c8y-nitro 0.7.1 → 0.8.0

package/dist/autoBootstrap-Drk7ltXK.mjs

@@ -0,0 +1,212 @@
+import { a as findMicroserviceByName, d as updateMicroservice, l as subscribeToApplication, n as createBasicAuthHeader, o as getBootstrapCredentials, p as createC8yManifest, r as createMicroservice } from "./c8y-api-DscUs-Kd.mjs";
+import { t as writeBootstrapCredentials } from "./env-file-BrOTmVjA.mjs";
+import { join } from "node:path";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { createHash } from "node:crypto";
+import process from "node:process";
+//#region src/module/manifestCache.ts
+/**
+* Directory (inside the project's `node_modules`) where c8y-nitro persists
+* local dev state such as the last-synced manifest hash. Lives in
+* `node_modules` so it is naturally gitignored and scoped per-checkout.
+*/
+const CACHE_DIR_SEGMENTS = ["node_modules", ".c8y-nitro"];
+const CACHE_FILE_NAME = "bootstrap-state.json";
+const CACHE_SCHEMA_VERSION = 1;
+function getCacheDir(rootDir) {
+	return join(rootDir, ...CACHE_DIR_SEGMENTS);
+}
+function getCacheFile(rootDir) {
+	return join(getCacheDir(rootDir), CACHE_FILE_NAME);
+}
+/**
+* Compute a hash over the manifest and the deployment target it will be synced
+* to. Folding the target in means switching tenant/baseURL invalidates the
+* cached hash even if the manifest itself is unchanged.
+*
+* @param manifest - The generated Cumulocity manifest
+* @param target - The deployment target identity
+*/
+function hashManifest(manifest, target) {
+	const payload = JSON.stringify({
+		manifest,
+		target
+	});
+	return createHash("sha256").update(payload).digest("hex");
+}
+/**
+* Read the persisted bootstrap state, or `null` when absent, unreadable, or
+* from an incompatible schema version.
+* @param rootDir - Project root directory (containing `node_modules`)
+*/
+async function readManifestCache(rootDir) {
+	try {
+		const content = await readFile(getCacheFile(rootDir), "utf-8");
+		const state = JSON.parse(content);
+		if (state.schemaVersion !== CACHE_SCHEMA_VERSION) return null;
+		return state;
+	} catch {
+		return null;
+	}
+}
+/**
+* Persist the bootstrap state for future dev restarts.
+* @param rootDir - Project root directory (containing `node_modules`)
+* @param state - The state to persist (schema version is filled in automatically)
+*/
+async function writeManifestCache(rootDir, state) {
+	await mkdir(getCacheDir(rootDir), { recursive: true });
+	const payload = {
+		schemaVersion: CACHE_SCHEMA_VERSION,
+		...state
+	};
+	await writeFile(getCacheFile(rootDir), JSON.stringify(payload, null, 2), "utf-8");
+}
+//#endregion
+//#region src/module/autoBootstrap.ts
+const BOOTSTRAP_ENV_VARS = [
+	"C8Y_BOOTSTRAP_TENANT",
+	"C8Y_BOOTSTRAP_USER",
+	"C8Y_BOOTSTRAP_PASSWORD"
+];
+const DEV_ENV_VARS = [
+	"C8Y_BASEURL",
+	"C8Y_DEVELOPMENT_TENANT",
+	"C8Y_DEVELOPMENT_USER",
+	"C8Y_DEVELOPMENT_PASSWORD"
+];
+/**
+* Reads bootstrap credentials from an env object (e.g. a loaded `.env` file or
+* `process.env`). Returns `undefined` unless all three variables are present.
+* @param env - Environment variables object
+*/
+function readBootstrapCredentialsFromEnv(env) {
+	const tenant = env.C8Y_BOOTSTRAP_TENANT;
+	const name = env.C8Y_BOOTSTRAP_USER;
+	const password = env.C8Y_BOOTSTRAP_PASSWORD;
+	if (!tenant || !name || !password) return;
+	return {
+		tenant,
+		name,
+		password
+	};
+}
+/**
+* Verifies the microservice on the development tenant and keeps it in sync with
+* the local manifest, bootstrapping (or re-bootstrapping) when needed.
