@geekmidas/cli 10.0.0-alpha.63 → 10.0.0-alpha.64

package/dist/{sniffer-D_SYc_pO.cjs → sniffer-ByhbEW5A.cjs}

@@ -1,11 +1,13 @@
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
-const require_home = require("./home-DOzBaWaL.cjs");
-const require_discover = require("./discover-C_6COHEv.cjs");
-const require_config = require("./config-BEJYKd4s.cjs");
-const require_workspace = require("./workspace-Kl4NG9IH.cjs");
+const require_local = require("./local-C7wnrcYK.cjs");
+const require_discover = require("./discover-DHdECueV.cjs");
+const require_sandbox = require("./sandbox-CL--ZDui.cjs");
+const require_derive = require("./derive-DAbo49sm.cjs");
+const require_workspace = require("./workspace-BwgWJK7h.cjs");
+const require_config = require("./config.cjs");
 const require_storage = require("./storage-CSGoC3bK.cjs");
-const require_store = require("./store-KvNQwYaB.cjs");
-const require_runtime = require("./runtime-CMwtq0AL.cjs");
+const require_store = require("./store-D_2ByRtW.cjs");
+const require_runtime = require("./runtime-BGNDrHzh.cjs");
 const require_fakes = require("./fakes-zW-jNAbQ.cjs");
 let node_path = require("node:path");
 let node_process = require("node:process");
@@ -108,128 +110,6 @@ async function prompt(message, options) {
 	}
 }
 //#endregion
-//#region src/auth/credentials.ts
-/**
-* Get the path to the credentials directory
-*/
-function getCredentialsDir(options) {
-	if (options?.home) return options.home;
-	return options?.root ? (0, node_path.join)(options.root, ".gkm") : require_home.gkmHome();
-}
-/**
-* Get the path to the credentials file
-*/
-function getCredentialsPath(options) {
-	return (0, node_path.join)(getCredentialsDir(options), "credentials.json");
-}
-/**
-* Ensure the credentials directory exists
-*/
-function ensureCredentialsDir(options) {
-	const dir = getCredentialsDir(options);
-	if (!(0, node_fs.existsSync)(dir)) (0, node_fs.mkdirSync)(dir, {
-		recursive: true,
-		mode: 448
-	});
-}
-/**
-* Read stored credentials from disk
-*/
-async function readCredentials(options) {
-	const path = getCredentialsPath(options);
-	if (!(0, node_fs.existsSync)(path)) return {};
-	try {
-		const content = await (0, node_fs_promises.readFile)(path, "utf-8");
-		return JSON.parse(content);
-	} catch {
-		return {};
-	}
-}
-/**
-* Write credentials to disk
-*/
-async function writeCredentials(credentials, options) {
-	ensureCredentialsDir(options);
-	const path = getCredentialsPath(options);
-	await (0, node_fs_promises.writeFile)(path, JSON.stringify(credentials, null, 2), { mode: 384 });
-}
-/**
-* Store Dokploy credentials
-*/
-async function storeDokployCredentials(token, endpoint, options) {
-	const credentials = await readCredentials(options);
-	credentials.dokploy = {
-		token,
-		endpoint,
-		storedAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-	await writeCredentials(credentials, options);
-}
-/**
-* Get stored Dokploy credentials
-*/
-async function getDokployCredentials(options) {
-	const credentials = await readCredentials(options);
-	const token = process.env.DOKPLOY_API_TOKEN ?? credentials.dokploy?.token;
-	const endpoint = process.env.DOKPLOY_ENDPOINT ?? credentials.dokploy?.endpoint;
-	if (!token || !endpoint) return null;
-	return {
-		token,
-		endpoint: endpoint.replace(/\/$/, ""),
-		...credentials.dokploy?.registryId ? { registryId: credentials.dokploy.registryId } : {}
-	};
-}
-/**
-* Remove Dokploy credentials
-*/
-async function removeDokployCredentials(options) {
-	const credentials = await readCredentials(options);
-	if (!credentials.dokploy) return false;
-	delete credentials.dokploy;
-	await writeCredentials(credentials, options);
-	return true;
-}
-/**
-* Get Dokploy API token, checking stored credentials first, then environment
-*/
-async function getDokployToken(options) {
-	const envToken = process.env.DOKPLOY_API_TOKEN;
-	if (envToken) return envToken;
-	const stored = await getDokployCredentials(options);
-	if (stored) return stored.token;
-	return null;
-}
-/**
-* Get Dokploy registry ID from stored credentials
-*/
-async function getDokployRegistryId(options) {
-	return (await getDokployCredentials(options))?.registryId ?? void 0;
-}
-/**
-* Store Hostinger API token
-*
-* @param token - API token from hpanel.hostinger.com/profile/api
-*/
-async function storeHostingerToken(token, options) {
-	const credentials = await readCredentials(options);
-	credentials.hostinger = {
-		token,
-		storedAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-	await writeCredentials(credentials, options);
-}
-/**
-* Get stored Hostinger API token
-*
-* Checks environment variable first (HOSTINGER_API_TOKEN),
-* then falls back to stored credentials.
