@geekmidas/cli 10.0.0-alpha.62 → 10.0.0-alpha.64

package/dist/{sniffer-BsfPa-GA.cjs → sniffer-ByhbEW5A.cjs}

@@ -1,11 +1,13 @@
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
-const require_home = require("./home-DOzBaWaL.cjs");
-const require_discover = require("./discover-Bc-4eA_p.cjs");
-const require_config = require("./config-BYh9S0cZ.cjs");
-const require_workspace = require("./workspace-B6zQO6RY.cjs");
+const require_local = require("./local-C7wnrcYK.cjs");
+const require_discover = require("./discover-DHdECueV.cjs");
+const require_sandbox = require("./sandbox-CL--ZDui.cjs");
+const require_derive = require("./derive-DAbo49sm.cjs");
+const require_workspace = require("./workspace-BwgWJK7h.cjs");
+const require_config = require("./config.cjs");
 const require_storage = require("./storage-CSGoC3bK.cjs");
-const require_store = require("./store-KvNQwYaB.cjs");
-const require_runtime = require("./runtime-CMwtq0AL.cjs");
+const require_store = require("./store-D_2ByRtW.cjs");
+const require_runtime = require("./runtime-BGNDrHzh.cjs");
 const require_fakes = require("./fakes-zW-jNAbQ.cjs");
 let node_path = require("node:path");
 let node_process = require("node:process");
@@ -16,12 +18,11 @@ let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");
 let node_util = require("node:util");
 let _geekmidas_manifest = require("@geekmidas/manifest");
+let node_url = require("node:url");
 let node_child_process = require("node:child_process");
-let node_module = require("node:module");
 let node_net = require("node:net");
 let dotenv = require("dotenv");
 let node_crypto = require("node:crypto");
-let node_url = require("node:url");
 let _geekmidas_constructs_encryption = require("@geekmidas/constructs/encryption");
 let _geekmidas_db_pg_roles = require("@geekmidas/db/pg/roles");
 let _geekmidas_events_sns_url = require("@geekmidas/events/sns/url");
@@ -109,128 +110,6 @@ async function prompt(message, options) {
 	}
 }
 //#endregion
-//#region src/auth/credentials.ts
-/**
-* Get the path to the credentials directory
-*/
-function getCredentialsDir(options) {
-	if (options?.home) return options.home;
-	return options?.root ? (0, node_path.join)(options.root, ".gkm") : require_home.gkmHome();
-}
-/**
-* Get the path to the credentials file
-*/
-function getCredentialsPath(options) {
-	return (0, node_path.join)(getCredentialsDir(options), "credentials.json");
-}
-/**
-* Ensure the credentials directory exists
-*/
-function ensureCredentialsDir(options) {
-	const dir = getCredentialsDir(options);
-	if (!(0, node_fs.existsSync)(dir)) (0, node_fs.mkdirSync)(dir, {
-		recursive: true,
-		mode: 448
-	});
-}
-/**
-* Read stored credentials from disk
-*/
-async function readCredentials(options) {
-	const path = getCredentialsPath(options);
-	if (!(0, node_fs.existsSync)(path)) return {};
-	try {
-		const content = await (0, node_fs_promises.readFile)(path, "utf-8");
-		return JSON.parse(content);
-	} catch {
-		return {};
-	}
-}
-/**
-* Write credentials to disk
-*/
-async function writeCredentials(credentials, options) {
-	ensureCredentialsDir(options);
-	const path = getCredentialsPath(options);
-	await (0, node_fs_promises.writeFile)(path, JSON.stringify(credentials, null, 2), { mode: 384 });
-}
-/**
-* Store Dokploy credentials
-*/
-async function storeDokployCredentials(token, endpoint, options) {
-	const credentials = await readCredentials(options);
-	credentials.dokploy = {
-		token,
-		endpoint,
-		storedAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-	await writeCredentials(credentials, options);
-}
-/**
-* Get stored Dokploy credentials
-*/
-async function getDokployCredentials(options) {
-	const credentials = await readCredentials(options);
-	const token = process.env.DOKPLOY_API_TOKEN ?? credentials.dokploy?.token;
-	const endpoint = process.env.DOKPLOY_ENDPOINT ?? credentials.dokploy?.endpoint;
-	if (!token || !endpoint) return null;
-	return {
-		token,
-		endpoint: endpoint.replace(/\/$/, ""),
-		...credentials.dokploy?.registryId ? { registryId: credentials.dokploy.registryId } : {}
-	};
-}
-/**
-* Remove Dokploy credentials
-*/
-async function removeDokployCredentials(options) {
-	const credentials = await readCredentials(options);
-	if (!credentials.dokploy) return false;
-	delete credentials.dokploy;
-	await writeCredentials(credentials, options);
-	return true;
-}
-/**
-* Get Dokploy API token, checking stored credentials first, then environment
-*/
-async function getDokployToken(options) {
-	const envToken = process.env.DOKPLOY_API_TOKEN;
-	if (envToken) return envToken;
-	const stored = await getDokployCredentials(options);
-	if (stored) return stored.token;
-	return null;
-}
-/**
-* Get Dokploy registry ID from stored credentials
-*/
-async function getDokployRegistryId(options) {
-	return (await getDokployCredentials(options))?.registryId ?? void 0;
-}
-/**
-* Store Hostinger API token
-*
-* @param token - API token from hpanel.hostinger.com/profile/api
-*/
-async function storeHostingerToken(token, options) {
-	const credentials = await readCredentials(options);
-	credentials.hostinger = {
-		token,
-		storedAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-	await writeCredentials(credentials, options);
-}
-/**
-* Get stored Hostinger API token
-*
-* Checks environment variable first (HOSTINGER_API_TOKEN),
-* then falls back to stored credentials.
