@geekmidas/cli 10.0.0-alpha.62 → 10.0.0-alpha.64

package/dist/{sniffer-DHE2Nafd.mjs → sniffer-49KPbDgq.mjs}

@@ -1,26 +1,27 @@
 import { n as __require, t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
-import { n as gkmHome } from "./home-GI7pJl1M.mjs";
-import { a as output, t as discover } from "./discover-FrYvzkeC.mjs";
-import { c as loadWorkspaceAppInfo, f as appKey, l as loadWorkspaceConfig, r as NotInAnApp, s as loadConfig, t as ConfigNotFound } from "./config-Bf4-bROQ.mjs";
-import { E as TEST_STAGE, p as getPublicEnvPrefix, t as allConstructGlobs } from "./workspace-BFe57es7.mjs";
+import { _ as storeHostingerToken, g as storeDokployCredentials, h as removeDokployCredentials, l as getCredentialsPath, s as run$1, t as LocalSandbox, u as getDokployCredentials } from "./local-Cd8ZYQG3.mjs";
+import { d as output, r as discover, s as nodeWithTsx } from "./discover-LMrqsWSU.mjs";
+import { i as activeSandbox } from "./sandbox-Dm247NGx.mjs";
+import { t as appKey } from "./derive-B4vDpzgP.mjs";
+import { E as TEST_STAGE, p as getPublicEnvPrefix, t as allConstructGlobs } from "./workspace-Bwit4q9O.mjs";
+import { ConfigNotFound, NotInAnApp, loadConfig, loadWorkspaceAppInfo, loadWorkspaceConfig } from "./config.mjs";
 import { i as toEmbeddableSecrets } from "./storage-BzaUxmqe.mjs";
-import { i as FileSecretsStore, n as secretsStoreFor } from "./store-BS8A7NcA.mjs";
-import { r as runtimeOf } from "./runtime-DbakJS8u.mjs";
+import { i as FileSecretsStore, n as secretsStoreFor } from "./store-BaaonhkJ.mjs";
+import { r as runtimeOf } from "./runtime-Cmn-FeYO.mjs";
 import { i as DEFAULT_STORAGE, n as DEFAULT_CACHE, r as DEFAULT_EVENTS$1, t as readFakes } from "./fakes-C9RiT6XG.mjs";
-import { createRequire } from "node:module";
 import { basename, dirname, join, parse, resolve } from "node:path";
 import { stdin, stdout } from "node:process";
 import * as readline from "node:readline/promises";
-import { copyFileSync, existsSync, mkdirSync, readFileSync, unlinkSync } from "node:fs";
+import { copyFileSync, existsSync, readFileSync, unlinkSync } from "node:fs";
 import { mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
 import { hostname, networkInterfaces, userInfo } from "node:os";
 import { promisify } from "node:util";
 import { DEFAULT_POSTGRES_VERSION, cacheTable, cookieDomain, dependenciesOf, dependentsOf, externalApiUrl, kebabCase, mobileOrigins, provideKey, providedKeyFor, provisionOrder, publicEnvFor, schemeBase } from "@geekmidas/manifest";
+import { fileURLToPath } from "node:url";
 import { execFile, spawn } from "node:child_process";
 import { createServer } from "node:net";
 import { config } from "dotenv";
 import { createCipheriv, createHash, randomBytes, randomUUID } from "node:crypto";
-import { fileURLToPath, pathToFileURL } from "node:url";
 import { formatKeyring, generateKeyring } from "@geekmidas/constructs/encryption";
 import { ownerRole, readerRole, roleStatements } from "@geekmidas/db/pg/roles";
 import * as snsUrl from "@geekmidas/events/sns/url";
@@ -106,128 +107,6 @@ async function prompt(message, options) {
 	}
 }
 //#endregion
-//#region src/auth/credentials.ts
-/**
-* Get the path to the credentials directory
-*/
-function getCredentialsDir(options) {
-	if (options?.home) return options.home;
-	return options?.root ? join(options.root, ".gkm") : gkmHome();
-}
-/**
-* Get the path to the credentials file
-*/
-function getCredentialsPath(options) {
-	return join(getCredentialsDir(options), "credentials.json");
-}
-/**
-* Ensure the credentials directory exists
-*/
-function ensureCredentialsDir(options) {
-	const dir = getCredentialsDir(options);
-	if (!existsSync(dir)) mkdirSync(dir, {
-		recursive: true,
-		mode: 448
-	});
-}
-/**
-* Read stored credentials from disk
-*/
-async function readCredentials(options) {
-	const path = getCredentialsPath(options);
-	if (!existsSync(path)) return {};
-	try {
-		const content = await readFile(path, "utf-8");
-		return JSON.parse(content);
-	} catch {
-		return {};
-	}
-}
-/**
-* Write credentials to disk
-*/
-async function writeCredentials(credentials, options) {
-	ensureCredentialsDir(options);
-	const path = getCredentialsPath(options);
-	await writeFile(path, JSON.stringify(credentials, null, 2), { mode: 384 });
-}
-/**
-* Store Dokploy credentials
-*/