-*/
-async function getHostingerToken(options) {
-	const envToken = process.env.HOSTINGER_API_TOKEN;
-	if (envToken) return envToken;
-	return (await readCredentials(options)).hostinger?.token ?? null;
-}
-//#endregion
 //#region src/auth/index.ts
 const logger$2 = console;
 /**
@@ -277,10 +157,10 @@ async function loginCommand(options) {
 			logger$2.error("\n✗ Invalid credentials. Please check your token and try again.");
 			process.exit(1);
 		}
-		await storeDokployCredentials(token, endpoint);
+		await require_local.storeDokployCredentials(token, endpoint);
 		logger$2.log("\n✓ Successfully logged in to Dokploy!");
 		logger$2.log(`  Endpoint: ${endpoint}`);
-		logger$2.log(`  Credentials stored in: ${getCredentialsPath()}`);
+		logger$2.log(`  Credentials stored in: ${require_local.getCredentialsPath()}`);
 		logger$2.log("\nYou can now use deploy commands without setting DOKPLOY_API_TOKEN.");
 	}
 	if (provider === "hostinger") {
@@ -297,9 +177,9 @@ async function loginCommand(options) {
 			logger$2.error("Token is required");
 			process.exit(1);
 		}
-		await storeHostingerToken(token);
+		await require_local.storeHostingerToken(token);
 		logger$2.log("\n✓ Hostinger token stored.");
-		logger$2.log(`  Credentials stored in: ${getCredentialsPath()}`);
+		logger$2.log(`  Credentials stored in: ${require_local.getCredentialsPath()}`);
 		logger$2.log("  Not validated here: every DNS endpoint is scoped to a domain, so the\n  first deploy that touches DNS is where a bad token reports itself.");
 		logger$2.log("\nYou can now use it as a DNS provider without setting HOSTINGER_API_TOKEN.");
 	}
@@ -310,12 +190,12 @@ async function loginCommand(options) {
 async function logoutCommand(options) {
 	const { provider = "dokploy" } = options;
 	if (provider === "all") {
-		if (await removeDokployCredentials()) logger$2.log("\n✓ Logged out from all services");
+		if (await require_local.removeDokployCredentials()) logger$2.log("\n✓ Logged out from all services");
 		else logger$2.log("\nNo stored credentials found");
 		return;
 	}
 	if (provider === "dokploy") {
-		if (await removeDokployCredentials()) logger$2.log("\n✓ Logged out from Dokploy");
+		if (await require_local.removeDokployCredentials()) logger$2.log("\n✓ Logged out from Dokploy");
 		else logger$2.log("\nNo Dokploy credentials found");
 	}
 }
@@ -324,13 +204,13 @@ async function logoutCommand(options) {
 */
 async function whoamiCommand() {
 	logger$2.log("\n📋 Current credentials:\n");
-	const dokploy = await getDokployCredentials();
+	const dokploy = await require_local.getDokployCredentials();
 	if (dokploy) {
 		logger$2.log("  Dokploy:");
 		logger$2.log(`    Endpoint: ${dokploy.endpoint}`);
 		logger$2.log(`    Token: ${maskToken(dokploy.token)}`);
 	} else logger$2.log("  Dokploy: Not logged in");
-	logger$2.log(`\n  Credentials file: ${getCredentialsPath()}`);
+	logger$2.log(`\n  Credentials file: ${require_local.getCredentialsPath()}`);
 }
 /**
 * Mask a token for display
@@ -1308,11 +1188,11 @@ function planFor(manifest, stage, order, options = {}) {
 	const root = rootSite(sites.map((r) => {
 		const declared = manifest[r.id];
 		return {
-			name: require_config.appKey(r.id),
+			name: require_derive.appKey(r.id),
 			...declared?.kind === "site" && declared.root ? { root: true } : {}
 		};
 	}));
-	for (const site of sites) if (require_config.appKey(site.id) === root) site.root = true;
+	for (const site of sites) if (require_derive.appKey(site.id) === root) site.root = true;
 	const workerBroker = events === "pgboss" && Object.values(manifest).some((d) => d?.kind === "worker") && resources.some((r) => r.kind === "database");
 	return {
 		stage,
@@ -1866,7 +1746,7 @@ function localPlan(workspace, manifest, fakes = {}) {
 * host's port for each app, never a name on the compose network.
