GAAG,GAAG,QAAQ,IAAI,IAAI;EAE9D,KAAK,MAAM,QAAQ,OAAO,KAAK;GAC9B,GAAG,IAAI;GACP,GAAG,IAAI;EACR,CAAC,GAAG;GACH,IAAI,CAAC,KAAK,WAAW,aAAa,GAAG;GACrC,MAAM,QAAQ,UAAU,MAAM,GAAG;GACjC,IAAI,OAAO,MAAM,KAAK;EACvB;CACD;CAGA,KAAK,IAAI,MAAM,OAAQ,MAAM,QAAQ,GAAG,GAAG;EAC1C,IAAI,WAAW,KAAK,KAAK,cAAc,CAAC,GAAG;GAC1C,MAAM,MAAM,KAAK,MAAM,aAAa,KAAK,KAAK,cAAc,GAAG,OAAO,CAAC;GACvE,KAAK,MAAM,QAAQ,OAAO,KAAK;IAC9B,GAAG,IAAI;IACP,GAAG,IAAI;GACR,CAAC,GAAG;IACH,IAAI,CAAC,KAAK,WAAW,aAAa,GAAG;IACrC,MAAM,QAAQ,UAAU,MAAM,GAAG;IACjC,IAAI,OAAO,MAAM,KAAK;GACvB;GACA;EACD;EACA,IAAI,QAAQ,GAAG,MAAM,KAAK;CAC3B;CACA,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,KAAK;AAC1B;;;;;;;;AAUA,eAAsB,aACrB,SACwB;CACxB,MAAM,EACL,YACA,WACA,QACA,WACA,UACA,OACA,eACG;CAGJ,MAAM,MAAM,WAAW,EAAE,WAAW,KAAK,CAAC;CAE1C,MAAM,YAAY,KAAK,WAAW,QAAQ,WAAW,YAAY;CAGjE,MAAM,OAAO;EACZ,cAAc;EACd;EACA;EACA;EACA;EACA;EACA,aAAa;EACb;EACA,eAAe;CAChB;CAEA,IAAI,QAGH,KAAK,KAAK,YAAY,cAAc;CAGrC,IAAI,WACH,KAAK,KAAK,aAAa;CAKxB,KAAK,MAAM,OAAO,CACjB,GAAG,UACH,GAAG,qBAAqB,QAAQ,UAAU,CAAC,CAC5C,GACC,KAAK,KAAK,cAAc,KAAK;CAI9B,IAAI;CAEJ,IAAI,OAAO;EACV,MAAM,EACL,qBACA,8BACA,qBACG,MAAM,OAAO,uBAAqB,CAAA,MAAA,MAAA,EAAA,EAAA;EACtC,MAAM,EAAE,kBAAkB,oBAAoB,MAAM,OACnD,uBACA,CAAA,MAAA,MAAA,EAAA,EAAA;EACD,MAAM,EAAE,gBAAgB,0BAA0B,MAAM,OAAO;EAC/D,MAAM,EAAE,gBAAgB,0BAA0B,MAAM,OACvD,yBACA,CAAA,MAAA,MAAA,EAAA,CAAA;EAKD,MAAM,QAAQ,MAAM,sBAAsB,CAAC,CAAC,MAC1C,cAAc,gBAAgB,WAAW,KAAK,IAC9C,UAAU;GACV,IAAI,iBAAiB,gBACpB,OAAO,IAAI,iBAAiB,QAAQ,IAAI,CAAC;GAE1C,MAAM;EACP,CACD;EACA,IAAI,UAAU,MAAM,MAAM,KAAK,KAAK;EAEpC,IAAI,CAAC,SAAS;GAEb,QAAQ,IAAI,qCAAqC,MAAM,KAAK;GAC5D,UAAU,iBAAiB,KAAK;GAChC,MAAM,MAAM,MAAM,OAAO,OAAO;GAChC,QAAQ,IAAI,oBAAoB,MAAM,aAAa,MAAM,KAAK,EAAE;EACjE;EAGA,IAAI,cAAc,WAAW,SAAS,GAAG;GACxC,QAAQ,IAAI,kDAAkD;GAC9D,MAAM,eAAe,MAAM,uBAAuB,UAAU;GAE5D,IAAI,aAAa,SAAS,GAAG;IAC5B,MAAM,aAAa,6BAA6B,cAAc,OAAO;IAErE,IAAI,CAAC,WAAW,OAAO;KACtB,MAAM,eAAe;MACpB,4CAA4C,MAAM;MAClD;MACA,GAAG,WAAW,QAAQ,KAAK,MAAM,OAAO,GAAG;MAC3C;MACA;MACA,0CAA0C,MAAM;MAChD,8CAA8C;MAC9C;MACA;MACA,gDAAgD;MAChD;MACA;MACA,GAAG,WAAW,SAAS,KAAK,MAC3B,WAAW,QAAQ,SAAS,CAAC,IAAI,OAAO,MAAM,OAAO,GACtD;KACD,CAAC,CAAC,KAAK,IAAI;KAEX,MAAM,IAAI,MAAM,YAAY;IAC7B;IAEA,QAAQ,IACP,WAAW,aAAa,OAAO,sCAChC;GACD;EACD;EAIA,MAAM,YAAY,eADC,oBAAoB,OACG,CAAC;EAC3C,YAAY,UAAU;EAGtB,MAAM,UAAU,sBAAsB,SAAS;EAC/C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAGhD,KAAK,KAAK,YAAY,IAAI,GAAG,OAAO;EAGrC,QAAQ,IAAI,kCAAkC,MAAM,EAAE;CACvD,OAAO;EAIN,MAAM,SAAS,KAAK,WAAW,MAAM,IAAI;EACzC,MAAM,gBAAgB,KAAK,QAAQ,iBAAiB;EACpD,MAAM,SAAS,KAAK,QAAQ,gBAAgB;EAC5C,IAAI,WAAW,aAAa,KAAK,WAAW,MAAM,GAAG;GACpD,MAAM,EAAE,0BAA0B,MAAM,OAAO,yBAAwB,CAAA,MAAA,MAAA,EAAA,CAAA;GACvE,MAAM,UAAU,sBAAsB;IACrC,WAAW,aAAa,eAAe,OAAO,CAAC,CAAC,KAAK;IACrD,IAAI,aAAa,QAAQ,OAAO,CAAC,CAAC,KAAK;IACvC,WAAW;GACZ,CAAC;GACD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAChD,KAAK,KAAK,YAAY,IAAI,GAAG,OAAO;GAErC,QAAQ,IAAI,0DAA0D;EACvE;CACD;CAEA,IAAI;EAEH,MAAM,CAAC,KAAK,GAAG,WAAW;EAC1B,MAAM,SAAS,UAAU,KAAK,SAAS;GACtC,KAAK,QAAQ,IAAI;GACjB,OAAO;GACP,OAAO,QAAQ,aAAa;EAC7B,CAAC;EAED,IAAI,OAAO,OACV,MAAM,OAAO;EAEd,IAAI,OAAO,WAAW,GACrB,MAAM,IAAI,MAAM,4BAA4B,OAAO,QAAQ;EAI5D,MAAM,EAAE,aAAa,MAAM,OAAO;EAClC,MAAM,UAAU,MAAM,SAAS,WAAW,OAAO;EACjD,IAAI,CAAC,QAAQ,WAAW,IAAI,GAC3B,MAAM,UAAU,WAAW,wBAAwB,SAAS;CAE9D,SAAS,OAAO;EACf,MAAM,IAAI,MACT,4BAA4B,iBAAiB,QAAQ,MAAM,UAAU,iBACtE;CACD;CAEA,OAAO;EACN,YAAY;EACZ;CACD;AACD"}

package/dist/index.cjs

@@ -57,7 +57,7 @@ crypto = require_rolldown_runtime.__toESM(crypto, 1);
 let _geekmidas_constructs_functions = require("@geekmidas/constructs/functions");
 let _geekmidas_constructs_topic = require("@geekmidas/constructs/topic");
 //#region package.json
-var version = "10.0.0-alpha.115";
+var version = "10.0.0-alpha.116";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -3831,7 +3831,7 @@ async function buildApp(input) {
 				...production,
 				...telemetry ? { telemetry } : {}
 			});
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-hvCgi0EG.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-B2_2-Dum.cjs"));
 			await bundleServer({
 				entryPoint,
 				outputDir: (0, node_path.join)(outputDir, "dist"),
@@ -4030,7 +4030,7 @@ async function buildWorkers(input) {
 		});
 		logger$4.log(`Generated worker ${worker.id}: ${crons.length} crons, ${queues.length} queues, ${subscribers.length} subscribers`);
 		if (!input.bundle) continue;
-		const { bundleServer } = await Promise.resolve().then(() => require("./bundler-hvCgi0EG.cjs"));
+		const { bundleServer } = await Promise.resolve().then(() => require("./bundler-B2_2-Dum.cjs"));
 		const outfile = require_seeds.workerBundleName(worker.id);
 		await bundleServer({
 			entryPoint,
@@ -4116,7 +4116,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$4.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-hvCgi0EG.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-B2_2-Dum.cjs"));
