@codemation/cli 0.0.4 → 0.0.7

package/dist/{CliBin-900C8Din.js → CliBin-Bx1lFBi5.js}

@@ -1,23 +1,28 @@
 import { createRequire } from "node:module";
 import process$1 from "node:process";
-import { CodemationConsumerConfigLoader, CodemationPluginDiscovery, WorkflowDiscoveryPathSegmentsComputer, WorkflowModulePathFinder } from "@codemation/host/server";
-import { ServerLoggerFactory, logLevelPolicyFactory } from "@codemation/host/next/server";
+import { AppConfigLoader, CodemationConsumerConfigLoader, CodemationFrontendAuthSnapshotFactory, CodemationPluginDiscovery, FrontendAppConfigJsonCodec, WorkflowDiscoveryPathSegmentsComputer, WorkflowModulePathFinder } from "@codemation/host/server";
+import { ApiPaths, AppContainerFactory, AppContainerLifecycle, ApplicationTokens, CodemationFrontendAuthSnapshotFactory as CodemationFrontendAuthSnapshotFactory$1, DatabaseMigrations, FrontendAppConfigJsonCodec as FrontendAppConfigJsonCodec$1, ListUserAccountsQuery, PrismaClient, UpsertLocalBootstrapUserCommand, WorkerRuntime } from "@codemation/host";
+import { AppContainerFactory as AppContainerFactory$1, AppContainerLifecycle as AppContainerLifecycle$1, CodemationHonoApiApp, CodemationPluginListMerger, FrontendRuntime, ServerLoggerFactory, logLevelPolicyFactory } from "@codemation/host/next/server";
 import { randomUUID } from "node:crypto";
 import { access, copyFile, cp, mkdir, open, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawn } from "node:child_process";
-import { ApiPaths, ApplicationTokens, CodemationApplication, CodemationBootstrapRequest, ListUserAccountsQuery, PrismaClient, UpsertLocalBootstrapUserCommand } from "@codemation/host";
 import { existsSync, readFileSync } from "node:fs";
 import { config, parse } from "dotenv";
 import { watch } from "chokidar";
 import ts from "typescript";
-import { DatabasePersistenceResolver, PrismaMigrationDeployer } from "@codemation/host/persistence";
+import { PrismaMigrationDeployer } from "@codemation/host/persistence";
 import boxen from "boxen";
 import chalk from "chalk";
 import figlet from "figlet";
+import { createServer } from "node:http";
+import httpProxy from "http-proxy";
+import { WebSocket, WebSocketServer } from "ws";
+import { serve } from "@hono/node-server";
+import { Hono } from "hono";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
-import { createServer } from "node:net";
+import { createServer as createServer$1 } from "node:net";
 import { Command } from "commander";
 
 //#region src/build/ConsumerBuildArtifactsPublisher.ts
@@ -120,9 +125,8 @@ var DbMigrateCommand = class {
 //#region src/commands/DevCommand.ts
 var DevCommand = class {
 	require = createRequire(import.meta.url);
-	constructor(pathResolver, pluginDiscovery, tsRuntime, devLockFactory, devSourceWatcherFactory, cliLogger, session, databaseMigrationsApplyService, devBootstrapSummaryFetcher, devCliBannerRenderer, devConsumerPublishBootstrap, consumerEnvDotenvFilePredicate, devTrackedProcessTreeKiller, nextHostConsumerServerCommandFactory) {
+	constructor(pathResolver, tsRuntime, devLockFactory, devSourceWatcherFactory, cliLogger, session, databaseMigrationsApplyService, devBootstrapSummaryFetcher, devCliBannerRenderer, devConsumerPublishBootstrap, consumerEnvDotenvFilePredicate, devTrackedProcessTreeKiller, nextHostConsumerServerCommandFactory, devApiRuntimeFactory, cliDevProxyServerFactory, devRebuildQueueFactory) {
 		this.pathResolver = pathResolver;