 */
 function sitePublicArgs(manifest, appName, env) {
-	const declaration = Object.entries(manifest).find(([id, d]) => d.kind === "site" && require_config.appKey(id) === appName)?.[1];
+	const declaration = Object.entries(manifest).find(([id, d]) => d.kind === "site" && require_derive.appKey(id) === appName)?.[1];
 	if (declaration?.kind !== "site") return {};
 	const args = {};
 	for (const key of Object.keys((0, _geekmidas_manifest.publicEnvFor)(declaration, manifest))) {
@@ -1922,7 +1802,7 @@ function networkEnv(plan, options) {
 * port.
 */
 function appEnvKeys(manifest, appName, runnables = {}) {
-	const entry = Object.entries(manifest).find(([id, d]) => (d.kind === "rest-api" || d.kind === "site" || d.kind === "mobile-app") && require_config.appKey(id) === appName);
+	const entry = Object.entries(manifest).find(([id, d]) => (d.kind === "rest-api" || d.kind === "site" || d.kind === "mobile-app") && require_derive.appKey(id) === appName);
 	if (!entry) return void 0;
 	const [id, declaration] = entry;
 	const keys = /* @__PURE__ */ new Set([
@@ -1971,7 +1851,7 @@ function appServices(workspace, manifest, containers, runnables = {}, fakes = {}
 	const services = {};
 	for (const [name, app] of Object.entries(workspace.apps)) {
 		if (app.type === "mobile" || !app.port) continue;
-		const key = require_config.appKey(name);
+		const key = require_derive.appKey(name);
 		const health = app.type === "web" ? "/" : "/health";
 		const dockerfile = dockerfileOf(name, app.path);
 		const ports = [`${app.port}:${app.port}`];
@@ -2433,7 +2313,7 @@ var UnassignedPort = class extends Error {
 * Every call is scoped to the generated compose file. Nothing here can touch a
 * container this project did not generate.
 */
-const run$1 = (0, node_util.promisify)(node_child_process.execFile);
+const run = (0, node_util.promisify)(node_child_process.execFile);
 /**
 * The generated file, then the project's own if it has one.
 *
@@ -2476,7 +2356,7 @@ function shown(args, services) {
 const dockerCli = {
 	async publishedPort(composePath, service, inside) {
 		try {
-			const { stdout } = await run$1("docker", [
+			const { stdout } = await run("docker", [
 				"compose",
 				...composeFiles(composePath),
 				"port",
@@ -2501,11 +2381,11 @@ const dockerCli = {
 			...services
 		];
 		if (options.show) return shown(args, services);
-		await run$1("docker", args);
+		await run("docker", args);
 	},
 	async copyOut(composePath, service, from, to) {
 		await (0, node_fs_promises.mkdir)((0, node_path.dirname)(to), { recursive: true });
-		await run$1("docker", [
+		await run("docker", [
 			"compose",
 			...composeFiles(composePath),
 			"cp",
@@ -2514,7 +2394,7 @@ const dockerCli = {
 		]);
 	},
 	async reload(composePath, service) {
-		await run$1("docker", [
+		await run("docker", [
 			"compose",
 			...composeFiles(composePath),
 			"exec",
@@ -2529,7 +2409,7 @@ const dockerCli = {
 	async healthy(composePath, services) {
 		if (services.length === 0) return true;
 		try {
-			const { stdout } = await run$1("docker", [
+			const { stdout } = await run("docker", [
 				"compose",
 				...composeFiles(composePath),
 				"ps",
@@ -3445,7 +3325,7 @@ function metroPorts(workspace, manifest) {
 	const ports = {};
 	for (const [id, declaration] of Object.entries(manifest)) {
 		if (declaration.kind !== "mobile-app") continue;
-		const port = workspace.apps[require_config.appKey(id)]?.port;
+		const port = workspace.apps[require_derive.appKey(id)]?.port;
 		if (port) ports[id] = port;
 	}
 	return ports;
@@ -3470,7 +3350,7 @@ function surfaceAddresses(workspace, manifest, at = (_app, port) => localAddress
 	const addresses = {};
 	for (const [id, declaration] of Object.entries(manifest)) {
 		if (declaration.kind !== "rest-api" && declaration.kind !== "site") continue;
-		const host = require_config.appKey(id);
+		const host = require_derive.appKey(id);
 		const port = workspace.apps[host]?.port;
 		if (port) addresses[id] = at(host, port);
 	}
@@ -3481,331 +3361,6 @@ function localAddress(port) {
 	return `http://localhost:${port}`;
 }
 //#endregion
-//#region src/run.ts
-/**
-* Start a program with an argument array, never a shell string.