+*
+* Unlike a purely env-var-based check, this always verifies against the tenant,
+* so it also handles:
+* - the manifest changing between runs (auto-updates a placeholder), and
+* - the application being deleted on the tenant while stale bootstrap env vars
+*   still linger locally (re-creates it).
+*
+* A previously *deployed* microservice (one with an active version) is never
+* overwritten automatically - we only warn about the drift.
+*
+* @param options - See {@link SyncBootstrappedMicroserviceOptions}
+* @returns The bootstrap credentials for the microservice (freshly fetched when
+* they were refreshed, otherwise the ones already present in `env`)
+*/
+async function syncBootstrappedMicroservice(options) {
+	const { rootDir, baseUrl, developmentTenant, authHeader, manifest, logger } = options;
+	const env = options.env ?? process.env;
+	const target = {
+		baseUrl,
+		developmentTenant,
+		name: manifest.name
+	};
+	const currentHash = hashManifest(manifest, target);
+	const existingApp = await findMicroserviceByName(baseUrl, manifest.name, authHeader);
+	if (!existingApp) {
+		const createdApp = await createMicroservice(baseUrl, manifest, authHeader);
+		logger.debug(`Microservice "${manifest.name}" created (ID: ${createdApp.id})`);
+		const credentials = await finalizeBootstrap({
+			rootDir,
+			logger,
+			baseUrl,
+			developmentTenant,
+			appId: createdApp.id,
+			authHeader,
+			target,
+			manifestHash: currentHash,
+			forceCredentials: true
+		});
+		logger.success(`Microservice "${manifest.name}" created on the development tenant.`);
+		return credentials;
+	}
+	const appId = existingApp.id;
+	const isRealService = Boolean(existingApp.activeVersionId);
+	const cache = await readManifestCache(rootDir);
+	if (!cache || cache.manifestHash !== currentHash || cache.appId !== appId) if (isRealService) logger.warn(`Local manifest for "${manifest.name}" differs from the deployed microservice on the development tenant. The running service was left untouched. Redeploy or run \`npx c8y-nitro bootstrap\` to update it explicitly.`);
+	else {
+		await updateMicroservice(baseUrl, appId, manifest, authHeader);
+		logger.success(`Updated microservice "${manifest.name}" with changed manifest.`);
+	}
+	const hasBootstrapCreds = BOOTSTRAP_ENV_VARS.every((v) => env[v]);
+	const appChanged = cache?.appId !== appId;
+	return await finalizeBootstrap({
+		rootDir,
+		logger,
+		baseUrl,
+		developmentTenant,
+		appId,
+		authHeader,
+		target,
+		manifestHash: currentHash,
+		forceCredentials: !hasBootstrapCreds || appChanged
+	}) ?? readBootstrapCredentialsFromEnv(env);
+}
+/**
+* Verifies the microservice on the development tenant during dev startup.
+* Runs silently unless a bootstrap/sync was performed or an error occurs.
+* @param nitro - Nitro instance
+*/
+async function autoBootstrap(nitro) {
+	try {
+		if (DEV_ENV_VARS.filter((v) => !process.env[v]).length > 0) return;
+		const baseUrl = process.env.C8Y_BASEURL.endsWith("/") ? process.env.C8Y_BASEURL.slice(0, -1) : process.env.C8Y_BASEURL;
+		const authHeader = createBasicAuthHeader(process.env.C8Y_DEVELOPMENT_TENANT, process.env.C8Y_DEVELOPMENT_USER, process.env.C8Y_DEVELOPMENT_PASSWORD);
+		const manifest = await createC8yManifest(nitro.options.rootDir, nitro.options, nitro.logger);
+		await syncBootstrappedMicroservice({
+			rootDir: nitro.options.rootDir,
+			baseUrl,
+			developmentTenant: process.env.C8Y_DEVELOPMENT_TENANT,
+			authHeader,
+			manifest,
+			logger: nitro.logger
+		});
+	} catch (error) {
+		nitro.logger.warn("Auto-bootstrap failed:", error instanceof Error ? error.message : String(error));
+	}
+}
+/**
+* Subscribe the tenant, optionally (re)write bootstrap credentials, and persist
+* the synced state to the local cache.