-		this.pluginDiscovery = pluginDiscovery;
 		this.tsRuntime = tsRuntime;
 		this.devLockFactory = devLockFactory;
 		this.devSourceWatcherFactory = devSourceWatcherFactory;
@@ -135,14 +139,17 @@ var DevCommand = class {
 		this.consumerEnvDotenvFilePredicate = consumerEnvDotenvFilePredicate;
 		this.devTrackedProcessTreeKiller = devTrackedProcessTreeKiller;
 		this.nextHostConsumerServerCommandFactory = nextHostConsumerServerCommandFactory;
+		this.devApiRuntimeFactory = devApiRuntimeFactory;
+		this.cliDevProxyServerFactory = cliDevProxyServerFactory;
+		this.devRebuildQueueFactory = devRebuildQueueFactory;
 	}
-	async execute(consumerRoot) {
-		const paths = await this.pathResolver.resolve(consumerRoot);
+	async execute(args) {
+		const paths = await this.pathResolver.resolve(args.consumerRoot);
 		this.devCliBannerRenderer.renderBrandHeader();
 		this.tsRuntime.configure(paths.repoRoot);
 		await this.databaseMigrationsApplyService.applyForConsumer(paths.consumerRoot);
 		await this.devConsumerPublishBootstrap.ensurePublished(paths);
-		const devMode = this.resolveDevModeFromEnv();
+		const devMode = this.resolveDevMode(args);
 		const { nextPort, gatewayPort } = await this.session.sessionPorts.resolve({
 			devMode,
 			portEnv: process$1.env.PORT,
@@ -151,66 +158,56 @@ var DevCommand = class {
 		const devLock = this.devLockFactory.create();
 		await devLock.acquire({
 			consumerRoot: paths.consumerRoot,
-			nextPort: devMode === "framework" ? nextPort : gatewayPort
+			nextPort: devMode === "watch-framework" ? nextPort : gatewayPort
 		});
 		const authSettings = await this.session.devAuthLoader.loadForConsumer(paths.consumerRoot);
 		const watcher = this.devSourceWatcherFactory.create();
+		const processState = this.createInitialProcessState();
+		let proxyServer = null;
 		try {
 			const prepared = await this.prepareDevRuntime(paths, devMode, nextPort, gatewayPort, authSettings);
-			const processState = this.createInitialProcessState();
 			const stopPromise = this.wireStopPromise(processState);
-			const uiProxyBase = await this.startConsumerUiProxyWhenNeeded(prepared, processState);
+			const uiProxyBase = await this.startPackagedUiWhenNeeded(prepared, processState);
+			proxyServer = await this.startProxyServer(prepared.gatewayPort, uiProxyBase);
 			const gatewayBaseUrl = this.gatewayBaseHttpUrl(gatewayPort);
-			await this.spawnGatewayChildAndWaitForHealth(prepared, processState, gatewayBaseUrl, uiProxyBase);
+			await this.bootInitialRuntime(prepared, processState, proxyServer);
 			await this.session.devHttpProbe.waitUntilBootstrapSummaryReady(gatewayBaseUrl);
 			const initialSummary = await this.devBootstrapSummaryFetcher.fetch(gatewayBaseUrl);
 			if (initialSummary) this.devCliBannerRenderer.renderRuntimeSummary(initialSummary);
-			this.bindShutdownSignalsToChildProcesses(processState);
-			this.spawnFrameworkNextHostWhenNeeded(prepared, processState, gatewayBaseUrl);
-			await this.startWatcherForSourceRestart(prepared, watcher, devMode, gatewayBaseUrl);
-			this.logConsumerDevHintWhenNeeded(devMode, gatewayPort);
+			this.bindShutdownSignalsToChildProcesses(processState, proxyServer);
+			await this.spawnDevUiWhenNeeded(prepared, processState, gatewayBaseUrl);
+			await this.startWatcherForSourceRestart(prepared, processState, watcher, devMode, gatewayBaseUrl, proxyServer);
+			this.logPackagedUiDevHintWhenNeeded(devMode, gatewayPort);
 			await stopPromise;
 		} finally {