-*
-* `gkm build`, `gkm docker` and `gkm deploy` pass values that come from the
-* workspace — image refs, tags, build args, package names — to `docker` and
-* `turbo`. Joined into a string and handed to a shell, a package named
-* `x;curl …|sh` or a tag holding `$(…)` became part of the command line, which
-* matters most where the CLI builds a repository it didn't write: a CI job for a
-* fork, a shared build runner. Here every value reaches the program as one
-* `argv` element, whatever it contains.
-*/
-/** Long enough for a cold image build; short enough that a hung one ends. */
-const DEFAULT_TIMEOUT_MS = 18e5;
-/** How long a timed-out child has to exit on SIGTERM before it is killed. */
-const KILL_GRACE_MS$1 = 5e3;
-/** The command line as a person would read it — for messages, never to run. */
-function display(command, args) {
-	return [command, ...args].join(" ");
-}
-/** The program ran and exited unsuccessfully; its own output said why. */
-var CommandFailed = class extends Error {
-	command;
-	args;
-	exitCode;
-	signal;
-	constructor(command, args, exitCode, signal) {
-		super(`\`${display(command, args)}\` ${exitCode === null ? `was stopped by ${signal ?? "a signal"}` : `exited with code ${exitCode}`}. Its output above says why; run it by hand to see it again.`);
-		this.command = command;
-		this.args = args;
-		this.exitCode = exitCode;
-		this.signal = signal;
-		this.name = "CommandFailed";
-	}
-};
-/** The program ran past its timeout and was killed. */
-var CommandTimedOut = class extends Error {
-	command;
-	args;
-	timeoutMs;
-	constructor(command, args, timeoutMs) {
-		super(`\`${display(command, args)}\` was still running after ${Math.round(timeoutMs / 1e3)}s and was stopped. Check what it was waiting on — a registry, the Docker daemon, a prompt — and run it again.`);
-		this.command = command;
-		this.args = args;
-		this.timeoutMs = timeoutMs;
-		this.name = "CommandTimedOut";
-	}
-};
-/**
-* Run `command` with `args`, resolving when it exits 0.
-*
-* Rejects with {@link CommandFailed} on any other exit, {@link CommandTimedOut}
-* once `timeoutMs` passes (after the child is gone), and with the spawn error
-* itself when the program cannot be started at all — `ENOENT` already names it.
-*/
-async function run(command, args, options = {}) {
-	await spawnChild(command, args, options, false);
-}
-/**
-* {@link run}, resolving with what the program wrote to stdout — for a value
-* the CLI reads back, such as the digest `docker inspect` reports. stderr still
-* reaches the terminal, so a failure explains itself the same way.
-*/
-function runOutput(command, args, options = {}) {
-	return spawnChild(command, args, options, true);
-}
-function spawnChild(command, args, options, capture) {
-	const { timeoutMs = DEFAULT_TIMEOUT_MS, ...spawnOptions } = options;
-	return new Promise((resolve, reject) => {
-		const child = (0, node_child_process.spawn)(command, [...args], {
-			stdio: "inherit",
-			...spawnOptions,
-			...capture ? { stdio: [
-				"ignore",
-				"pipe",
-				"inherit"
-			] } : {},
-			shell: false
-		});
-		let stdout = "";
-		child.stdout?.on("data", (chunk) => {
-			stdout += chunk.toString();
-		});
-		let timedOut = false;
-		let killer;
-		const timer = setTimeout(() => {
-			timedOut = true;
-			child.kill("SIGTERM");
-			killer = setTimeout(() => child.kill("SIGKILL"), KILL_GRACE_MS$1);
-			killer.unref?.();
-		}, timeoutMs);
-		timer.unref?.();
-		const settle = () => {
-			clearTimeout(timer);
-			if (killer) clearTimeout(killer);
-		};
-		child.on("error", (error) => {
-			settle();
-			reject(spawnOptions.signal?.aborted ? spawnOptions.signal.reason : error);
-		});
-		child.on("close", (code, signal) => {
-			settle();
-			if (spawnOptions.signal?.aborted) reject(spawnOptions.signal.reason);
-			else if (timedOut) reject(new CommandTimedOut(command, args, timeoutMs));
-			else if (code === 0) resolve(stdout);
-			else reject(new CommandFailed(command, args, code, signal));
-		});
-	});
-}
-//#endregion
-//#region src/sandbox/env.ts
-/**
-* What of the host's environment a local sandbox passes on.