-*/
-async function getHostingerToken(options) {
-	const envToken = process.env.HOSTINGER_API_TOKEN;
-	if (envToken) return envToken;
-	return (await readCredentials(options)).hostinger?.token ?? null;
-}
-//#endregion
 //#region src/auth/index.ts
 const logger$2 = console;
 /**
@@ -278,10 +157,10 @@ async function loginCommand(options) {
 			logger$2.error("\n✗ Invalid credentials. Please check your token and try again.");
 			process.exit(1);
 		}
-		await storeDokployCredentials(token, endpoint);
+		await require_local.storeDokployCredentials(token, endpoint);
 		logger$2.log("\n✓ Successfully logged in to Dokploy!");
 		logger$2.log(`  Endpoint: ${endpoint}`);
-		logger$2.log(`  Credentials stored in: ${getCredentialsPath()}`);
+		logger$2.log(`  Credentials stored in: ${require_local.getCredentialsPath()}`);
 		logger$2.log("\nYou can now use deploy commands without setting DOKPLOY_API_TOKEN.");
 	}
 	if (provider === "hostinger") {
@@ -298,9 +177,9 @@ async function loginCommand(options) {
 			logger$2.error("Token is required");
 			process.exit(1);
 		}
-		await storeHostingerToken(token);
+		await require_local.storeHostingerToken(token);
 		logger$2.log("\n✓ Hostinger token stored.");
-		logger$2.log(`  Credentials stored in: ${getCredentialsPath()}`);
+		logger$2.log(`  Credentials stored in: ${require_local.getCredentialsPath()}`);
 		logger$2.log("  Not validated here: every DNS endpoint is scoped to a domain, so the\n  first deploy that touches DNS is where a bad token reports itself.");
 		logger$2.log("\nYou can now use it as a DNS provider without setting HOSTINGER_API_TOKEN.");
 	}
@@ -311,12 +190,12 @@ async function loginCommand(options) {
 async function logoutCommand(options) {
 	const { provider = "dokploy" } = options;
 	if (provider === "all") {
-		if (await removeDokployCredentials()) logger$2.log("\n✓ Logged out from all services");
+		if (await require_local.removeDokployCredentials()) logger$2.log("\n✓ Logged out from all services");
 		else logger$2.log("\nNo stored credentials found");
 		return;
 	}
 	if (provider === "dokploy") {
-		if (await removeDokployCredentials()) logger$2.log("\n✓ Logged out from Dokploy");
+		if (await require_local.removeDokployCredentials()) logger$2.log("\n✓ Logged out from Dokploy");
 		else logger$2.log("\nNo Dokploy credentials found");
 	}
 }
@@ -325,13 +204,13 @@ async function logoutCommand(options) {
 */
 async function whoamiCommand() {
 	logger$2.log("\n📋 Current credentials:\n");
-	const dokploy = await getDokployCredentials();
+	const dokploy = await require_local.getDokployCredentials();
 	if (dokploy) {
 		logger$2.log("  Dokploy:");
 		logger$2.log(`    Endpoint: ${dokploy.endpoint}`);
 		logger$2.log(`    Token: ${maskToken(dokploy.token)}`);
 	} else logger$2.log("  Dokploy: Not logged in");
-	logger$2.log(`\n  Credentials file: ${getCredentialsPath()}`);
+	logger$2.log(`\n  Credentials file: ${require_local.getCredentialsPath()}`);
 }
 /**
 * Mask a token for display
@@ -588,45 +467,6 @@ function normalizeRoutes(routes) {
 	return Array.isArray(routes) ? routes : [routes];
 }
 //#endregion
-//#region src/owningTsconfigJsx.ts
-const REGISTER = "owning-tsconfig-jsx-register.mjs";
-/** The CLI's `bin/` was not found above the module looking for it. */
-var OwningTsconfigJsxHookMissing = class extends Error {
-	from;
-	constructor(from) {
-		super(`Could not find bin/${REGISTER} in any directory above '${from}'. It ships with @geekmidas/cli beside bin/gkm.mjs; reinstall the package if it is missing.`);
-		this.from = from;
-		this.name = "OwningTsconfigJsxHookMissing";
-	}
-};
-/**
-* The CLI's `bin/owning-tsconfig-jsx-register.mjs`, as a file URL. Searched
-* upward because this module runs from `src/` in the repo and from a chunk in
-* `dist/` once built, and `bin/` sits beside both.
-*/
-function registerUrl() {
-	const from = (0, node_path.dirname)((0, node_url.fileURLToPath)(require("url").pathToFileURL(__filename).href));
-	for (let dir = from;; dir = (0, node_path.dirname)(dir)) {
-		const candidate = (0, node_path.join)(dir, "bin", REGISTER);
-		if ((0, node_fs.existsSync)(candidate)) return (0, node_url.pathToFileURL)(candidate).href;
-		if ((0, node_path.dirname)(dir) === dir) throw new OwningTsconfigJsxHookMissing(from);
-	}
-}
-/**
-* `NODE_OPTIONS` for a process that runs app code through tsx, with the hook
-* that compiles each `.tsx` with its own tsconfig's JSX settings (see
-* `bin/owning-tsconfig-jsx.mjs`) put in front of every other `--import`, so it
-* is registered before tsx and reads the source on tsx's behalf.