+			processState.stopRequested = true;
+			await this.stopLiveProcesses(processState, proxyServer);
 			await watcher.stop();
 			await devLock.release();
 		}
 	}
-	resolveDevModeFromEnv() {
-		return process$1.env.CODEMATION_DEV_MODE === "framework" ? "framework" : "consumer";
+	resolveDevMode(args) {
+		if (args.watchFramework === true || process$1.env.CODEMATION_DEV_MODE === "framework") return "watch-framework";
+		return "packaged-ui";
 	}
 	async prepareDevRuntime(paths, devMode, nextPort, gatewayPort, authSettings) {
-		const developmentServerToken = this.session.devAuthLoader.resolveDevelopmentServerToken(process$1.env.CODEMATION_DEV_SERVER_TOKEN);
-		const gatewayEntrypoint = await this.session.runtimeEntrypointResolver.resolve({
-			packageName: "@codemation/dev-gateway",
-			repoRoot: paths.repoRoot,
-			sourceEntrypoint: "packages/dev-gateway/src/bin.ts"
-		});
-		const runtimeEntrypoint = await this.session.runtimeEntrypointResolver.resolve({
-			packageName: "@codemation/runtime-dev",
-			repoRoot: paths.repoRoot,
-			sourceEntrypoint: "packages/runtime-dev/src/bin.ts"
-		});
-		const runtimeWorkingDirectory = paths.repoRoot ?? paths.consumerRoot;
-		const consumerEnv = this.session.consumerEnvLoader.load(paths.consumerRoot);
 		return {
 			paths,
 			devMode,
 			nextPort,
 			gatewayPort,
 			authSettings,
-			developmentServerToken,
-			gatewayEntrypoint,
-			runtimeEntrypoint,
-			runtimeWorkingDirectory,
-			discoveredPluginPackagesJson: JSON.stringify(await this.pluginDiscovery.discover(paths.consumerRoot)),
-			consumerEnv
+			developmentServerToken: this.session.devAuthLoader.resolveDevelopmentServerToken(process$1.env.CODEMATION_DEV_SERVER_TOKEN),
+			consumerEnv: this.session.consumerEnvLoader.load(paths.consumerRoot)
 		};
 	}
 	createInitialProcessState() {
 		return {
-			currentGateway: null,
-			currentNextHost: null,
-			currentUiNext: null,
+			currentDevUi: null,
+			currentPackagedUi: null,
+			currentPackagedUiBaseUrl: null,
+			currentRuntime: null,
+			isRestartingUi: false,
 			stopRequested: false,
 			stopResolve: null,
 			stopReject: null
@@ -225,92 +222,64 @@ var DevCommand = class {
 	gatewayBaseHttpUrl(gatewayPort) {
 		return `http://127.0.0.1:${gatewayPort}`;
 	}
-	/**
-	* Consumer mode: run `next start` for the host UI and wait until it responds, so the gateway can proxy to it.
-	* Framework mode: no separate UI child (Next runs in dev later).
-	*/
-	async startConsumerUiProxyWhenNeeded(prepared, state) {
-		if (prepared.devMode !== "consumer") return "";
+	async startPackagedUiWhenNeeded(prepared, state) {
+		if (prepared.devMode !== "packaged-ui") return "";
 		const websocketPort = prepared.gatewayPort;
-		const uiPort = await this.session.loopbackPortAllocator.allocate();
-		const uiProxyBase = `http://127.0.0.1:${uiPort}`;
+		const uiProxyBase = state.currentPackagedUiBaseUrl ?? `http://127.0.0.1:${await this.session.loopbackPortAllocator.allocate()}`;
+		state.currentPackagedUiBaseUrl = uiProxyBase;
+		await this.spawnPackagedUi(prepared, state, prepared.authSettings, websocketPort, uiProxyBase);
+		return uiProxyBase;
+	}
+	async spawnPackagedUi(prepared, state, authSettings, websocketPort, uiProxyBase) {
 		const nextHostPackageJsonPath = this.require.resolve("@codemation/next-host/package.json");
 		const nextHostRoot = path.dirname(nextHostPackageJsonPath);
 		const nextHostCommand = await this.nextHostConsumerServerCommandFactory.create({ nextHostRoot });