-*
-* An allowlist, not a denylist: a credential's variable has any name its
-* owner chose (`DOKPLOY_TOKEN`, `AWS_SECRET_ACCESS_KEY`, `MY_VAULT_TOKEN`), so
-* the only safe default is to name what a program needs to *run* and pass
-* nothing else.
-*/
-/**
-* Variables a command needs to find programs, write temp files, print in the
-* user's locale and reach the network through the host's proxy — and nothing
-* that authenticates as anyone.
-*
-* Deliberately left out:
-* - `NODE_OPTIONS`: it can `--require` or `--import` code into every node
-*   process, and CI often holds `--import tsx` there. A step that needs a
-*   loader passes its own.
-* - `NODE_AUTH_TOKEN`, `NPM_TOKEN`, `npm_config_*`: registry tokens
-*   (`actions/setup-node` writes `NODE_AUTH_TOKEN`), which is why there is no
-*   `NODE_*` wildcard.
-* - `AWS_*`, `DOCKER_*`, `DOKPLOY_*`, `GITHUB_TOKEN`, `TURBO_TOKEN`, `GKM_*`:
-*   credentials, or where the deploy keeps them.
-* - `SHELL`, `EDITOR` and the rest of a login session: nothing here starts a
-*   shell.
-*
-* Proxies are passed: behind one, nothing installs or builds without it. A
-* proxy URL with a password in it reaches the command too — a host that keeps
-* one there and builds code it does not trust should pass a sandbox of its
-* own.
-*/
-const SANDBOX_ENV_ALLOWLIST = [
-	"PATH",
-	"HOME",
-	"USER",
-	"LOGNAME",
-	"TMPDIR",
-	"TMP",
-	"TEMP",
-	"LANG",
-	"LANGUAGE",
-	"TZ",
-	/^LC_[A-Z]+$/,
-	"TERM",
-	"COLORTERM",
-	"NO_COLOR",
-	"FORCE_COLOR",
-	"CI",
-	"NODE_ENV",
-	"NODE_EXTRA_CA_CERTS",
-	"COREPACK_HOME",
-	"PNPM_HOME",
-	"XDG_CACHE_HOME",
-	"XDG_DATA_HOME",
-	"HTTP_PROXY",
-	"HTTPS_PROXY",
-	"NO_PROXY",
-	"http_proxy",
-	"https_proxy",
-	"no_proxy",
-	"SystemRoot",
-	"SYSTEMROOT",
-	"windir",
-	"WINDIR",
-	"ComSpec",
-	"COMSPEC",
-	"PATHEXT",
-	"USERPROFILE",
-	"APPDATA",
-	"LOCALAPPDATA"
-];
-function allowed(name) {
-	return SANDBOX_ENV_ALLOWLIST.some((entry) => typeof entry === "string" ? entry === name : entry.test(name));
-}
-/**
-* The allowlisted part of `source`, plus each of `extra` the host chose to
-* pass on by name.
-*/
-function allowlistedEnv(source = process.env, extra = []) {
-	const env = {};
-	for (const [name, value] of Object.entries(source)) {
-		if (value === void 0) continue;
-		if (allowed(name) || extra.includes(name)) env[name] = value;
-	}
-	return env;
-}
-//#endregion
-//#region src/sandbox/local.ts
-/** How long a timed-out command has to exit on SIGTERM before SIGKILL. */
-const KILL_GRACE_MS = 5e3;
-/** Where `output` sends a child's streams. */
-const STDIO = {
-	capture: [
-		"ignore",
-		"pipe",
-		"pipe"
-	],
-	inherit: "inherit",
-	stderr: [
-		"ignore",
-		2,
-		2
-	],
-	ignore: "ignore"
-};
-/**
-* A child process on this machine, as this user, with an allowlisted
-* environment.