-async function storeDokployCredentials(token, endpoint, options) {
-	const credentials = await readCredentials(options);
-	credentials.dokploy = {
-		token,
-		endpoint,
-		storedAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-	await writeCredentials(credentials, options);
-}
-/**
-* Get stored Dokploy credentials
-*/
-async function getDokployCredentials(options) {
-	const credentials = await readCredentials(options);
-	const token = process.env.DOKPLOY_API_TOKEN ?? credentials.dokploy?.token;
-	const endpoint = process.env.DOKPLOY_ENDPOINT ?? credentials.dokploy?.endpoint;
-	if (!token || !endpoint) return null;
-	return {
-		token,
-		endpoint: endpoint.replace(/\/$/, ""),
-		...credentials.dokploy?.registryId ? { registryId: credentials.dokploy.registryId } : {}
-	};
-}
-/**
-* Remove Dokploy credentials
-*/
-async function removeDokployCredentials(options) {
-	const credentials = await readCredentials(options);
-	if (!credentials.dokploy) return false;
-	delete credentials.dokploy;
-	await writeCredentials(credentials, options);
-	return true;
-}
-/**
-* Get Dokploy API token, checking stored credentials first, then environment
-*/
-async function getDokployToken(options) {
-	const envToken = process.env.DOKPLOY_API_TOKEN;
-	if (envToken) return envToken;
-	const stored = await getDokployCredentials(options);
-	if (stored) return stored.token;
-	return null;
-}
-/**
-* Get Dokploy registry ID from stored credentials
-*/
-async function getDokployRegistryId(options) {
-	return (await getDokployCredentials(options))?.registryId ?? void 0;
-}
-/**
-* Store Hostinger API token
-*
-* @param token - API token from hpanel.hostinger.com/profile/api
-*/
-async function storeHostingerToken(token, options) {
-	const credentials = await readCredentials(options);
-	credentials.hostinger = {
-		token,
-		storedAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-	await writeCredentials(credentials, options);
-}
-/**
-* Get stored Hostinger API token
-*
-* Checks environment variable first (HOSTINGER_API_TOKEN),
-* then falls back to stored credentials.
-*/
-async function getHostingerToken(options) {
-	const envToken = process.env.HOSTINGER_API_TOKEN;
-	if (envToken) return envToken;
-	return (await readCredentials(options)).hostinger?.token ?? null;
-}
-//#endregion
 //#region src/auth/index.ts
 const logger$2 = console;
 /**
@@ -585,45 +464,6 @@ function normalizeRoutes(routes) {
 	return Array.isArray(routes) ? routes : [routes];
 }
 //#endregion
-//#region src/owningTsconfigJsx.ts
-const REGISTER = "owning-tsconfig-jsx-register.mjs";
-/** The CLI's `bin/` was not found above the module looking for it. */
-var OwningTsconfigJsxHookMissing = class extends Error {
-	from;
-	constructor(from) {
-		super(`Could not find bin/${REGISTER} in any directory above '${from}'. It ships with @geekmidas/cli beside bin/gkm.mjs; reinstall the package if it is missing.`);
-		this.from = from;
-		this.name = "OwningTsconfigJsxHookMissing";
-	}
-};
-/**
-* The CLI's `bin/owning-tsconfig-jsx-register.mjs`, as a file URL. Searched
-* upward because this module runs from `src/` in the repo and from a chunk in
-* `dist/` once built, and `bin/` sits beside both.
-*/
-function registerUrl() {
-	const from = dirname(fileURLToPath(import.meta.url));
-	for (let dir = from;; dir = dirname(dir)) {
-		const candidate = join(dir, "bin", REGISTER);
-		if (existsSync(candidate)) return pathToFileURL(candidate).href;
-		if (dirname(dir) === dir) throw new OwningTsconfigJsxHookMissing(from);
-	}
-}
-/**
-* `NODE_OPTIONS` for a process that runs app code through tsx, with the hook
-* that compiles each `.tsx` with its own tsconfig's JSX settings (see
-* `bin/owning-tsconfig-jsx.mjs`) put in front of every other `--import`, so it
-* is registered before tsx and reads the source on tsx's behalf.
-*
-* `bin/gkm.mjs` already starts the CLI this way, and its children inherit it;
-* this is for those that set `NODE_OPTIONS` themselves, or whose CLI was
-* started with tsx already imported.
-*/
-function withOwningTsconfigJsx(nodeOptions = "") {
-	if (nodeOptions.includes(REGISTER)) return nodeOptions;
-	return [`--import=${registerUrl()}`, nodeOptions].filter(Boolean).join(" ");
-}
-//#endregion
 //#region src/reconcile/containers.ts
 /**
 * What gkm knows about each container it can derive.