 		const consumerOutputManifestPath = path.resolve(prepared.paths.consumerRoot, ".codemation", "output", "current.json");
-		state.currentUiNext = spawn(nextHostCommand.command, nextHostCommand.args, {
+		const uiPort = Number(new URL(uiProxyBase).port);
+		const nextHostEnvironment = this.session.nextHostEnvBuilder.buildConsumerUiProxy({
+			authConfigJson: authSettings.authConfigJson,
+			authSecret: authSettings.authSecret,
+			consumerRoot: prepared.paths.consumerRoot,
+			consumerOutputManifestPath,
+			developmentServerToken: prepared.developmentServerToken,
+			nextPort: uiPort,
+			publicBaseUrl: this.gatewayBaseHttpUrl(prepared.gatewayPort),
+			runtimeDevUrl: this.gatewayBaseHttpUrl(prepared.gatewayPort),
+			skipUiAuth: authSettings.skipUiAuth,
+			websocketPort
+		});
+		state.currentPackagedUi = spawn(nextHostCommand.command, nextHostCommand.args, {
 			cwd: nextHostCommand.cwd,
 			...this.devDetachedChildSpawnOptions(),
-			env: {
-				...process$1.env,
-				...prepared.consumerEnv,
-				PORT: String(uiPort),
-				CODEMATION_AUTH_CONFIG_JSON: prepared.authSettings.authConfigJson,
-				CODEMATION_CONSUMER_ROOT: prepared.paths.consumerRoot,
-				CODEMATION_CONSUMER_OUTPUT_MANIFEST_PATH: consumerOutputManifestPath,
-				CODEMATION_SKIP_UI_AUTH: prepared.authSettings.skipUiAuth ? "true" : "false",
-				AUTH_SECRET: prepared.authSettings.authSecret,
-				NEXTAUTH_SECRET: prepared.authSettings.authSecret,
-				NEXT_PUBLIC_CODEMATION_SKIP_UI_AUTH: prepared.authSettings.skipUiAuth ? "true" : "false",
-				CODEMATION_WS_PORT: String(websocketPort),
-				NEXT_PUBLIC_CODEMATION_WS_PORT: String(websocketPort),
-				CODEMATION_DEV_SERVER_TOKEN: prepared.developmentServerToken,
-				NODE_OPTIONS: this.session.sourceMapNodeOptions.appendToNodeOptions(process$1.env.NODE_OPTIONS),
-				WS_NO_BUFFER_UTIL: "1",
-				WS_NO_UTF_8_VALIDATE: "1"
-			}
+			env: nextHostEnvironment
 		});
-		state.currentUiNext.on("error", (error) => {
-			if (!state.stopRequested) {
-				state.stopRequested = true;
-				state.stopReject?.(error instanceof Error ? error : new Error(String(error)));
-			}
+		state.currentPackagedUi.on("error", (error) => {
+			if (state.stopRequested || state.isRestartingUi) return;
+			state.stopRequested = true;
+			state.stopReject?.(error instanceof Error ? error : new Error(String(error)));
 		});
-		state.currentUiNext.on("exit", (code) => {
-			if (state.stopRequested) return;
+		state.currentPackagedUi.on("exit", (code) => {
+			if (state.stopRequested || state.isRestartingUi) return;
 			state.stopRequested = true;
-			if (state.currentGateway?.exitCode === null) this.devTrackedProcessTreeKiller.killProcessTreeRootedAt(state.currentGateway);
-			state.stopReject?.(/* @__PURE__ */ new Error(`next start (consumer UI) exited unexpectedly with code ${code ?? 0}.`));
+			state.stopReject?.(/* @__PURE__ */ new Error(`next start (packaged UI) exited unexpectedly with code ${code ?? 0}.`));
 		});
 		await this.session.devHttpProbe.waitUntilUrlRespondsOk(`${uiProxyBase}/`);
-		return uiProxyBase;
 	}
-	async spawnGatewayChildAndWaitForHealth(prepared, state, gatewayBaseUrl, uiProxyBase) {
-		const gatewayProcessEnv = this.session.consumerEnvLoader.mergeIntoProcessEnvironment(process$1.env, prepared.consumerEnv);
-		state.currentGateway = spawn(prepared.gatewayEntrypoint.command, prepared.gatewayEntrypoint.args, {
-			cwd: prepared.runtimeWorkingDirectory,