-*
-* What it withholds from the command: the host's environment beyond
-* {@link SANDBOX_ENV_ALLOWLIST}, a shell, a working directory outside the
-* project, and any time past the timeout. What it does not: the host's
-* filesystem, which the command can read and write as the user running the
-* deploy. So it is not `isolating`, and it is the default for projects the
-* host already trusts — the developer's own, a team's own CI. Code nobody
-* vetted belongs in a sandbox that is.
-*
-* A timed-out command is sent SIGTERM, then SIGKILL; processes it started
-* itself are its to stop.
-*/
-var LocalSandbox = class {
-	root;
-	isolating = false;
-	env;
-	constructor(options) {
-		this.root = (0, node_path.resolve)(options.root);
-		this.env = {
-			...allowlistedEnv(options.hostEnv ?? process.env, options.passEnv),
-			...options.home ? {
-				HOME: options.home,
-				USERPROFILE: options.home
-			} : {}
-		};
-	}
-	async exec(command, args, options) {
-		const cwd = require_discover.confineCwd(this.root, options.cwd);
-		require_discover.assertSecretNames(options.secrets);
-		options.signal?.throwIfAborted();
-		const secretsDir = await mountSecrets(options.secrets);
-		try {
-			return await spawnConfined(command, args, {
-				...options,
-				cwd,
-				env: secretsDir ? {
-					...options.env,
-					[require_discover.SECRETS_DIR_ENV]: secretsDir
-				} : options.env
-			});
-		} finally {
-			if (secretsDir) await (0, node_fs_promises.rm)(secretsDir, {
-				recursive: true,
-				force: true
-			});
-		}
-	}
-};
-/**
-* Each secret as a 0600 file in a fresh 0700 directory outside the project —
-* where nothing the build writes, packs or commits will pick it up.
-*/
-async function mountSecrets(secrets) {
-	if (!secrets || Object.keys(secrets).length === 0) return void 0;
-	const dir = await (0, node_fs_promises.mkdtemp)((0, node_path.join)((0, node_os.tmpdir)(), "gkm-secrets-"));
-	for (const [name, value] of Object.entries(secrets)) await (0, node_fs_promises.writeFile)((0, node_path.join)(dir, name), value, { mode: 384 });
-	return dir;
-}
-function spawnConfined(command, args, options) {
-	const { output = "capture", signal, timeoutMs } = options;
-	return new Promise((resolvePromise, reject) => {
-		const child = (0, node_child_process.spawn)(command, [...args], {
-			cwd: options.cwd,
-			env: { ...options.env },
-			stdio: STDIO[output],
-			shell: false,
-			...signal ? { signal } : {}
-		});
-		let stdout = "";
-		let stderr = "";
-		child.stdout?.on("data", (chunk) => {
-			stdout += chunk.toString();
-		});
-		child.stderr?.on("data", (chunk) => {
-			stderr += chunk.toString();
-		});
-		let timedOut = false;
-		let killer;
-		const timer = setTimeout(() => {
-			timedOut = true;
-			child.kill("SIGTERM");
-			killer = setTimeout(() => child.kill("SIGKILL"), KILL_GRACE_MS);
-			killer.unref?.();
-		}, timeoutMs);
-		timer.unref?.();
-		const settle = () => {
-			clearTimeout(timer);
-			if (killer) clearTimeout(killer);
-		};
-		child.on("error", (error) => {
-			settle();
-			reject(signal?.aborted ? signal.reason : error);
-		});
-		child.on("close", (code, killedBy) => {
-			settle();
-			if (signal?.aborted) reject(signal.reason);
-			else if (timedOut) reject(new CommandTimedOut(command, args, timeoutMs));
-			else resolvePromise({
-				exitCode: code,
-				signal: killedBy ?? null,
-				stdout,
-				stderr
-			});
-		});
-	});
-}
-//#endregion
 //#region src/secrets/encryption.ts
 var encryption_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