@@ -2470,7 +2310,7 @@ var UnassignedPort = class extends Error {
 * Every call is scoped to the generated compose file. Nothing here can touch a
 * container this project did not generate.
 */
-const run$1 = promisify(execFile);
+const run = promisify(execFile);
 /**
 * The generated file, then the project's own if it has one.
 *
@@ -2513,7 +2353,7 @@ function shown(args, services) {
 const dockerCli = {
 	async publishedPort(composePath, service, inside) {
 		try {
-			const { stdout } = await run$1("docker", [
+			const { stdout } = await run("docker", [
 				"compose",
 				...composeFiles(composePath),
 				"port",
@@ -2538,11 +2378,11 @@ const dockerCli = {
 			...services
 		];
 		if (options.show) return shown(args, services);
-		await run$1("docker", args);
+		await run("docker", args);
 	},
 	async copyOut(composePath, service, from, to) {
 		await mkdir(dirname(to), { recursive: true });
-		await run$1("docker", [
+		await run("docker", [
 			"compose",
 			...composeFiles(composePath),
 			"cp",
@@ -2551,7 +2391,7 @@ const dockerCli = {
 		]);
 	},
 	async reload(composePath, service) {
-		await run$1("docker", [
+		await run("docker", [
 			"compose",
 			...composeFiles(composePath),
 			"exec",
@@ -2566,7 +2406,7 @@ const dockerCli = {
 	async healthy(composePath, services) {
 		if (services.length === 0) return true;
 		try {
-			const { stdout } = await run$1("docker", [
+			const { stdout } = await run("docker", [
 				"compose",
 				...composeFiles(composePath),
 				"ps",
@@ -3518,116 +3358,6 @@ function localAddress(port) {
 	return `http://localhost:${port}`;
 }
 //#endregion
-//#region src/run.ts
-/**
-* Start a program with an argument array, never a shell string.
-*
-* `gkm build`, `gkm docker` and `gkm deploy` pass values that come from the
-* workspace — image refs, tags, build args, package names — to `docker` and
-* `turbo`. Joined into a string and handed to a shell, a package named
-* `x;curl …|sh` or a tag holding `$(…)` became part of the command line, which
-* matters most where the CLI builds a repository it didn't write: a CI job for a
-* fork, a shared build runner. Here every value reaches the program as one
-* `argv` element, whatever it contains.
-*/
-/** Long enough for a cold image build; short enough that a hung one ends. */
-const DEFAULT_TIMEOUT_MS = 18e5;
-/** How long a timed-out child has to exit on SIGTERM before it is killed. */
-const KILL_GRACE_MS = 5e3;
-/** The command line as a person would read it — for messages, never to run. */
-function display(command, args) {
-	return [command, ...args].join(" ");
-}
-/** The program ran and exited unsuccessfully; its own output said why. */
-var CommandFailed = class extends Error {
-	command;
-	args;
-	exitCode;
-	signal;
-	constructor(command, args, exitCode, signal) {
-		super(`\`${display(command, args)}\` ${exitCode === null ? `was stopped by ${signal ?? "a signal"}` : `exited with code ${exitCode}`}. Its output above says why; run it by hand to see it again.`);
-		this.command = command;
-		this.args = args;
-		this.exitCode = exitCode;
-		this.signal = signal;
-		this.name = "CommandFailed";
-	}
-};
-/** The program ran past its timeout and was killed. */
-var CommandTimedOut = class extends Error {
-	command;
-	args;
-	timeoutMs;
-	constructor(command, args, timeoutMs) {
-		super(`\`${display(command, args)}\` was still running after ${Math.round(timeoutMs / 1e3)}s and was stopped. Check what it was waiting on — a registry, the Docker daemon, a prompt — and run it again.`);
-		this.command = command;
-		this.args = args;
-		this.timeoutMs = timeoutMs;
-		this.name = "CommandTimedOut";
-	}
-};
-/**
-* Run `command` with `args`, resolving when it exits 0.
-*
-* Rejects with {@link CommandFailed} on any other exit, {@link CommandTimedOut}
-* once `timeoutMs` passes (after the child is gone), and with the spawn error
-* itself when the program cannot be started at all — `ENOENT` already names it.
-*/
-async function run(command, args, options = {}) {
-	await spawnChild(command, args, options, false);
-}
-/**
-* {@link run}, resolving with what the program wrote to stdout — for a value
-* the CLI reads back, such as the digest `docker inspect` reports. stderr still
-* reaches the terminal, so a failure explains itself the same way.