-*
-* `bin/gkm.mjs` already starts the CLI this way, and its children inherit it;
-* this is for those that set `NODE_OPTIONS` themselves, or whose CLI was
-* started with tsx already imported.
-*/
-function withOwningTsconfigJsx(nodeOptions = "") {
-	if (nodeOptions.includes(REGISTER)) return nodeOptions;
-	return [`--import=${registerUrl()}`, nodeOptions].filter(Boolean).join(" ");
-}
-//#endregion
 //#region src/reconcile/containers.ts
 /**
 * What gkm knows about each container it can derive.
@@ -1348,11 +1188,11 @@ function planFor(manifest, stage, order, options = {}) {
 	const root = rootSite(sites.map((r) => {
 		const declared = manifest[r.id];
 		return {
-			name: require_config.appKey(r.id),
+			name: require_derive.appKey(r.id),
 			...declared?.kind === "site" && declared.root ? { root: true } : {}
 		};
 	}));
-	for (const site of sites) if (require_config.appKey(site.id) === root) site.root = true;
+	for (const site of sites) if (require_derive.appKey(site.id) === root) site.root = true;
 	const workerBroker = events === "pgboss" && Object.values(manifest).some((d) => d?.kind === "worker") && resources.some((r) => r.kind === "database");
 	return {
 		stage,
@@ -1906,7 +1746,7 @@ function localPlan(workspace, manifest, fakes = {}) {
 * host's port for each app, never a name on the compose network.
 */
 function sitePublicArgs(manifest, appName, env) {
-	const declaration = Object.entries(manifest).find(([id, d]) => d.kind === "site" && require_config.appKey(id) === appName)?.[1];
+	const declaration = Object.entries(manifest).find(([id, d]) => d.kind === "site" && require_derive.appKey(id) === appName)?.[1];
 	if (declaration?.kind !== "site") return {};
 	const args = {};
 	for (const key of Object.keys((0, _geekmidas_manifest.publicEnvFor)(declaration, manifest))) {
@@ -1962,7 +1802,7 @@ function networkEnv(plan, options) {
 * port.
 */
 function appEnvKeys(manifest, appName, runnables = {}) {
-	const entry = Object.entries(manifest).find(([id, d]) => (d.kind === "rest-api" || d.kind === "site" || d.kind === "mobile-app") && require_config.appKey(id) === appName);
+	const entry = Object.entries(manifest).find(([id, d]) => (d.kind === "rest-api" || d.kind === "site" || d.kind === "mobile-app") && require_derive.appKey(id) === appName);
 	if (!entry) return void 0;
 	const [id, declaration] = entry;
 	const keys = /* @__PURE__ */ new Set([
@@ -2011,7 +1851,7 @@ function appServices(workspace, manifest, containers, runnables = {}, fakes = {}
 	const services = {};
 	for (const [name, app] of Object.entries(workspace.apps)) {
 		if (app.type === "mobile" || !app.port) continue;
-		const key = require_config.appKey(name);
+		const key = require_derive.appKey(name);
 		const health = app.type === "web" ? "/" : "/health";
 		const dockerfile = dockerfileOf(name, app.path);
 		const ports = [`${app.port}:${app.port}`];
@@ -2473,7 +2313,7 @@ var UnassignedPort = class extends Error {
 * Every call is scoped to the generated compose file. Nothing here can touch a
 * container this project did not generate.
 */
-const run$1 = (0, node_util.promisify)(node_child_process.execFile);
+const run = (0, node_util.promisify)(node_child_process.execFile);
 /**
 * The generated file, then the project's own if it has one.
 *
@@ -2516,7 +2356,7 @@ function shown(args, services) {
 const dockerCli = {
 	async publishedPort(composePath, service, inside) {
 		try {
-			const { stdout } = await run$1("docker", [
+			const { stdout } = await run("docker", [
 				"compose",
 				...composeFiles(composePath),
 				"port",
@@ -2541,11 +2381,11 @@ const dockerCli = {
 			...services
 		];
 		if (options.show) return shown(args, services);
-		await run$1("docker", args);
+		await run("docker", args);
 	},
 	async copyOut(composePath, service, from, to) {
 		await (0, node_fs_promises.mkdir)((0, node_path.dirname)(to), { recursive: true });
-		await run$1("docker", [
+		await run("docker", [
 			"compose",
 			...composeFiles(composePath),
 			"cp",
@@ -2554,7 +2394,7 @@ const dockerCli = {
 		]);
 	},
 	async reload(composePath, service) {
-		await run$1("docker", [
+		await run("docker", [
 			"compose",
 			...composeFiles(composePath),
 			"exec",
@@ -2569,7 +2409,7 @@ const dockerCli = {
 	async healthy(composePath, services) {
 		if (services.length === 0) return true;
 		try {
-			const { stdout } = await run$1("docker", [
+			const { stdout } = await run("docker", [
 				"compose",
 				...composeFiles(composePath),
 				"ps",
@@ -3485,7 +3325,7 @@ function metroPorts(workspace, manifest) {
 	const ports = {};
 	for (const [id, declaration] of Object.entries(manifest)) {
 		if (declaration.kind !== "mobile-app") continue;
-		const port = workspace.apps[require_config.appKey(id)]?.port;
+		const port = workspace.apps[require_derive.appKey(id)]?.port;
 		if (port) ports[id] = port;
 	}
 	return ports;
@@ -3510,7 +3350,7 @@ function surfaceAddresses(workspace, manifest, at = (_app, port) => localAddress
 	const addresses = {};
 	for (const [id, declaration] of Object.entries(manifest)) {
 		if (declaration.kind !== "rest-api" && declaration.kind !== "site") continue;
-		const host = require_config.appKey(id);
+		const host = require_derive.appKey(id);
 		const port = workspace.apps[host]?.port;
 		if (port) addresses[id] = at(host, port);
 	}
@@ -3521,116 +3361,6 @@ function localAddress(port) {
 	return `http://localhost:${port}`;
 }
 //#endregion
-//#region src/run.ts
-/**
-* Start a program with an argument array, never a shell string.