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -5950,25 +5950,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.115",
-	"@geekmidas/auth": "~10.0.0-alpha.115",
-	"@geekmidas/cache": "~10.0.0-alpha.115",
-	"@geekmidas/client": "~10.0.0-alpha.115",
-	"@geekmidas/cloud": "~10.0.0-alpha.115",
-	"@geekmidas/constructs": "~10.0.0-alpha.115",
-	"@geekmidas/db": "~10.0.0-alpha.115",
-	"@geekmidas/emailkit": "~10.0.0-alpha.115",
-	"@geekmidas/envkit": "~10.0.0-alpha.115",
-	"@geekmidas/errors": "~10.0.0-alpha.115",
-	"@geekmidas/events": "~10.0.0-alpha.115",
-	"@geekmidas/logger": "~10.0.0-alpha.115",
-	"@geekmidas/manifest": "~10.0.0-alpha.115",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.115",
-	"@geekmidas/schema": "~10.0.0-alpha.115",
-	"@geekmidas/services": "~10.0.0-alpha.115",
-	"@geekmidas/storage": "~10.0.0-alpha.115",
-	"@geekmidas/telescope": "~10.0.0-alpha.115",
-	"@geekmidas/testkit": "~10.0.0-alpha.115",
+	"@geekmidas/audit": "~10.0.0-alpha.116",
+	"@geekmidas/auth": "~10.0.0-alpha.116",
+	"@geekmidas/cache": "~10.0.0-alpha.116",
+	"@geekmidas/client": "~10.0.0-alpha.116",
+	"@geekmidas/cloud": "~10.0.0-alpha.116",
+	"@geekmidas/constructs": "~10.0.0-alpha.116",
+	"@geekmidas/db": "~10.0.0-alpha.116",
+	"@geekmidas/emailkit": "~10.0.0-alpha.116",
+	"@geekmidas/envkit": "~10.0.0-alpha.116",
+	"@geekmidas/errors": "~10.0.0-alpha.116",
+	"@geekmidas/events": "~10.0.0-alpha.116",
+	"@geekmidas/logger": "~10.0.0-alpha.116",
+	"@geekmidas/manifest": "~10.0.0-alpha.116",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.116",
+	"@geekmidas/schema": "~10.0.0-alpha.116",
+	"@geekmidas/services": "~10.0.0-alpha.116",
+	"@geekmidas/storage": "~10.0.0-alpha.116",
+	"@geekmidas/telescope": "~10.0.0-alpha.116",
+	"@geekmidas/testkit": "~10.0.0-alpha.116",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -7161,7 +7161,7 @@ const COMMIT = /^[0-9a-f]{40}$/;
 * The `uses:` value for the stages action, with a comment saying which CLI
 * release the pinned commit is.
 */
-function stagesActionUses(commit = "f1cb336edfa0ad66598783740950d96f53f1108c", version = cliVersion()) {
+function stagesActionUses(commit = "8441f7be92366877d6802babf8ee655bcdde2489", version = cliVersion()) {
 	return commit && COMMIT.test(commit) ? `${STAGES_ACTION}@${commit} # @geekmidas/cli ${version}` : `${STAGES_ACTION}@main # pin to a commit SHA: see the action's README`;
 }
 //#endregion