-*/
-function runOutput(command, args, options = {}) {
-	return spawnChild(command, args, options, true);
-}
-function spawnChild(command, args, options, capture) {
-	const { timeoutMs = DEFAULT_TIMEOUT_MS, ...spawnOptions } = options;
-	return new Promise((resolve, reject) => {
-		const child = spawn(command, [...args], {
-			stdio: "inherit",
-			...spawnOptions,
-			...capture ? { stdio: [
-				"ignore",
-				"pipe",
-				"inherit"
-			] } : {},
-			shell: false
-		});
-		let stdout = "";
-		child.stdout?.on("data", (chunk) => {
-			stdout += chunk.toString();
-		});
-		let timedOut = false;
-		let killer;
-		const timer = setTimeout(() => {
-			timedOut = true;
-			child.kill("SIGTERM");
-			killer = setTimeout(() => child.kill("SIGKILL"), KILL_GRACE_MS);
-			killer.unref?.();
-		}, timeoutMs);
-		timer.unref?.();
-		const settle = () => {
-			clearTimeout(timer);
-			if (killer) clearTimeout(killer);
-		};
-		child.on("error", (error) => {
-			settle();
-			reject(spawnOptions.signal?.aborted ? spawnOptions.signal.reason : error);
-		});
-		child.on("close", (code, signal) => {
-			settle();
-			if (spawnOptions.signal?.aborted) reject(spawnOptions.signal.reason);
-			else if (timedOut) reject(new CommandTimedOut(command, args, timeoutMs));
-			else if (code === 0) resolve(stdout);
-			else reject(new CommandFailed(command, args, code, signal));
-		});
-	});
-}
-//#endregion
 //#region src/secrets/encryption.ts
 var encryption_exports = /* @__PURE__ */ __exportAll({
 	encryptSecrets: () => encryptSecrets,
@@ -4052,17 +3782,17 @@ function isStateStore(value) {
 async function createStateStore(options) {
 	const { config, workspaceRoot, workspaceName } = options;
 	if (!config || config.provider === "local") {
-		const { LocalStateStore } = await import("./LocalStateStore-B51rnfgn.mjs").then((n) => n.n);
+		const { LocalStateStore } = await import("./LocalStateStore-Cy1ZBW7U.mjs").then((n) => n.n);
 		return new LocalStateStore(workspaceRoot);
 	}
 	if (isStateStore(config.provider)) return config.provider;
 	if (isStateProvider(config.provider)) {
-		const { LegacyStateStore } = await import("./LegacyStateStore-A8d2GdT7.mjs");
+		const { LegacyStateStore } = await import("./LegacyStateStore-DIgkGaUP.mjs");
 		return new LegacyStateStore(config.provider, { warn: options.warn });
 	}
 	if (config.provider === "ssm") {
 		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("ssm");
-		const { SSMStateStore } = await import("./SSMStateStore-iK5UKp9d.mjs");
+		const { SSMStateStore } = await import("./SSMStateStore-DfF174xQ.mjs");
 		const ssm = config;
 		return SSMStateStore.create({
 			workspaceName,
@@ -4072,7 +3802,7 @@ async function createStateStore(options) {
 	}
 	if (config.provider === "s3") {
 		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("s3");
-		const { S3StateStore } = await import("./S3StateStore-CJewPhgz.mjs");
+		const { S3StateStore } = await import("./S3StateStore-D3x6ivBL.mjs");
 		const s3 = config;
 		return S3StateStore.create({
 			workspaceName,
@@ -5250,7 +4980,7 @@ async function buildDockerImage(imageName, options, cwd) {
 	logger.log(`\n🐳 Building Docker image: ${fullImageName}`);
 	const cleanup = ensureLockfile(cwd);
 	try {
-		await run("docker", [
+		await run$1("docker", [
 			"build",
 			"--file=.gkm/docker/Dockerfile",
 			`--tag=${fullImageName}`,
@@ -5279,7 +5009,7 @@ async function pushDockerImage(imageName, options, cwd) {
 	const fullImageName = validateImageRef(`${registry}/${imageName}:${tag}`);
 	logger.log(`\n🚀 Pushing Docker image: ${fullImageName}`);
 	try {
-		await run("docker", ["push", fullImageName], { cwd });
+		await run$1("docker", ["push", fullImageName], { cwd });
 		logger.log(`✅ Docker image pushed: ${fullImageName}`);
 	} catch (error) {
 		throw new DockerPushFailed(fullImageName, error);
@@ -6221,13 +5951,6 @@ var DokployApi = class {
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 /**
-* Resolve the tsx package path from the CLI package's dependencies.
-* This ensures tsx is available regardless of whether the target project has it installed.
-*/
-function resolveTsxPath() {
-	return createRequire(import.meta.url).resolve("tsx");
-}
-/**
 * Resolve the path to a sniffer helper file.
 * Handles both dev (.ts with tsx) and production (.mjs from dist).