-*
-* `gkm build`, `gkm docker` and `gkm deploy` pass values that come from the
-* workspace — image refs, tags, build args, package names — to `docker` and
-* `turbo`. Joined into a string and handed to a shell, a package named
-* `x;curl …|sh` or a tag holding `$(…)` became part of the command line, which
-* matters most where the CLI builds a repository it didn't write: a CI job for a
-* fork, a shared build runner. Here every value reaches the program as one
-* `argv` element, whatever it contains.
-*/
-/** Long enough for a cold image build; short enough that a hung one ends. */
-const DEFAULT_TIMEOUT_MS = 18e5;
-/** How long a timed-out child has to exit on SIGTERM before it is killed. */
-const KILL_GRACE_MS = 5e3;
-/** The command line as a person would read it — for messages, never to run. */
-function display(command, args) {
-	return [command, ...args].join(" ");
-}
-/** The program ran and exited unsuccessfully; its own output said why. */
-var CommandFailed = class extends Error {
-	command;
-	args;
-	exitCode;
-	signal;
-	constructor(command, args, exitCode, signal) {
-		super(`\`${display(command, args)}\` ${exitCode === null ? `was stopped by ${signal ?? "a signal"}` : `exited with code ${exitCode}`}. Its output above says why; run it by hand to see it again.`);
-		this.command = command;
-		this.args = args;
-		this.exitCode = exitCode;
-		this.signal = signal;
-		this.name = "CommandFailed";
-	}
-};
-/** The program ran past its timeout and was killed. */
-var CommandTimedOut = class extends Error {
-	command;
-	args;
-	timeoutMs;
-	constructor(command, args, timeoutMs) {
-		super(`\`${display(command, args)}\` was still running after ${Math.round(timeoutMs / 1e3)}s and was stopped. Check what it was waiting on — a registry, the Docker daemon, a prompt — and run it again.`);
-		this.command = command;
-		this.args = args;
-		this.timeoutMs = timeoutMs;
-		this.name = "CommandTimedOut";
-	}
-};
-/**
-* Run `command` with `args`, resolving when it exits 0.
-*
-* Rejects with {@link CommandFailed} on any other exit, {@link CommandTimedOut}
-* once `timeoutMs` passes (after the child is gone), and with the spawn error
-* itself when the program cannot be started at all — `ENOENT` already names it.
-*/
-async function run(command, args, options = {}) {
-	await spawnChild(command, args, options, false);
-}
-/**
-* {@link run}, resolving with what the program wrote to stdout — for a value
-* the CLI reads back, such as the digest `docker inspect` reports. stderr still
-* reaches the terminal, so a failure explains itself the same way.
-*/
-function runOutput(command, args, options = {}) {
-	return spawnChild(command, args, options, true);
-}
-function spawnChild(command, args, options, capture) {
-	const { timeoutMs = DEFAULT_TIMEOUT_MS, ...spawnOptions } = options;
-	return new Promise((resolve, reject) => {
-		const child = (0, node_child_process.spawn)(command, [...args], {
-			stdio: "inherit",
-			...spawnOptions,
-			...capture ? { stdio: [
-				"ignore",
-				"pipe",
-				"inherit"
-			] } : {},
-			shell: false
-		});
-		let stdout = "";
-		child.stdout?.on("data", (chunk) => {
-			stdout += chunk.toString();
-		});
-		let timedOut = false;
-		let killer;
-		const timer = setTimeout(() => {
-			timedOut = true;
-			child.kill("SIGTERM");
-			killer = setTimeout(() => child.kill("SIGKILL"), KILL_GRACE_MS);
-			killer.unref?.();
-		}, timeoutMs);
-		timer.unref?.();
-		const settle = () => {
-			clearTimeout(timer);
-			if (killer) clearTimeout(killer);
-		};
-		child.on("error", (error) => {
-			settle();
-			reject(spawnOptions.signal?.aborted ? spawnOptions.signal.reason : error);
-		});
-		child.on("close", (code, signal) => {
-			settle();
-			if (spawnOptions.signal?.aborted) reject(spawnOptions.signal.reason);
-			else if (timedOut) reject(new CommandTimedOut(command, args, timeoutMs));
-			else if (code === 0) resolve(stdout);
-			else reject(new CommandFailed(command, args, code, signal));
-		});
-	});
-}
-//#endregion
 //#region src/secrets/encryption.ts
 var encryption_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
 	encryptSecrets: () => encryptSecrets,
@@ -4055,17 +3785,17 @@ function isStateStore(value) {
 async function createStateStore(options) {
 	const { config, workspaceRoot, workspaceName } = options;
 	if (!config || config.provider === "local") {
-		const { LocalStateStore } = await Promise.resolve().then(() => require("./LocalStateStore-COW3Ldwa.cjs")).then((n) => n.LocalStateStore_exports);
+		const { LocalStateStore } = await Promise.resolve().then(() => require("./LocalStateStore-DiJqKyPy.cjs")).then((n) => n.LocalStateStore_exports);
 		return new LocalStateStore(workspaceRoot);