-			...this.devDetachedChildSpawnOptions(),
-			env: {
-				...gatewayProcessEnv,
-				...prepared.gatewayEntrypoint.env,
-				CODEMATION_DEV_GATEWAY_HTTP_PORT: String(prepared.gatewayPort),
-				CODEMATION_RUNTIME_CHILD_BIN: prepared.runtimeEntrypoint.command,
-				CODEMATION_RUNTIME_CHILD_ARGS_JSON: JSON.stringify(prepared.runtimeEntrypoint.args),
-				CODEMATION_RUNTIME_CHILD_ENV_JSON: JSON.stringify(prepared.runtimeEntrypoint.env),
-				CODEMATION_RUNTIME_CHILD_CWD: prepared.runtimeWorkingDirectory,
-				CODEMATION_CONSUMER_ROOT: prepared.paths.consumerRoot,
-				CODEMATION_DISCOVERED_PLUGIN_PACKAGES_JSON: prepared.discoveredPluginPackagesJson,
-				CODEMATION_PREFER_PLUGIN_SOURCE_ENTRY: "true",
-				CODEMATION_DEV_SERVER_TOKEN: prepared.developmentServerToken,
-				CODEMATION_SKIP_STARTUP_MIGRATIONS: "true",
-				NODE_OPTIONS: this.session.sourceMapNodeOptions.appendToNodeOptions(process$1.env.NODE_OPTIONS),
-				WS_NO_BUFFER_UTIL: "1",
-				WS_NO_UTF_8_VALIDATE: "1",
-				...uiProxyBase.length > 0 ? { CODEMATION_DEV_UI_PROXY_TARGET: uiProxyBase } : {}
-			}
-		});
-		state.currentGateway.on("error", (error) => {
-			if (!state.stopRequested) {
-				state.stopRequested = true;
-				state.stopReject?.(error instanceof Error ? error : new Error(String(error)));
-			}
-		});
-		state.currentGateway.on("exit", (code) => {
-			if (state.stopRequested) return;
-			state.stopRequested = true;
-			state.stopReject?.(/* @__PURE__ */ new Error(`codemation dev-gateway exited unexpectedly with code ${code ?? 0}.`));
+	async startProxyServer(gatewayPort, uiProxyBase) {
+		const proxyServer = this.cliDevProxyServerFactory.create(gatewayPort);
+		proxyServer.setUiProxyTarget(uiProxyBase.length > 0 ? uiProxyBase : null);
+		await proxyServer.start();
+		await this.session.devHttpProbe.waitUntilGatewayHealthy(this.gatewayBaseHttpUrl(gatewayPort));
+		return proxyServer;
+	}
+	async bootInitialRuntime(prepared, state, proxyServer) {
+		const runtime = await this.createRuntime(prepared);
+		state.currentRuntime = runtime;
+		await proxyServer.activateRuntime({
+			httpPort: runtime.httpPort,
+			workflowWebSocketPort: runtime.workflowWebSocketPort
 		});
-		await this.session.devHttpProbe.waitUntilGatewayHealthy(gatewayBaseUrl);
+		proxyServer.setBuildStatus("idle");
 	}
 	devDetachedChildSpawnOptions() {
 		return process$1.platform === "win32" ? {
@@ -322,20 +291,14 @@ var DevCommand = class {
 			detached: true
 		};
 	}
-	bindShutdownSignalsToChildProcesses(state) {
+	bindShutdownSignalsToChildProcesses(state, proxyServer) {
 		let shutdownInProgress = false;
 		const runShutdown = async () => {
 			if (shutdownInProgress) return;
 			shutdownInProgress = true;
 			state.stopRequested = true;
 			process$1.stdout.write("\n[codemation] Stopping..\n");
-			const children = [];
-			for (const child of [
-				state.currentUiNext,
-				state.currentNextHost,
-				state.currentGateway
-			]) if (child && child.exitCode === null && child.signalCode === null) children.push(child);
-			await Promise.all(children.map((child) => this.devTrackedProcessTreeKiller.killProcessTreeRootedAt(child)));
+			await this.stopLiveProcesses(state, proxyServer);
 			process$1.stdout.write("[codemation] Stopped.\n");
 			state.stopResolve?.();
 		};
@@ -347,24 +310,24 @@ var DevCommand = class {
 			runShutdown();
 		});
 	}
-	/**
-	* Framework mode: run `next dev` for the Next host with HMR, pointed at the dev gateway runtime URL.