 *
@@ -6246,6 +5969,39 @@ function resolveSnifferFile(baseName) {
 	return tsPath;
 }
 /**
+* Run a sniffer worker in the sandbox, with the sandbox's environment and
+* nothing of the deploy's: the deploy's Dokploy token, registry login and AWS
+* keys stay where they are. A worker that outlives the timeout is killed, and
+* comes back as the error the caller reports.
+*/
+async function runSniffer(run, workspacePath, cwd, nodeArgs) {
+	const sandbox = run.sandbox ?? activeSandbox() ?? new LocalSandbox({ root: resolve(workspacePath) });
+	try {
+		const result = await sandbox.exec("node", nodeArgs, {
+			cwd,
+			env: { ...sandbox.env },
+			timeoutMs: run.timeoutMs ?? 3e4,
+			output: "capture"
+		});
+		return {
+			stdout: result.stdout,
+			stderr: result.stderr,
+			code: result.exitCode
+		};
+	} catch (error) {
+		return { error: error instanceof Error ? error : new Error(String(error)) };
+	}
+}
+/** The worker's JSON answer: the last object on stdout naming `envVars`. */
+function snifferAnswer(stdout) {
+	try {
+		const jsonMatch = stdout.match(/\{[^{}]*"envVars"[^{}]*\}[^{]*$/);
+		return jsonMatch ? JSON.parse(jsonMatch[0]) : void 0;
+	} catch {
+		return;
+	}
+}
+/**
 * Get required environment variables for an app.
 *
 * Detection strategy (in order):
@@ -6267,6 +6023,10 @@ function resolveSnifferFile(baseName) {
 */
 async function sniffAppEnvironment(app, appName, workspacePath, options = {}) {
 	const { logWarnings = true, markOptional = false } = options;
+	const run = {
+		...options.sandbox ? { sandbox: options.sandbox } : {},
+		...options.timeoutMs ? { timeoutMs: options.timeoutMs } : {}
+	};
 	if (app.type === "web" || app.type === "mobile") {
 		const publicPrefix = getPublicEnvPrefix(app.framework);
 		const depVars = publicPrefix ? (app.dependencies ?? []).map((dep) => `${publicPrefix}${dep.toUpperCase()}_URL`) : [];
@@ -6277,7 +6037,7 @@ async function sniffAppEnvironment(app, appName, workspacePath, options = {}) {
 			if (app.config.client) configPaths.push(app.config.client);
 			if (app.config.server) configPaths.push(app.config.server);
 			for (const configPath of configPaths) {
-				const result = await sniffEntryFile(configPath, app.path, workspacePath);
+				const result = await sniffEntryFile(configPath, app.path, workspacePath, run);
 				if (logWarnings && result.error) output.warn(`[sniffer] ${appName}: Config file "${configPath}" threw error during sniffing (env vars still captured): ${result.error.message}`);
 				sniffedVars.push(...result.envVars);
 				sniffedOptional.push(...result.optionalEnvVars);
@@ -6296,7 +6056,7 @@ async function sniffAppEnvironment(app, appName, workspacePath, options = {}) {
 		};
 	}
 	if (app.entry) {
-		const result = await sniffEntryFile(app.entry, app.path, workspacePath);
+		const result = await sniffEntryFile(app.entry, app.path, workspacePath, run);
 		if (logWarnings && result.error) output.warn(`[sniffer] ${appName}: Entry file threw error during sniffing (env vars still captured): ${result.error.message}`);
 		return {
 			appName,
@@ -6305,7 +6065,7 @@ async function sniffAppEnvironment(app, appName, workspacePath, options = {}) {
 		};
 	}
 	if (app.routes) {
-		const result = await sniffRouteFiles(normalizeRoutes(app.routes), app.path, workspacePath);
+		const result = await sniffRouteFiles(normalizeRoutes(app.routes), app.path, workspacePath, run);
 		if (logWarnings && result.error) output.warn(`[sniffer] ${appName}: Route sniffing threw error (env vars still captured): ${result.error.message}`);
 		return {
 			appName,
@@ -6314,7 +6074,7 @@ async function sniffAppEnvironment(app, appName, workspacePath, options = {}) {
 		};
 	}
 	if (app.envParser) {
-		const result = await sniffEnvParser(app.envParser, app.path, workspacePath);
+		const result = await sniffEnvParser(app.envParser, app.path, workspacePath, run);
 		if (logWarnings) {
 			if (result.error) output.warn(`[sniffer] ${appName}: envParser threw error during sniffing (env vars still captured): ${result.error.message}`);
 			if (result.unhandledRejections.length > 0) output.warn(`[sniffer] ${appName}: Fire-and-forget rejections during sniffing (suppressed): ${result.unhandledRejections.map((e) => e.message).join(", ")}`);
@@ -6359,63 +6119,27 @@ function applyMarkOptional(envVars, optionalEnvVars, markOptional) {
 * @param workspacePath - Absolute path to workspace root
 * @returns EntrySniffResult with env vars and optional error
 */
-async function sniffEntryFile(entryPath, appPath, workspacePath) {
+async function sniffEntryFile(entryPath, appPath, workspacePath, run = {}) {
 	const fullEntryPath = resolve(workspacePath, appPath, entryPath);
 	const loaderPath = resolveSnifferFile("sniffer-loader");
 	const workerPath = resolveSnifferFile("sniffer-worker");
-	return new Promise((resolvePromise) => {