+* @param opts - Bootstrap finalization inputs
+* @returns The freshly fetched credentials when `forceCredentials` was set
+*/
+async function finalizeBootstrap(opts) {
+	await subscribeToApplication(opts.baseUrl, opts.developmentTenant, opts.appId, opts.authHeader);
+	let credentials;
+	if (opts.forceCredentials) {
+		credentials = await getBootstrapCredentials(opts.baseUrl, opts.appId, opts.authHeader);
+		const envFileName = await writeBootstrapCredentials(opts.rootDir, {
+			C8Y_BOOTSTRAP_TENANT: credentials.tenant,
+			C8Y_BOOTSTRAP_USER: credentials.name,
+			C8Y_BOOTSTRAP_PASSWORD: credentials.password
+		});
+		process.env.C8Y_BOOTSTRAP_TENANT = credentials.tenant;
+		process.env.C8Y_BOOTSTRAP_USER = credentials.name;
+		process.env.C8Y_BOOTSTRAP_PASSWORD = credentials.password;
+		opts.logger.debug(`Bootstrap credentials written to ${envFileName}`);
+	}
+	await writeManifestCache(opts.rootDir, {
+		manifestHash: opts.manifestHash,
+		target: opts.target,
+		appId: opts.appId
+	});
+	return credentials;
+}
+//#endregion
+export { readBootstrapCredentialsFromEnv as n, syncBootstrappedMicroservice as r, autoBootstrap as t };

package/dist/{bootstrap-ObaEF7rN.mjs → bootstrap-C1Qly0J_.mjs}

@@ -1,4 +1,4 @@
-import { a as findMicroserviceByName, d as updateMicroservice, l as subscribeToApplication, n as createBasicAuthHeader, o as getBootstrapCredentials, p as createC8yManifest, r as createMicroservice } from "./c8y-api-BFjK6AYb.mjs";
+import { a as findMicroserviceByName, d as updateMicroservice, l as subscribeToApplication, n as createBasicAuthHeader, o as getBootstrapCredentials, p as createC8yManifest, r as createMicroservice } from "./c8y-api-DscUs-Kd.mjs";
 import { t as writeBootstrapCredentials } from "./env-file-BrOTmVjA.mjs";
 import { n as validateBootstrapEnv, t as loadC8yConfig } from "./config-BVQHqlgV.mjs";
 import { defineCommand, runCommand } from "citty";
@@ -52,7 +52,7 @@ var bootstrap_default = defineCommand({
 		});
 		consola.success(`Bootstrap credentials written to ${envFileName}`);
 		if (manifest.roles && manifest.roles.length > 0) {
-			if (await consola.prompt("Do you want to manage microservice roles for your development user?", { type: "confirm" })) await runCommand(await import("./roles-B58Fguop.mjs").then((r) => r.default), { rawArgs: [] });
+			if (await consola.prompt("Do you want to manage microservice roles for your development user?", { type: "confirm" })) await runCommand(await import("./roles-B-DNuScZ.mjs").then((r) => r.default), { rawArgs: [] });
 		}
 		consola.success("Bootstrap complete!");
 	}

package/dist/{c8y-api-BFjK6AYb.mjs → c8y-api-DscUs-Kd.mjs}

@@ -283,14 +283,20 @@ async function unassignUserRole(baseUrl, tenantId, userId, roleId, authHeader) {
 	}
 }
 /**
-* Gets all tenant options for a specific category.