 	}
 	if (isStateStore(config.provider)) return config.provider;
 	if (isStateProvider(config.provider)) {
-		const { LegacyStateStore } = await Promise.resolve().then(() => require("./LegacyStateStore-UHJEBLdn.cjs"));
+		const { LegacyStateStore } = await Promise.resolve().then(() => require("./LegacyStateStore-C2abV49N.cjs"));
 		return new LegacyStateStore(config.provider, { warn: options.warn });
 	}
 	if (config.provider === "ssm") {
 		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("ssm");
-		const { SSMStateStore } = await Promise.resolve().then(() => require("./SSMStateStore-Zejt42V8.cjs"));
+		const { SSMStateStore } = await Promise.resolve().then(() => require("./SSMStateStore-CLipvx47.cjs"));
 		const ssm = config;
 		return SSMStateStore.create({
 			workspaceName,
@@ -4075,7 +3805,7 @@ async function createStateStore(options) {
 	}
 	if (config.provider === "s3") {
 		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("s3");
-		const { S3StateStore } = await Promise.resolve().then(() => require("./S3StateStore-WUJGdRNL.cjs"));
+		const { S3StateStore } = await Promise.resolve().then(() => require("./S3StateStore-Ds0V1Lgm.cjs"));
 		const s3 = config;
 		return S3StateStore.create({
 			workspaceName,
@@ -5259,7 +4989,7 @@ async function buildDockerImage(imageName, options, cwd) {
 	logger.log(`\n🐳 Building Docker image: ${fullImageName}`);
 	const cleanup = ensureLockfile(cwd);
 	try {
-		await run("docker", [
+		await require_local.run("docker", [
 			"build",
 			"--file=.gkm/docker/Dockerfile",
 			`--tag=${fullImageName}`,
@@ -5288,7 +5018,7 @@ async function pushDockerImage(imageName, options, cwd) {
 	const fullImageName = validateImageRef(`${registry}/${imageName}:${tag}`);
 	logger.log(`\n🚀 Pushing Docker image: ${fullImageName}`);
 	try {
-		await run("docker", ["push", fullImageName], { cwd });
+		await require_local.run("docker", ["push", fullImageName], { cwd });
 		logger.log(`✅ Docker image pushed: ${fullImageName}`);
 	} catch (error) {
 		throw new DockerPushFailed(fullImageName, error);
@@ -5391,7 +5121,7 @@ async function workspaceDockerCommand(workspace, manifest) {
 * leaving the bundle with an empty URL.
 */
 function siteDockerfile(appName, app, options) {
-	const declared = options.manifest ? Object.entries(options.manifest).find(([id, d]) => d.kind === "site" && require_config.appKey(id) === appName)?.[1] : void 0;
+	const declared = options.manifest ? Object.entries(options.manifest).find(([id, d]) => d.kind === "site" && require_derive.appKey(id) === appName)?.[1] : void 0;
 	const publicUrlArgs = declared?.kind === "site" && options.manifest ? Object.keys((0, _geekmidas_manifest.publicEnvFor)(declared, options.manifest)) : getPublicUrlArgNames(app);
 	const webOpts = {
 		imageName: appName,
@@ -6230,13 +5960,6 @@ var DokployApi = class {
 const __filename$1 = (0, node_url.fileURLToPath)(require("url").pathToFileURL(__filename).href);
 const __dirname$1 = (0, node_path.dirname)(__filename$1);
 /**
-* Resolve the tsx package path from the CLI package's dependencies.
-* This ensures tsx is available regardless of whether the target project has it installed.
-*/
-function resolveTsxPath() {
-	return (0, node_module.createRequire)(require("url").pathToFileURL(__filename).href).resolve("tsx");
-}
-/**
 * Resolve the path to a sniffer helper file.
 * Handles both dev (.ts with tsx) and production (.mjs from dist).
 *
@@ -6255,6 +5978,39 @@ function resolveSnifferFile(baseName) {
 	return tsPath;
 }
 /**
+* Run a sniffer worker in the sandbox, with the sandbox's environment and
+* nothing of the deploy's: the deploy's Dokploy token, registry login and AWS
+* keys stay where they are. A worker that outlives the timeout is killed, and
+* comes back as the error the caller reports.
+*/
+async function runSniffer(run, workspacePath, cwd, nodeArgs) {
+	const sandbox = run.sandbox ?? require_sandbox.activeSandbox() ?? new require_local.LocalSandbox({ root: (0, node_path.resolve)(workspacePath) });
+	try {
+		const result = await sandbox.exec("node", nodeArgs, {
+			cwd,
+			env: { ...sandbox.env },
+			timeoutMs: run.timeoutMs ?? 3e4,
+			output: "capture"
+		});
+		return {
+			stdout: result.stdout,
+			stderr: result.stderr,
+			code: result.exitCode
+		};
+	} catch (error) {
+		return { error: error instanceof Error ? error : new Error(String(error)) };
+	}
+}
+/** The worker's JSON answer: the last object on stdout naming `envVars`. */
+function snifferAnswer(stdout) {
+	try {
+		const jsonMatch = stdout.match(/\{[^{}]*"envVars"[^{}]*\}[^{]*$/);
+		return jsonMatch ? JSON.parse(jsonMatch[0]) : void 0;
+	} catch {
+		return;
+	}
+}
+/**
 * Get required environment variables for an app.