-		const child = spawn("node", [
-			"--import",
-			loaderPath,
-			workerPath,
-			fullEntryPath
-		], {
-			cwd: resolve(workspacePath, appPath),
-			stdio: [
-				"ignore",
-				"pipe",
-				"pipe"
-			],
-			env: {
-				...process.env,
-				NODE_OPTIONS: withOwningTsconfigJsx("--import=tsx")
-			}
-		});
-		let stdout = "";
-		let stderr = "";
-		child.stdout.on("data", (data) => {
-			stdout += data.toString();
-		});
-		child.stderr.on("data", (data) => {
-			stderr += data.toString();
-		});
-		child.on("close", (code) => {
-			try {
-				const jsonMatch = stdout.match(/\{[^{}]*"envVars"[^{}]*\}[^{]*$/);
-				if (jsonMatch) {
-					const result = JSON.parse(jsonMatch[0]);
-					resolvePromise({
-						envVars: result.envVars || [],
-						optionalEnvVars: result.optionalEnvVars || [],
-						error: result.error ? new Error(result.error) : void 0
-					});
-					return;
-				}
-			} catch {}
-			resolvePromise({
-				envVars: [],
-				optionalEnvVars: [],
-				error: /* @__PURE__ */ new Error(`Failed to sniff entry file (exit code ${code}): ${stderr || stdout || "No output"}`)
-			});
-		});
-		child.on("error", (err) => {
-			resolvePromise({
-				envVars: [],
-				optionalEnvVars: [],
-				error: err
-			});
-		});
-	});
+	const ran = await runSniffer(run, workspacePath, resolve(workspacePath, appPath), nodeWithTsx(workerPath, [fullEntryPath], [loaderPath]));
+	if ("error" in ran) return {
+		envVars: [],
+		optionalEnvVars: [],
+		error: ran.error
+	};
+	const answer = snifferAnswer(ran.stdout);
+	if (answer) return {
+		envVars: answer.envVars || [],
+		optionalEnvVars: answer.optionalEnvVars || [],
+		error: answer.error ? new Error(answer.error) : void 0
+	};
+	return {
+		envVars: [],
+		optionalEnvVars: [],
+		error: /* @__PURE__ */ new Error(`Failed to sniff entry file (exit code ${ran.code}): ${ran.stderr || ran.stdout || "No output"}`)
+	};
 }
 /**
 * Sniff route files by loading constructs and calling getEnvironment().
@@ -6431,116 +6155,79 @@ async function sniffEntryFile(entryPath, appPath, workspacePath) {
 * @param workspacePath - Absolute path to workspace root
 * @returns EntrySniffResult with env vars and optional error
 */
-async function sniffRouteFiles(routes, appPath, workspacePath) {
+async function sniffRouteFiles(routes, appPath, workspacePath, run = {}) {
 	const fullAppPath = resolve(workspacePath, appPath);
 	const workerPath = resolveSnifferFile("sniffer-routes-worker");
-	const tsxPath = resolveTsxPath();
 	const pattern = (Array.isArray(routes) ? routes : [routes])[0];
 	if (!pattern) return {
 		envVars: [],
 		optionalEnvVars: [],
 		error: /* @__PURE__ */ new Error("No route patterns provided")
 	};
-	return new Promise((resolvePromise) => {
-		const child = spawn("node", [
-			"--import",
-			tsxPath,
-			workerPath,
-			fullAppPath,
-			pattern
-		], {
-			cwd: fullAppPath,
-			stdio: [
-				"ignore",
-				"pipe",
-				"pipe"
-			],
-			env: { ...process.env }
-		});
-		let stdout = "";
-		let stderr = "";
-		child.stdout.on("data", (data) => {
-			stdout += data.toString();
-		});
-		child.stderr.on("data", (data) => {
-			stderr += data.toString();
-		});
-		child.on("close", (code) => {
-			if (stderr) stderr.split("\n").filter((line) => line.trim()).forEach((line) => output.warn(line));
-			try {
-				const jsonMatch = stdout.match(/\{[^{}]*"envVars"[^{}]*\}[^{]*$/);
-				if (jsonMatch) {
-					const result = JSON.parse(jsonMatch[0]);
-					resolvePromise({
-						envVars: result.envVars || [],
-						optionalEnvVars: result.optionalEnvVars || [],
-						error: result.error ? new Error(result.error) : void 0
-					});
-					return;
-				}
-			} catch {}
-			resolvePromise({
-				envVars: [],
-				optionalEnvVars: [],
-				error: /* @__PURE__ */ new Error(`Failed to sniff route files (exit code ${code}): ${stderr || stdout || "No output"}`)
-			});
-		});
-		child.on("error", (err) => {
-			resolvePromise({
-				envVars: [],
-				optionalEnvVars: [],
-				error: err
-			});
-		});
-	});
+	const ran = await runSniffer(run, workspacePath, fullAppPath, nodeWithTsx(workerPath, [fullAppPath, pattern]));
+	if ("error" in ran) return {
+		envVars: [],
+		optionalEnvVars: [],
+		error: ran.error
+	};
+	if (ran.stderr) ran.stderr.split("\n").filter((line) => line.trim()).forEach((line) => output.warn(line));
+	const answer = snifferAnswer(ran.stdout);
+	if (answer) return {
+		envVars: answer.envVars || [],
+		optionalEnvVars: answer.optionalEnvVars || [],
+		error: answer.error ? new Error(answer.error) : void 0
+	};
+	return {
+		envVars: [],
+		optionalEnvVars: [],
+		error: /* @__PURE__ */ new Error(`Failed to sniff route files (exit code ${ran.code}): ${ran.stderr || ran.stdout || "No output"}`)
+	};
 }
 /**
 * Run the SnifferEnvironmentParser on an envParser module to detect
 * which environment variables it accesses.