+* Fetches the current application's settings (the tenant options of the
+* microservice's own settings category) via
+* `GET /application/currentApplication/settings`.
+*
+* Must be called with microservice credentials (bootstrap or service user).
+* Unlike the Options API — which returns `credentials.*` values encrypted for
+* regular users and rejects the bootstrap user with `403` — this endpoint
+* returns encrypted `credentials.*` options **decrypted**.
 * @param baseUrl - The Cumulocity base URL
-* @param category - The category to fetch options for
-* @param authHeader - The Basic Auth header
-* @returns Record of key-value pairs for the category
+* @param authHeader - Basic Auth header of the bootstrap (or service) user
+* @returns Flat key-value map of the microservice's settings
 */
-async function getTenantOptionsByCategory(baseUrl, category, authHeader) {
-	const url = `${baseUrl}/tenant/options/${encodeURIComponent(category)}`;
+async function getCurrentApplicationSettings(baseUrl, authHeader) {
+	const url = `${baseUrl}/application/currentApplication/settings`;
 	const response = await fetch(url, {
 		method: "GET",
 		headers: {
@@ -298,23 +304,21 @@ async function getTenantOptionsByCategory(baseUrl, category, authHeader) {
 			Accept: "application/json"
 		}
 	});
-	if (response.status === 404) return {};
 	if (!response.ok) {
 		const errorText = await response.text();
-		throw new Error(`Failed to get tenant options for category ${category}: ${response.status} ${response.statusText}\n${errorText}`, { cause: response });
+		throw new Error(`Failed to get current application settings: ${response.status} ${response.statusText}\n${errorText}`, { cause: response });
 	}
 	return await response.json();
 }
 /**
-* Gets a specific tenant option value.
+* Gets all tenant options for a specific category.
 * @param baseUrl - The Cumulocity base URL
-* @param category - The category of the option
-* @param key - The option key
+* @param category - The category to fetch options for
 * @param authHeader - The Basic Auth header
-* @returns The option value, or undefined if not set
+* @returns Record of key-value pairs for the category
 */
-async function getTenantOption(baseUrl, category, key, authHeader) {
-	const url = `${baseUrl}/tenant/options/${encodeURIComponent(category)}/${encodeURIComponent(key)}`;
+async function getTenantOptionsByCategory(baseUrl, category, authHeader) {
+	const url = `${baseUrl}/tenant/options/${encodeURIComponent(category)}`;
 	const response = await fetch(url, {
 		method: "GET",
 		headers: {
@@ -322,12 +326,12 @@ async function getTenantOption(baseUrl, category, key, authHeader) {
 			Accept: "application/json"
 		}
 	});
-	if (response.status === 404) return;
+	if (response.status === 404) return {};
 	if (!response.ok) {
 		const errorText = await response.text();
-		throw new Error(`Failed to get tenant option ${category}/${key}: ${response.status} ${response.statusText}\n${errorText}`, { cause: response });
+		throw new Error(`Failed to get tenant options for category ${category}: ${response.status} ${response.statusText}\n${errorText}`, { cause: response });
 	}
-	return (await response.json()).value;
+	return await response.json();
 }
 /**
 * Creates a tenant option.