 *
 * Detection strategy (in order):
@@ -6276,6 +6032,10 @@ function resolveSnifferFile(baseName) {
 */
 async function sniffAppEnvironment(app, appName, workspacePath, options = {}) {
 	const { logWarnings = true, markOptional = false } = options;
+	const run = {
+		...options.sandbox ? { sandbox: options.sandbox } : {},
+		...options.timeoutMs ? { timeoutMs: options.timeoutMs } : {}
+	};
 	if (app.type === "web" || app.type === "mobile") {
 		const publicPrefix = require_workspace.getPublicEnvPrefix(app.framework);
 		const depVars = publicPrefix ? (app.dependencies ?? []).map((dep) => `${publicPrefix}${dep.toUpperCase()}_URL`) : [];
@@ -6286,7 +6046,7 @@ async function sniffAppEnvironment(app, appName, workspacePath, options = {}) {
 			if (app.config.client) configPaths.push(app.config.client);
 			if (app.config.server) configPaths.push(app.config.server);
 			for (const configPath of configPaths) {
-				const result = await sniffEntryFile(configPath, app.path, workspacePath);
+				const result = await sniffEntryFile(configPath, app.path, workspacePath, run);
 				if (logWarnings && result.error) require_discover.output.warn(`[sniffer] ${appName}: Config file "${configPath}" threw error during sniffing (env vars still captured): ${result.error.message}`);
 				sniffedVars.push(...result.envVars);
 				sniffedOptional.push(...result.optionalEnvVars);
@@ -6305,7 +6065,7 @@ async function sniffAppEnvironment(app, appName, workspacePath, options = {}) {
 		};
 	}
 	if (app.entry) {
-		const result = await sniffEntryFile(app.entry, app.path, workspacePath);
+		const result = await sniffEntryFile(app.entry, app.path, workspacePath, run);
 		if (logWarnings && result.error) require_discover.output.warn(`[sniffer] ${appName}: Entry file threw error during sniffing (env vars still captured): ${result.error.message}`);
 		return {
 			appName,
@@ -6314,7 +6074,7 @@ async function sniffAppEnvironment(app, appName, workspacePath, options = {}) {
 		};
 	}
 	if (app.routes) {
-		const result = await sniffRouteFiles(normalizeRoutes(app.routes), app.path, workspacePath);
+		const result = await sniffRouteFiles(normalizeRoutes(app.routes), app.path, workspacePath, run);
 		if (logWarnings && result.error) require_discover.output.warn(`[sniffer] ${appName}: Route sniffing threw error (env vars still captured): ${result.error.message}`);
 		return {
 			appName,
@@ -6323,7 +6083,7 @@ async function sniffAppEnvironment(app, appName, workspacePath, options = {}) {
 		};
 	}
 	if (app.envParser) {
-		const result = await sniffEnvParser(app.envParser, app.path, workspacePath);
+		const result = await sniffEnvParser(app.envParser, app.path, workspacePath, run);
 		if (logWarnings) {
 			if (result.error) require_discover.output.warn(`[sniffer] ${appName}: envParser threw error during sniffing (env vars still captured): ${result.error.message}`);
 			if (result.unhandledRejections.length > 0) require_discover.output.warn(`[sniffer] ${appName}: Fire-and-forget rejections during sniffing (suppressed): ${result.unhandledRejections.map((e) => e.message).join(", ")}`);
@@ -6368,63 +6128,27 @@ function applyMarkOptional(envVars, optionalEnvVars, markOptional) {
 * @param workspacePath - Absolute path to workspace root
 * @returns EntrySniffResult with env vars and optional error
 */
-async function sniffEntryFile(entryPath, appPath, workspacePath) {
+async function sniffEntryFile(entryPath, appPath, workspacePath, run = {}) {
 	const fullEntryPath = (0, node_path.resolve)(workspacePath, appPath, entryPath);
 	const loaderPath = resolveSnifferFile("sniffer-loader");
 	const workerPath = resolveSnifferFile("sniffer-worker");
-	return new Promise((resolvePromise) => {
-		const child = (0, node_child_process.spawn)("node", [
-			"--import",
-			loaderPath,
-			workerPath,
-			fullEntryPath
-		], {
-			cwd: (0, node_path.resolve)(workspacePath, appPath),
-			stdio: [
-				"ignore",
-				"pipe",
-				"pipe"
-			],
-			env: {
-				...process.env,
-				NODE_OPTIONS: withOwningTsconfigJsx("--import=tsx")
-			}
-		});
-		let stdout = "";
-		let stderr = "";
-		child.stdout.on("data", (data) => {
-			stdout += data.toString();
-		});
-		child.stderr.on("data", (data) => {
-			stderr += data.toString();
-		});
-		child.on("close", (code) => {
-			try {
-				const jsonMatch = stdout.match(/\{[^{}]*"envVars"[^{}]*\}[^{]*$/);
-				if (jsonMatch) {
-					const result = JSON.parse(jsonMatch[0]);
-					resolvePromise({
-						envVars: result.envVars || [],
-						optionalEnvVars: result.optionalEnvVars || [],
-						error: result.error ? new Error(result.error) : void 0
-					});
-					return;
-				}
-			} catch {}
-			resolvePromise({
-				envVars: [],
-				optionalEnvVars: [],
-				error: /* @__PURE__ */ new Error(`Failed to sniff entry file (exit code ${code}): ${stderr || stdout || "No output"}`)
-			});
-		});
-		child.on("error", (err) => {
-			resolvePromise({
-				envVars: [],
-				optionalEnvVars: [],
-				error: err
-			});
-		});
-	});
+	const ran = await runSniffer(run, workspacePath, (0, node_path.resolve)(workspacePath, appPath), require_discover.nodeWithTsx(workerPath, [fullEntryPath], [loaderPath]));
+	if ("error" in ran) return {
+		envVars: [],
+		optionalEnvVars: [],
+		error: ran.error
+	};
+	const answer = snifferAnswer(ran.stdout);
+	if (answer) return {
+		envVars: answer.envVars || [],
+		optionalEnvVars: answer.optionalEnvVars || [],
+		error: answer.error ? new Error(answer.error) : void 0
+	};
+	return {
+		envVars: [],
+		optionalEnvVars: [],
+		error: /* @__PURE__ */ new Error(`Failed to sniff entry file (exit code ${ran.code}): ${ran.stderr || ran.stdout || "No output"}`)
+	};
 }
 /**
 * Sniff route files by loading constructs and calling getEnvironment().