 *
-* This function handles "fire and forget" async operations by using
-* the shared sniffWithFireAndForget utility from @geekmidas/envkit.
+* In a subprocess, like the entry and route sniffers: the module is the
+* project's code, and it was imported into the deploy itself before — with
+* every credential the deploy held in reach. Fire-and-forget rejections are
+* collected there with the shared `sniffWithFireAndForget`.
 *
 * @param envParserPath - The envParser config (e.g., './src/config/env#envParser')
 * @param appPath - The app's path relative to workspace
 * @param workspacePath - Absolute path to workspace root
 * @returns SniffResult with env vars and any errors encountered
 */
-async function sniffEnvParser(envParserPath, appPath, workspacePath) {
+async function sniffEnvParser(envParserPath, appPath, workspacePath, run = {}) {
 	const [modulePath, exportName = "default"] = envParserPath.split("#");
 	if (!modulePath) return {
 		envVars: [],
 		optionalEnvVars: [],
 		unhandledRejections: []
 	};
-	const fullPath = resolve(workspacePath, appPath, modulePath);
-	let SnifferEnvironmentParser;
-	let sniffWithFireAndForget;
-	try {
-		const envkitModule = await import("@geekmidas/envkit/sniffer");
-		SnifferEnvironmentParser = envkitModule.SnifferEnvironmentParser;
-		sniffWithFireAndForget = envkitModule.sniffWithFireAndForget;
-	} catch (error) {
-		const message = error instanceof Error ? error.message : String(error);
-		output.warn(`[sniffer] Failed to import SnifferEnvironmentParser: ${message}`);
-		return {
-			envVars: [],
-			optionalEnvVars: [],
-			unhandledRejections: []
-		};
-	}
-	const sniffer = new SnifferEnvironmentParser();
-	return sniffWithFireAndForget(sniffer, async () => {
-		const envParser = (await import(pathToFileURL(fullPath).href))[exportName];
-		if (typeof envParser !== "function") {
-			output.warn(`[sniffer] Export "${exportName}" from "${modulePath}" is not a function`);
-			return;
-		}
-		const result = envParser(sniffer);
-		if (result && typeof result.parse === "function") try {
-			result.parse();
-		} catch {}
-	});
+	const appRoot = resolve(workspacePath, appPath);
+	const fullPath = resolve(appRoot, modulePath);
+	const workerPath = resolveSnifferFile("sniffer-envparser-worker");
+	const ran = await runSniffer(run, workspacePath, appRoot, nodeWithTsx(workerPath, [fullPath, exportName]));
+	if ("error" in ran) return {
+		envVars: [],
+		optionalEnvVars: [],
+		unhandledRejections: [],
+		error: ran.error
+	};
+	const answer = snifferAnswer(ran.stdout);
+	if (!answer) return {
+		envVars: [],
+		optionalEnvVars: [],
+		unhandledRejections: [],
+		error: /* @__PURE__ */ new Error(`Failed to sniff envParser (exit code ${ran.code}): ${ran.stderr || ran.stdout || "No output"}`)
+	};
+	for (const warning of answer.warnings ?? []) output.warn(warning);
+	return {
+		envVars: answer.envVars ?? [],
+		optionalEnvVars: answer.optionalEnvVars ?? [],
+		unhandledRejections: (answer.unhandledRejections ?? []).map((message) => new Error(message)),
+		...answer.error ? { error: new Error(answer.error) } : {}
+	};
 }
 /**
 * Sniff environment requirements for multiple apps.