@@ -420,4 +424,4 @@ async function deleteTenantOption(baseUrl, category, key, authHeader) {
 	}
 }
 //#endregion
-export { GENERATED_READINESS_ROUTE as _, findMicroserviceByName as a, getTenantOptionsByCategory as c, updateMicroservice as d, upsertTenantOption as f, GENERATED_LIVENESS_ROUTE as g, GENERATED_INVALIDATE_TENANT_OPTIONS_ROUTE as h, deleteTenantOption as i, subscribeToApplication as l, createC8yManifestFromNitro as m, createBasicAuthHeader as n, getBootstrapCredentials as o, createC8yManifest as p, createMicroservice as r, getTenantOption as s, assignUserRole as t, unassignUserRole as u };
+export { GENERATED_READINESS_ROUTE as _, findMicroserviceByName as a, getTenantOptionsByCategory as c, updateMicroservice as d, upsertTenantOption as f, GENERATED_LIVENESS_ROUTE as g, GENERATED_INVALIDATE_TENANT_OPTIONS_ROUTE as h, deleteTenantOption as i, subscribeToApplication as l, createC8yManifestFromNitro as m, createBasicAuthHeader as n, getBootstrapCredentials as o, createC8yManifest as p, createMicroservice as r, getCurrentApplicationSettings as s, assignUserRole as t, unassignUserRole as u };

package/dist/cli/index.mjs

@@ -1,4 +1,4 @@
-import { n as name, r as version, t as description } from "../package-D5xRshsx.mjs";
+import { n as name, r as version, t as description } from "../package-CNWz76PV.mjs";
 import { defineCommand, runMain } from "citty";
 //#region src/cli/index.ts
 runMain(defineCommand({
@@ -8,9 +8,9 @@ runMain(defineCommand({
 		description
 	},
 	subCommands: {
-		bootstrap: () => import("../bootstrap-ObaEF7rN.mjs").then((r) => r.default),
-		roles: () => import("../roles-B58Fguop.mjs").then((r) => r.default),
-		options: () => import("../options-B7_yb_wr.mjs").then((r) => r.default)
+		bootstrap: () => import("../bootstrap-C1Qly0J_.mjs").then((r) => r.default),
+		roles: () => import("../roles-B-DNuScZ.mjs").then((r) => r.default),
+		options: () => import("../options-CmLpZ3Qf.mjs").then((r) => r.default)
 	}
 }));
 //#endregion

package/dist/{client-DxmbyZju.mjs → client-D0Tdq7H1.mjs}

@@ -96,6 +96,50 @@ async function getUserTenantDomain(requestOrEvent) {
 	const tenantId = await getCurrentUserTenantId(requestOrEvent);
 	return cachedTenantDomain(requestOrEvent, tenantId);
 }
+const FAST_DOMAIN_SUCCESS_TTL = 6e4;
+const FAST_DOMAIN_FAILURE_TTL = 1e4;
+const FAST_DOMAIN_MAX_ENTRIES = 1e3;
+const fastDomainCache = /* @__PURE__ */ new Map();
+/**
+* Best-effort variant of {@link getUserTenantDomain} for per-request hot paths:
+* never throws (returns `undefined` for unauthenticated requests or failed
+* lookups) and memoizes results in-process per auth material. Failures are
+* cached briefly so requests with unresolvable credentials don't trigger a
+* platform call each time.
+* @param requestOrEvent - The H3Event or ServerRequest from the current request
+* @param resolveDomain - Domain resolver, only overridden in tests
+*/
+async function tryGetUserTenantDomainFast(requestOrEvent, resolveDomain = getUserTenantDomain) {
+	if (!getCurrentUserTenantCacheKeyMaterial(requestOrEvent)) return;
+	const key = createCurrentUserTenantCacheKey(requestOrEvent);
+	const now = Date.now();
+	const cached = fastDomainCache.get(key);
+	if (cached && cached.expiresAt > now) return cached.domain;
+	let domain;
+	try {
+		domain = await resolveDomain(requestOrEvent);
+	} catch {
+		domain = void 0;
+	}
+	if (!fastDomainCache.has(key) && fastDomainCache.size >= FAST_DOMAIN_MAX_ENTRIES) fastDomainCache.delete(fastDomainCache.keys().next().value);
+	fastDomainCache.set(key, {
+		domain,
+		expiresAt: now + (domain ? FAST_DOMAIN_SUCCESS_TTL : FAST_DOMAIN_FAILURE_TTL)
+	});
+	return domain;
+}
+/**
+* Builds the public URL a request is reachable at through the platform proxy:
+* `https://<tenant domain>/service/<contextPath><pathname><search>`.
+* The proxy strips the `/service/<contextPath>` prefix before the request
+* reaches the microservice, so it is re-added here.