 	encryptSecrets: () => encryptSecrets,
@@ -4230,17 +3785,17 @@ function isStateStore(value) {
 async function createStateStore(options) {
 	const { config, workspaceRoot, workspaceName } = options;
 	if (!config || config.provider === "local") {
-		const { LocalStateStore } = await Promise.resolve().then(() => require("./LocalStateStore-sS8mvLeq.cjs")).then((n) => n.LocalStateStore_exports);
+		const { LocalStateStore } = await Promise.resolve().then(() => require("./LocalStateStore-DiJqKyPy.cjs")).then((n) => n.LocalStateStore_exports);
 		return new LocalStateStore(workspaceRoot);
 	}
 	if (isStateStore(config.provider)) return config.provider;
 	if (isStateProvider(config.provider)) {
-		const { LegacyStateStore } = await Promise.resolve().then(() => require("./LegacyStateStore-CP7SZwTP.cjs"));
+		const { LegacyStateStore } = await Promise.resolve().then(() => require("./LegacyStateStore-C2abV49N.cjs"));
 		return new LegacyStateStore(config.provider, { warn: options.warn });
 	}
 	if (config.provider === "ssm") {
 		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("ssm");
-		const { SSMStateStore } = await Promise.resolve().then(() => require("./SSMStateStore-B__F7IJa.cjs"));
+		const { SSMStateStore } = await Promise.resolve().then(() => require("./SSMStateStore-CLipvx47.cjs"));
 		const ssm = config;
 		return SSMStateStore.create({
 			workspaceName,
@@ -4250,7 +3805,7 @@ async function createStateStore(options) {
 	}
 	if (config.provider === "s3") {
 		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("s3");
-		const { S3StateStore } = await Promise.resolve().then(() => require("./S3StateStore-6jqITH2F.cjs"));
+		const { S3StateStore } = await Promise.resolve().then(() => require("./S3StateStore-Ds0V1Lgm.cjs"));
 		const s3 = config;
 		return S3StateStore.create({
 			workspaceName,
@@ -5434,7 +4989,7 @@ async function buildDockerImage(imageName, options, cwd) {
 	logger.log(`\n🐳 Building Docker image: ${fullImageName}`);
 	const cleanup = ensureLockfile(cwd);
 	try {
-		await run("docker", [
+		await require_local.run("docker", [
 			"build",
 			"--file=.gkm/docker/Dockerfile",
 			`--tag=${fullImageName}`,
@@ -5463,7 +5018,7 @@ async function pushDockerImage(imageName, options, cwd) {
 	const fullImageName = validateImageRef(`${registry}/${imageName}:${tag}`);
 	logger.log(`\n🚀 Pushing Docker image: ${fullImageName}`);
 	try {
-		await run("docker", ["push", fullImageName], { cwd });
+		await require_local.run("docker", ["push", fullImageName], { cwd });
 		logger.log(`✅ Docker image pushed: ${fullImageName}`);
 	} catch (error) {
 		throw new DockerPushFailed(fullImageName, error);
@@ -5566,7 +5121,7 @@ async function workspaceDockerCommand(workspace, manifest) {
 * leaving the bundle with an empty URL.
 */
 function siteDockerfile(appName, app, options) {
-	const declared = options.manifest ? Object.entries(options.manifest).find(([id, d]) => d.kind === "site" && require_config.appKey(id) === appName)?.[1] : void 0;
+	const declared = options.manifest ? Object.entries(options.manifest).find(([id, d]) => d.kind === "site" && require_derive.appKey(id) === appName)?.[1] : void 0;
 	const publicUrlArgs = declared?.kind === "site" && options.manifest ? Object.keys((0, _geekmidas_manifest.publicEnvFor)(declared, options.manifest)) : getPublicUrlArgNames(app);
 	const webOpts = {
 		imageName: appName,
@@ -6429,7 +5984,7 @@ function resolveSnifferFile(baseName) {
 * comes back as the error the caller reports.