-	*/
-	spawnFrameworkNextHostWhenNeeded(prepared, state, gatewayBaseUrl) {
-		if (prepared.devMode !== "framework") return;
+	async spawnDevUiWhenNeeded(prepared, state, gatewayBaseUrl) {
+		if (prepared.devMode !== "watch-framework") return;
+		await this.spawnDevUi(prepared, state, gatewayBaseUrl, prepared.authSettings);
+	}
+	async spawnDevUi(prepared, state, gatewayBaseUrl, authSettings) {
 		const websocketPort = prepared.gatewayPort;
 		const nextHostPackageJsonPath = this.require.resolve("@codemation/next-host/package.json");
 		const nextHostRoot = path.dirname(nextHostPackageJsonPath);
 		const nextHostEnvironment = this.session.nextHostEnvBuilder.build({
-			authConfigJson: prepared.authSettings.authConfigJson,
+			authConfigJson: authSettings.authConfigJson,
 			consumerRoot: prepared.paths.consumerRoot,
 			developmentServerToken: prepared.developmentServerToken,
 			nextPort: prepared.nextPort,
-			skipUiAuth: prepared.authSettings.skipUiAuth,
+			skipUiAuth: authSettings.skipUiAuth,
 			websocketPort,
 			runtimeDevUrl: gatewayBaseUrl
 		});
-		state.currentNextHost = spawn("pnpm", [
+		state.currentDevUi = spawn("pnpm", [
 			"exec",
 			"next",
 			"dev"
@@ -373,26 +336,28 @@ var DevCommand = class {
 			...this.devDetachedChildSpawnOptions(),
 			env: nextHostEnvironment
 		});
-		state.currentNextHost.on("exit", (code) => {
+		state.currentDevUi.on("exit", (code) => {
 			const normalizedCode = code ?? 0;
-			if (state.stopRequested) return;
+			if (state.stopRequested || state.isRestartingUi) return;
 			if (normalizedCode === 0) {
 				state.stopRequested = true;
-				if (state.currentGateway?.exitCode === null) this.devTrackedProcessTreeKiller.killProcessTreeRootedAt(state.currentGateway);
 				state.stopResolve?.();
 				return;
 			}
 			state.stopRequested = true;
 			state.stopReject?.(/* @__PURE__ */ new Error(`next host exited with code ${normalizedCode}.`));
 		});
-		state.currentNextHost.on("error", (error) => {
-			if (!state.stopRequested) {
-				state.stopRequested = true;
-				state.stopReject?.(error instanceof Error ? error : new Error(String(error)));
-			}
+		state.currentDevUi.on("error", (error) => {
+			if (state.stopRequested || state.isRestartingUi) return;
+			state.stopRequested = true;
+			state.stopReject?.(error instanceof Error ? error : new Error(String(error)));
 		});
+		await this.session.devHttpProbe.waitUntilUrlRespondsOk(`http://127.0.0.1:${prepared.nextPort}/`);
 	}
-	async startWatcherForSourceRestart(prepared, watcher, devMode, gatewayBaseUrl) {
+	async startWatcherForSourceRestart(prepared, state, watcher, devMode, gatewayBaseUrl, proxyServer) {
+		const rebuildQueue = this.devRebuildQueueFactory.create({ run: async (request) => {
+			await this.runQueuedRebuild(prepared, state, gatewayBaseUrl, proxyServer, request);
+		} });
 		await watcher.start({
 			roots: this.session.watchRootsResolver.resolve({
 				consumerRoot: prepared.paths.consumerRoot,
@@ -401,22 +366,119 @@ var DevCommand = class {
 			}),
 			onChange: async ({ changedPaths }) => {
 				if (changedPaths.length > 0 && changedPaths.every((p) => this.consumerEnvDotenvFilePredicate.matches(p))) {
-					process$1.stdout.write("\n[codemation] Consumer environment file changed (e.g. .env). Restart the `codemation dev` process so the gateway and runtime pick up updated variables (host `process.env` does not hot-reload).\n");
+					process$1.stdout.write("\n[codemation] Consumer environment file changed (e.g. .env). Restart the `codemation dev` process so the runtime picks up updated variables (host `process.env` does not hot-reload).\n");