+* @param tenantDomain - Public domain of the tenant (e.g. `tenant.cumulocity.com`)
+* @param contextPath - Context path of the microservice
+* @param url - URL the request was received with (only pathname and search are used)
+*/
+function buildPublicRequestUrl(tenantDomain, contextPath, url) {
+	return new URL(`https://${tenantDomain}/service/${contextPath}${url.pathname}${url.search}`);
+}
 //#endregion
 //#region src/utils/credentials.ts
 let prevCredentials = null;
@@ -233,4 +277,4 @@ async function useDeployedTenantClient() {
 	return client;
 }
 //#endregion
-export { getUserTenantDomain as n, useDeployedTenantClient as t };
+export { buildPublicRequestUrl as n, tryGetUserTenantDomainFast as r, useDeployedTenantClient as t };

package/dist/index.mjs

@@ -1,8 +1,8 @@
-import { _ as GENERATED_READINESS_ROUTE, a as findMicroserviceByName, d as updateMicroservice, g as GENERATED_LIVENESS_ROUTE, h as GENERATED_INVALIDATE_TENANT_OPTIONS_ROUTE, l as subscribeToApplication, m as createC8yManifestFromNitro, n as createBasicAuthHeader, o as getBootstrapCredentials, p as createC8yManifest, r as createMicroservice } from "./c8y-api-BFjK6AYb.mjs";
-import { t as writeBootstrapCredentials } from "./env-file-BrOTmVjA.mjs";
-import { n as name } from "./package-D5xRshsx.mjs";
+import { _ as GENERATED_READINESS_ROUTE, g as GENERATED_LIVENESS_ROUTE, h as GENERATED_INVALIDATE_TENANT_OPTIONS_ROUTE, m as createC8yManifestFromNitro, p as createC8yManifest } from "./c8y-api-DscUs-Kd.mjs";
+import { t as autoBootstrap } from "./autoBootstrap-Drk7ltXK.mjs";
+import { n as name } from "./package-CNWz76PV.mjs";
 import { basename, dirname, join, relative } from "node:path";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdir, writeFile } from "node:fs/promises";
 import { x } from "tinyexec";
 import { join as join$1 } from "pathe";
 import { mkdir as mkdir$1, readFile as readFile$1, stat, writeFile as writeFile$1 } from "fs/promises";
@@ -11,8 +11,6 @@ import Spinnies from "spinnies";
 import { colors } from "consola/utils";
 import { mkdirSync, writeFileSync } from "fs";
 import { fileURLToPath } from "node:url";
-import { createHash } from "node:crypto";
-import process from "node:process";
 import evlog from "evlog/nitro/v3";
 //#region src/module/apiClient.ts
 /**
@@ -465,6 +463,22 @@ function registerRuntime(nitro, options = {}) {
 		handler,
 		middleware: true
 	})));
+	/**
+	* Request URL rewrite middleware (always on in production builds).
+	* Rewrites `event.url` to the public tenant endpoint so handlers that build
+	* absolute URLs from the request don't leak internal cluster URLs.
+	* Registered after the scanned middlewares (which observe the original
+	* cluster-local URL) and before the OpenAPI transform, which reuses the
+	* resolved tenant domain from its cache.
+	*/
+	if (!isNitroDev) {
+		nitro.options.handlers.push({
+			route: "/**",
+			handler: join$1(thisFilePath, "./runtime/handlers/rewriteRequestUrl"),
+			middleware: true
+		});
+		nitro.logger.debug("Registered public request URL rewrite middleware");
+	}
 	if (Boolean(nitro.options.experimental?.openAPI && (isNitroDev || nitro.options.openAPI?.production))) if (!isNitroDev && nitro.options.openAPI?.production === "prerender") nitro.logger.warn("c8y-nitro cannot transform a prerendered OpenAPI document (internal routes stay listed and the server URL is baked in at build time). Use `openAPI: { production: true }` to serve the document at runtime instead.");
 	else {
 		nitro.options.handlers.push({
@@ -535,173 +549,6 @@ function checkProbeEndpoint(nitro, probe, probeType) {
 	}
 }
 //#endregion
-//#region src/module/manifestCache.ts
-/**
-* Directory (inside the project's `node_modules`) where c8y-nitro persists
-* local dev state such as the last-synced manifest hash. Lives in
-* `node_modules` so it is naturally gitignored and scoped per-checkout.