@@ -6440,116 +6164,79 @@ async function sniffEntryFile(entryPath, appPath, workspacePath) {
 * @param workspacePath - Absolute path to workspace root
 * @returns EntrySniffResult with env vars and optional error
 */
-async function sniffRouteFiles(routes, appPath, workspacePath) {
+async function sniffRouteFiles(routes, appPath, workspacePath, run = {}) {
 	const fullAppPath = (0, node_path.resolve)(workspacePath, appPath);
 	const workerPath = resolveSnifferFile("sniffer-routes-worker");
-	const tsxPath = resolveTsxPath();
 	const pattern = (Array.isArray(routes) ? routes : [routes])[0];
 	if (!pattern) return {
 		envVars: [],
 		optionalEnvVars: [],
 		error: /* @__PURE__ */ new Error("No route patterns provided")
 	};
-	return new Promise((resolvePromise) => {
-		const child = (0, node_child_process.spawn)("node", [
-			"--import",
-			tsxPath,
-			workerPath,
-			fullAppPath,
-			pattern
-		], {
-			cwd: fullAppPath,
-			stdio: [
-				"ignore",
-				"pipe",
-				"pipe"
-			],
-			env: { ...process.env }
-		});
-		let stdout = "";
-		let stderr = "";
-		child.stdout.on("data", (data) => {
-			stdout += data.toString();
-		});
-		child.stderr.on("data", (data) => {
-			stderr += data.toString();
-		});
-		child.on("close", (code) => {
-			if (stderr) stderr.split("\n").filter((line) => line.trim()).forEach((line) => require_discover.output.warn(line));
-			try {
-				const jsonMatch = stdout.match(/\{[^{}]*"envVars"[^{}]*\}[^{]*$/);
-				if (jsonMatch) {
-					const result = JSON.parse(jsonMatch[0]);
-					resolvePromise({
-						envVars: result.envVars || [],
-						optionalEnvVars: result.optionalEnvVars || [],
-						error: result.error ? new Error(result.error) : void 0
-					});
-					return;
-				}
-			} catch {}
-			resolvePromise({
-				envVars: [],
-				optionalEnvVars: [],
-				error: /* @__PURE__ */ new Error(`Failed to sniff route files (exit code ${code}): ${stderr || stdout || "No output"}`)
-			});
-		});
-		child.on("error", (err) => {
-			resolvePromise({
-				envVars: [],
-				optionalEnvVars: [],
-				error: err
-			});
-		});
-	});
+	const ran = await runSniffer(run, workspacePath, fullAppPath, require_discover.nodeWithTsx(workerPath, [fullAppPath, pattern]));
+	if ("error" in ran) return {
+		envVars: [],
+		optionalEnvVars: [],
+		error: ran.error
+	};
+	if (ran.stderr) ran.stderr.split("\n").filter((line) => line.trim()).forEach((line) => require_discover.output.warn(line));
+	const answer = snifferAnswer(ran.stdout);
+	if (answer) return {
+		envVars: answer.envVars || [],
+		optionalEnvVars: answer.optionalEnvVars || [],
+		error: answer.error ? new Error(answer.error) : void 0
+	};
+	return {
+		envVars: [],
+		optionalEnvVars: [],
+		error: /* @__PURE__ */ new Error(`Failed to sniff route files (exit code ${ran.code}): ${ran.stderr || ran.stdout || "No output"}`)
+	};
 }
 /**
 * Run the SnifferEnvironmentParser on an envParser module to detect
 * which environment variables it accesses.
 *
-* This function handles "fire and forget" async operations by using
-* the shared sniffWithFireAndForget utility from @geekmidas/envkit.
+* In a subprocess, like the entry and route sniffers: the module is the
+* project's code, and it was imported into the deploy itself before — with
+* every credential the deploy held in reach. Fire-and-forget rejections are
+* collected there with the shared `sniffWithFireAndForget`.