@@ -6559,6 +6246,6 @@ async function sniffAllApps(apps, workspacePath, options = {}) {
 	return results;
 }
 //#endregion
-export { quoteIdentifier as $, StateStoreBusy as A, getDokployCredentials as At, run as B, setDnsRecord as C, loadEnvFiles as Ct, DocumentStateStore as D, logoutCommand as Dt, setPostgresBackupId as E, loginCommand as Et, newLockHolder as F, storeDokployCredentials as Ft, derivedContainers as G, FAKE_ENV as H, withGeneratedSecrets as I, canPrompt as It, LOCAL_CA_PATH as J, reconcileWorkspace as K, encryptSecrets as L, prompt as Lt, StateVersionConflict as M, getDokployToken as Mt, contentVersion as N, getHostingerToken as Nt, StageStateMissing as O, validateDokployToken as Ot, createStateStore as P, readCredentials as Pt, postgresStatements as Q, encryption_exports as R, setDeployedImage as S, isPortAvailable as St, setGeneratedSecret as T, prepareEntryCredentials as Tt, backendsOf as U, runOutput as V, constructGlobs as W, applyPostgres as X, forgetState as Y, postgresDatabaseNames as Z, getBackupState as _, primaryPortKey as _t, DockerBuildFailed as a, localRolePassword as at, setApplicationId as b, createEntryWrapper as bt, dockerCommand as c, hostFor as ct, generateDockerignore as d, providerOf as dt, composeFor as et, generateSlimDockerfile as f, storageBackendFor as ft, createEmptyState as g, portKeys as gt, resolveHost as h, fakeKey as ht, DokployApiError as i, envFor as it, StateStoreWithoutLocking as j, getDokployRegistryId as jt, StateLocked as k, whoamiCommand as kt, siteDockerfile as l, cacheBackendFor as lt, isMainFrontendApp as m, describeServices as mt, sniffAppEnvironment as n, appEnvKeys as nt, DockerPushFailed as o, planFor as ot, validateImageRef as p, DEFAULT_IMAGES as pt, workspace_exports as q, DokployApi as r, networkEnv as rt, appPackageName as s, resourceName as st, sniffAllApps as t, pgClient as tt, detectPackageManager as u, eventsBackendFor as ut, getGeneratedSecret as v, withOwningTsconfigJsx as vt, setDnsVerification as w, loadSecretsForApp as wt, setBackupState as x, findAvailablePort as xt, isDnsVerified as y, createCredentialsPreload as yt, keyFingerprint as z };
+export { pgClient as $, StateStoreBusy as A, FAKE_ENV as B, setDnsRecord as C, loginCommand as Ct, DocumentStateStore as D, canPrompt as Dt, setPostgresBackupId as E, whoamiCommand as Et, newLockHolder as F, workspace_exports as G, constructGlobs as H, withGeneratedSecrets as I, applyPostgres as J, LOCAL_CA_PATH as K, encryptSecrets as L, StateVersionConflict as M, contentVersion as N, StageStateMissing as O, prompt as Ot, createStateStore as P, composeFor as Q, encryption_exports as R, setDeployedImage as S, prepareEntryCredentials as St, setGeneratedSecret as T, validateDokployToken as Tt, derivedContainers as U, backendsOf as V, reconcileWorkspace as W, postgresStatements as X, postgresDatabaseNames as Y, quoteIdentifier as Z, getBackupState as _, createEntryWrapper as _t, DockerBuildFailed as a, resourceName as at, setApplicationId as b, loadEnvFiles as bt, dockerCommand as c, eventsBackendFor as ct, generateDockerignore as d, DEFAULT_IMAGES as dt, appEnvKeys as et, generateSlimDockerfile as f, describeServices as ft, createEmptyState as g, createCredentialsPreload as gt, resolveHost as h, primaryPortKey as ht, DokployApiError as i, planFor as it, StateStoreWithoutLocking as j, StateLocked as k, siteDockerfile as l, providerOf as lt, isMainFrontendApp as m, portKeys as mt, sniffAppEnvironment as n, envFor as nt, DockerPushFailed as o, hostFor as ot, validateImageRef as p, fakeKey as pt, forgetState as q, DokployApi as r, localRolePassword as rt, appPackageName as s, cacheBackendFor as st, sniffAllApps as t, networkEnv as tt, detectPackageManager as u, storageBackendFor as ut, getGeneratedSecret as v, findAvailablePort as vt, setDnsVerification as w, logoutCommand as wt, setBackupState as x, loadSecretsForApp as xt, isDnsVerified as y, isPortAvailable as yt, keyFingerprint as z };
 
-//# sourceMappingURL=sniffer-DHE2Nafd.mjs.map
+//# sourceMappingURL=sniffer-49KPbDgq.mjs.map