-*/
-const CACHE_DIR_SEGMENTS = ["node_modules", ".c8y-nitro"];
-const CACHE_FILE_NAME = "bootstrap-state.json";
-const CACHE_SCHEMA_VERSION = 1;
-function getCacheDir(rootDir) {
-	return join(rootDir, ...CACHE_DIR_SEGMENTS);
-}
-function getCacheFile(rootDir) {
-	return join(getCacheDir(rootDir), CACHE_FILE_NAME);
-}
-/**
-* Compute a hash over the manifest and the deployment target it will be synced
-* to. Folding the target in means switching tenant/baseURL invalidates the
-* cached hash even if the manifest itself is unchanged.
-*
-* @param manifest - The generated Cumulocity manifest
-* @param target - The deployment target identity
-*/
-function hashManifest(manifest, target) {
-	const payload = JSON.stringify({
-		manifest,
-		target
-	});
-	return createHash("sha256").update(payload).digest("hex");
-}
-/**
-* Read the persisted bootstrap state, or `null` when absent, unreadable, or
-* from an incompatible schema version.
-* @param rootDir - Project root directory (containing `node_modules`)
-*/
-async function readManifestCache(rootDir) {
-	try {
-		const content = await readFile(getCacheFile(rootDir), "utf-8");
-		const state = JSON.parse(content);
-		if (state.schemaVersion !== CACHE_SCHEMA_VERSION) return null;
-		return state;
-	} catch {
-		return null;
-	}
-}
-/**
-* Persist the bootstrap state for future dev restarts.
-* @param rootDir - Project root directory (containing `node_modules`)
-* @param state - The state to persist (schema version is filled in automatically)
-*/
-async function writeManifestCache(rootDir, state) {
-	await mkdir(getCacheDir(rootDir), { recursive: true });
-	const payload = {
-		schemaVersion: CACHE_SCHEMA_VERSION,
-		...state
-	};
-	await writeFile(getCacheFile(rootDir), JSON.stringify(payload, null, 2), "utf-8");
-}
-//#endregion
-//#region src/module/autoBootstrap.ts
-const BOOTSTRAP_ENV_VARS = [
-	"C8Y_BOOTSTRAP_TENANT",
-	"C8Y_BOOTSTRAP_USER",
-	"C8Y_BOOTSTRAP_PASSWORD"
-];
-const DEV_ENV_VARS = [
-	"C8Y_BASEURL",
-	"C8Y_DEVELOPMENT_TENANT",
-	"C8Y_DEVELOPMENT_USER",
-	"C8Y_DEVELOPMENT_PASSWORD"
-];
-/**
-* Verifies the microservice on the development tenant and keeps it in sync with
-* the local manifest, bootstrapping (or re-bootstrapping) when needed.
-*
-* Unlike a purely env-var-based check, this always verifies against the tenant
-* when development credentials are available, so it also handles:
-* - the manifest changing between dev restarts (auto-updates a placeholder), and
-* - the application being deleted on the tenant while stale bootstrap env vars
-*   still linger locally (re-creates it).
-*
-* A previously *deployed* microservice (one with an active version) is never
-* overwritten automatically - we only warn about the drift.
-*
-* Runs silently unless a bootstrap/sync was performed or an error occurs.