 *
 * @param envParserPath - The envParser config (e.g., './src/config/env#envParser')
 * @param appPath - The app's path relative to workspace
 * @param workspacePath - Absolute path to workspace root
 * @returns SniffResult with env vars and any errors encountered
 */
-async function sniffEnvParser(envParserPath, appPath, workspacePath) {
+async function sniffEnvParser(envParserPath, appPath, workspacePath, run = {}) {
 	const [modulePath, exportName = "default"] = envParserPath.split("#");
 	if (!modulePath) return {
 		envVars: [],
 		optionalEnvVars: [],
 		unhandledRejections: []
 	};
-	const fullPath = (0, node_path.resolve)(workspacePath, appPath, modulePath);
-	let SnifferEnvironmentParser;
-	let sniffWithFireAndForget;
-	try {
-		const envkitModule = await import("@geekmidas/envkit/sniffer");
-		SnifferEnvironmentParser = envkitModule.SnifferEnvironmentParser;
-		sniffWithFireAndForget = envkitModule.sniffWithFireAndForget;
-	} catch (error) {
-		const message = error instanceof Error ? error.message : String(error);
-		require_discover.output.warn(`[sniffer] Failed to import SnifferEnvironmentParser: ${message}`);
-		return {
-			envVars: [],
-			optionalEnvVars: [],
-			unhandledRejections: []
-		};
-	}
-	const sniffer = new SnifferEnvironmentParser();
-	return sniffWithFireAndForget(sniffer, async () => {
-		const envParser = (await import((0, node_url.pathToFileURL)(fullPath).href))[exportName];
-		if (typeof envParser !== "function") {
-			require_discover.output.warn(`[sniffer] Export "${exportName}" from "${modulePath}" is not a function`);
-			return;
-		}
-		const result = envParser(sniffer);
-		if (result && typeof result.parse === "function") try {
-			result.parse();
-		} catch {}
-	});
+	const appRoot = (0, node_path.resolve)(workspacePath, appPath);
+	const fullPath = (0, node_path.resolve)(appRoot, modulePath);
+	const workerPath = resolveSnifferFile("sniffer-envparser-worker");
+	const ran = await runSniffer(run, workspacePath, appRoot, require_discover.nodeWithTsx(workerPath, [fullPath, exportName]));
+	if ("error" in ran) return {
+		envVars: [],
+		optionalEnvVars: [],
+		unhandledRejections: [],
+		error: ran.error
+	};
+	const answer = snifferAnswer(ran.stdout);
+	if (!answer) return {
+		envVars: [],
+		optionalEnvVars: [],
+		unhandledRejections: [],
+		error: /* @__PURE__ */ new Error(`Failed to sniff envParser (exit code ${ran.code}): ${ran.stderr || ran.stdout || "No output"}`)
+	};
+	for (const warning of answer.warnings ?? []) require_discover.output.warn(warning);
+	return {
+		envVars: answer.envVars ?? [],
+		optionalEnvVars: answer.optionalEnvVars ?? [],
+		unhandledRejections: (answer.unhandledRejections ?? []).map((message) => new Error(message)),
+		...answer.error ? { error: new Error(answer.error) } : {}
+	};
 }
 /**
 * Sniff environment requirements for multiple apps.
@@ -6808,36 +6495,12 @@ Object.defineProperty(exports, "getBackupState", {
 		return getBackupState;
 	}
 });
-Object.defineProperty(exports, "getDokployCredentials", {
-	enumerable: true,
-	get: function() {
-		return getDokployCredentials;
-	}
-});
-Object.defineProperty(exports, "getDokployRegistryId", {
-	enumerable: true,
-	get: function() {
-		return getDokployRegistryId;
-	}
-});
-Object.defineProperty(exports, "getDokployToken", {
-	enumerable: true,
-	get: function() {
-		return getDokployToken;
-	}
-});
 Object.defineProperty(exports, "getGeneratedSecret", {
 	enumerable: true,
 	get: function() {
 		return getGeneratedSecret;
 	}
 });
-Object.defineProperty(exports, "getHostingerToken", {
-	enumerable: true,
-	get: function() {
-		return getHostingerToken;
-	}
-});
 Object.defineProperty(exports, "hostFor", {
 	enumerable: true,
 	get: function() {
@@ -6970,12 +6633,6 @@ Object.defineProperty(exports, "quoteIdentifier", {
 		return quoteIdentifier;
 	}
 });
-Object.defineProperty(exports, "readCredentials", {
-	enumerable: true,
-	get: function() {
-		return readCredentials;
-	}
-});
 Object.defineProperty(exports, "reconcileWorkspace", {
 	enumerable: true,
 	get: function() {
@@ -6994,18 +6651,6 @@ Object.defineProperty(exports, "resourceName", {
 		return resourceName;
 	}
 });
-Object.defineProperty(exports, "run", {
-	enumerable: true,
-	get: function() {
-		return run;
-	}
-});
-Object.defineProperty(exports, "runOutput", {
-	enumerable: true,
-	get: function() {
-		return runOutput;
-	}
-});
 Object.defineProperty(exports, "setApplicationId", {
 	enumerable: true,
 	get: function() {
@@ -7072,12 +6717,6 @@ Object.defineProperty(exports, "storageBackendFor", {
 		return storageBackendFor;
 	}
 });
-Object.defineProperty(exports, "storeDokployCredentials", {
-	enumerable: true,
-	get: function() {
-		return storeDokployCredentials;
-	}
-});
 Object.defineProperty(exports, "validateDokployToken", {
 	enumerable: true,
 	get: function() {
@@ -7102,12 +6741,6 @@ Object.defineProperty(exports, "withGeneratedSecrets", {
 		return withGeneratedSecrets;
 	}
 });
-Object.defineProperty(exports, "withOwningTsconfigJsx", {
-	enumerable: true,
-	get: function() {
-		return withOwningTsconfigJsx;
-	}
-});
 Object.defineProperty(exports, "workspace_exports", {
 	enumerable: true,
 	get: function() {
@@ -7115,4 +6748,4 @@ Object.defineProperty(exports, "workspace_exports", {
 	}
 });
 
-//# sourceMappingURL=sniffer-BsfPa-GA.cjs.map
+//# sourceMappingURL=sniffer-ByhbEW5A.cjs.map