 */
 async function runSniffer(run, workspacePath, cwd, nodeArgs) {
-	const sandbox = run.sandbox ?? require_discover.activeSandbox() ?? new LocalSandbox({ root: (0, node_path.resolve)(workspacePath) });
+	const sandbox = run.sandbox ?? require_sandbox.activeSandbox() ?? new require_local.LocalSandbox({ root: (0, node_path.resolve)(workspacePath) });
 	try {
 		const result = await sandbox.exec("node", nodeArgs, {
 			cwd,
@@ -6700,30 +6255,12 @@ async function sniffAllApps(apps, workspacePath, options = {}) {
 	return results;
 }
 //#endregion
-Object.defineProperty(exports, "CommandFailed", {
-	enumerable: true,
-	get: function() {
-		return CommandFailed;
-	}
-});
-Object.defineProperty(exports, "CommandTimedOut", {
-	enumerable: true,
-	get: function() {
-		return CommandTimedOut;
-	}
-});
 Object.defineProperty(exports, "DEFAULT_IMAGES", {
 	enumerable: true,
 	get: function() {
 		return DEFAULT_IMAGES;
 	}
 });
-Object.defineProperty(exports, "DEFAULT_TIMEOUT_MS", {
-	enumerable: true,
-	get: function() {
-		return DEFAULT_TIMEOUT_MS;
-	}
-});
 Object.defineProperty(exports, "DockerBuildFailed", {
 	enumerable: true,
 	get: function() {
@@ -6766,18 +6303,6 @@ Object.defineProperty(exports, "LOCAL_CA_PATH", {
 		return LOCAL_CA_PATH;
 	}
 });
-Object.defineProperty(exports, "LocalSandbox", {
-	enumerable: true,
-	get: function() {
-		return LocalSandbox;
-	}
-});
-Object.defineProperty(exports, "SANDBOX_ENV_ALLOWLIST", {
-	enumerable: true,
-	get: function() {
-		return SANDBOX_ENV_ALLOWLIST;
-	}
-});
 Object.defineProperty(exports, "StageStateMissing", {
 	enumerable: true,
 	get: function() {
@@ -6808,12 +6333,6 @@ Object.defineProperty(exports, "StateVersionConflict", {
 		return StateVersionConflict;
 	}
 });
-Object.defineProperty(exports, "allowlistedEnv", {
-	enumerable: true,
-	get: function() {
-		return allowlistedEnv;
-	}
-});
 Object.defineProperty(exports, "appEnvKeys", {
 	enumerable: true,
 	get: function() {
@@ -6976,36 +6495,12 @@ Object.defineProperty(exports, "getBackupState", {
 		return getBackupState;
 	}
 });
-Object.defineProperty(exports, "getDokployCredentials", {
-	enumerable: true,
-	get: function() {
-		return getDokployCredentials;
-	}
-});
-Object.defineProperty(exports, "getDokployRegistryId", {
-	enumerable: true,
-	get: function() {
-		return getDokployRegistryId;
-	}
-});
-Object.defineProperty(exports, "getDokployToken", {
-	enumerable: true,
-	get: function() {
-		return getDokployToken;
-	}
-});
 Object.defineProperty(exports, "getGeneratedSecret", {
 	enumerable: true,
 	get: function() {
 		return getGeneratedSecret;
 	}
 });
-Object.defineProperty(exports, "getHostingerToken", {
-	enumerable: true,
-	get: function() {
-		return getHostingerToken;
-	}
-});
 Object.defineProperty(exports, "hostFor", {
 	enumerable: true,
 	get: function() {
@@ -7138,12 +6633,6 @@ Object.defineProperty(exports, "quoteIdentifier", {
 		return quoteIdentifier;
 	}
 });
-Object.defineProperty(exports, "readCredentials", {
-	enumerable: true,
-	get: function() {
-		return readCredentials;
-	}
-});
 Object.defineProperty(exports, "reconcileWorkspace", {
 	enumerable: true,
 	get: function() {
@@ -7162,18 +6651,6 @@ Object.defineProperty(exports, "resourceName", {
 		return resourceName;
 	}
 });
-Object.defineProperty(exports, "run", {
-	enumerable: true,
-	get: function() {
-		return run;
-	}
-});
-Object.defineProperty(exports, "runOutput", {
-	enumerable: true,
-	get: function() {
-		return runOutput;
-	}
-});
 Object.defineProperty(exports, "setApplicationId", {
 	enumerable: true,
 	get: function() {
@@ -7240,12 +6717,6 @@ Object.defineProperty(exports, "storageBackendFor", {
 		return storageBackendFor;
 	}
 });
-Object.defineProperty(exports, "storeDokployCredentials", {
-	enumerable: true,
-	get: function() {
-		return storeDokployCredentials;
-	}
-});
 Object.defineProperty(exports, "validateDokployToken", {
 	enumerable: true,
 	get: function() {
@@ -7277,4 +6748,4 @@ Object.defineProperty(exports, "workspace_exports", {
 	}
 });
 
-//# sourceMappingURL=sniffer-D_SYc_pO.cjs.map
+//# sourceMappingURL=sniffer-ByhbEW5A.cjs.map