-* @param nitro - Nitro instance
-*/
-async function autoBootstrap(nitro) {
-	try {
-		const rootDir = nitro.options.rootDir;
-		if (DEV_ENV_VARS.filter((v) => !process.env[v]).length > 0) return;
-		const baseUrl = process.env.C8Y_BASEURL.endsWith("/") ? process.env.C8Y_BASEURL.slice(0, -1) : process.env.C8Y_BASEURL;
-		const developmentTenant = process.env.C8Y_DEVELOPMENT_TENANT;
-		const authHeader = createBasicAuthHeader(developmentTenant, process.env.C8Y_DEVELOPMENT_USER, process.env.C8Y_DEVELOPMENT_PASSWORD);
-		const manifest = await createC8yManifest(rootDir, nitro.options, nitro.logger);
-		const target = {
-			baseUrl,
-			developmentTenant,
-			name: manifest.name
-		};
-		const currentHash = hashManifest(manifest, target);
-		const existingApp = await findMicroserviceByName(baseUrl, manifest.name, authHeader);
-		if (!existingApp) {
-			const createdApp = await createMicroservice(baseUrl, manifest, authHeader);
-			nitro.logger.debug(`Microservice "${manifest.name}" created (ID: ${createdApp.id})`);
-			await finalizeBootstrap(nitro, {
-				baseUrl,
-				developmentTenant,
-				appId: createdApp.id,
-				authHeader,
-				target,
-				manifestHash: currentHash,
-				forceCredentials: true
-			});
-			nitro.logger.success(`Auto-bootstrap complete! Microservice "${manifest.name}" created on tenant.`);
-			return;
-		}
-		const appId = existingApp.id;
-		const isRealService = Boolean(existingApp.activeVersionId);
-		const cache = await readManifestCache(rootDir);
-		if (!cache || cache.manifestHash !== currentHash || cache.appId !== appId) if (isRealService) nitro.logger.warn(`Local manifest for "${manifest.name}" differs from the deployed microservice on the development tenant. The running service was left untouched. Redeploy or run \`npx c8y-nitro bootstrap\` to update it explicitly.`);
-		else {
-			await updateMicroservice(baseUrl, appId, manifest, authHeader);
-			nitro.logger.success(`Auto-bootstrap: updated microservice "${manifest.name}" with changed manifest.`);
-		}
-		const hasBootstrapCreds = BOOTSTRAP_ENV_VARS.every((v) => process.env[v]);
-		const appChanged = cache?.appId !== appId;
-		await finalizeBootstrap(nitro, {
-			baseUrl,
-			developmentTenant,
-			appId,
-			authHeader,
-			target,
-			manifestHash: currentHash,
-			forceCredentials: !hasBootstrapCreds || appChanged
-		});
-	} catch (error) {
-		nitro.logger.warn("Auto-bootstrap failed:", error instanceof Error ? error.message : String(error));
-	}
-}
-/**
-* Subscribe the tenant, optionally (re)write bootstrap credentials, and persist
-* the synced state to the local cache.
-* @param nitro
-* @param opts
-*/
-async function finalizeBootstrap(nitro, opts) {
-	await subscribeToApplication(opts.baseUrl, opts.developmentTenant, opts.appId, opts.authHeader);
-	if (opts.forceCredentials) {
-		const credentials = await getBootstrapCredentials(opts.baseUrl, opts.appId, opts.authHeader);
-		const envFileName = await writeBootstrapCredentials(nitro.options.rootDir, {
-			C8Y_BOOTSTRAP_TENANT: credentials.tenant,
-			C8Y_BOOTSTRAP_USER: credentials.name,
-			C8Y_BOOTSTRAP_PASSWORD: credentials.password
-		});
-		process.env.C8Y_BOOTSTRAP_TENANT = credentials.tenant;
-		process.env.C8Y_BOOTSTRAP_USER = credentials.name;
-		process.env.C8Y_BOOTSTRAP_PASSWORD = credentials.password;
-		nitro.logger.debug(`Bootstrap credentials written to ${envFileName}`);
-	}
-	await writeManifestCache(nitro.options.rootDir, {
-		manifestHash: opts.manifestHash,
-		target: opts.target,
-		appId: opts.appId
-	});
-}
-//#endregion
 //#region src/index.ts
 function c8y() {
 	return {