 					return;
 				}
-				process$1.stdout.write("\n[codemation] Source change detected — rebuilding consumer…\n");
-				await this.session.sourceRestartCoordinator.runHandshakeAfterSourceChange(gatewayBaseUrl, prepared.developmentServerToken);
-				process$1.stdout.write("[codemation] Waiting for runtime to accept traffic…\n");
-				await this.session.devHttpProbe.waitUntilBootstrapSummaryReady(gatewayBaseUrl);
-				const json = await this.devBootstrapSummaryFetcher.fetch(gatewayBaseUrl);
-				if (json) this.devCliBannerRenderer.renderCompact(json);
-				process$1.stdout.write("[codemation] Runtime ready.\n");
+				try {
+					const shouldRepublishConsumerOutput = this.session.sourceChangeClassifier.shouldRepublishConsumerOutput({
+						changedPaths,
+						consumerRoot: prepared.paths.consumerRoot
+					});
+					const shouldRestartUi = this.session.sourceChangeClassifier.requiresUiRestart({
+						changedPaths,
+						consumerRoot: prepared.paths.consumerRoot
+					});
+					process$1.stdout.write(shouldRestartUi ? "\n[codemation] Source change detected — rebuilding consumer, restarting the runtime, and restarting the UI…\n" : "\n[codemation] Source change detected — rebuilding consumer and restarting the runtime…\n");
+					await rebuildQueue.enqueue({
+						changedPaths,
+						shouldRepublishConsumerOutput,
+						shouldRestartUi
+					});
+				} catch (error) {
+					await this.failDevSessionAfterIrrecoverableSourceError(state, proxyServer, error);
+				}
+			}
+		});
+	}
+	async runQueuedRebuild(prepared, state, gatewayBaseUrl, proxyServer, request) {
+		proxyServer.setBuildStatus("building");
+		proxyServer.broadcastBuildStarted();
+		try {
+			if (request.shouldRepublishConsumerOutput) await this.devConsumerPublishBootstrap.ensurePublished(prepared.paths);
+			await this.stopCurrentRuntime(state, proxyServer);
+			process$1.stdout.write("[codemation] Waiting for runtime to accept traffic…\n");
+			const runtime = await this.createRuntime(prepared);
+			state.currentRuntime = runtime;
+			await proxyServer.activateRuntime({
+				httpPort: runtime.httpPort,
+				workflowWebSocketPort: runtime.workflowWebSocketPort
+			});
+			if (request.shouldRestartUi) await this.restartUiAfterSourceChange(prepared, state, gatewayBaseUrl);
+			await this.session.devHttpProbe.waitUntilBootstrapSummaryReady(gatewayBaseUrl);
+			const json = await this.devBootstrapSummaryFetcher.fetch(gatewayBaseUrl);
+			if (json) this.devCliBannerRenderer.renderCompact(json);
+			proxyServer.setBuildStatus("idle");
+			proxyServer.broadcastBuildCompleted(runtime.buildVersion);
+			process$1.stdout.write("[codemation] Runtime ready.\n");
+		} catch (error) {
+			proxyServer.setBuildStatus("idle");
+			proxyServer.broadcastBuildFailed(error instanceof Error ? error.message : String(error));
+			throw error;
+		}
+	}
+	async restartUiAfterSourceChange(prepared, state, gatewayBaseUrl) {
+		const refreshedAuthSettings = await this.session.devAuthLoader.loadForConsumer(prepared.paths.consumerRoot);
+		process$1.stdout.write("[codemation] Restarting the UI process to apply source changes…\n");
+		state.isRestartingUi = true;
+		try {
+			if (prepared.devMode === "packaged-ui") {
+				await this.restartPackagedUi(prepared, state, refreshedAuthSettings);
+				return;
+			}
+			await this.restartDevUi(prepared, state, gatewayBaseUrl, refreshedAuthSettings);
+		} finally {
+			state.isRestartingUi = false;
+		}
+	}
+	async restartPackagedUi(prepared, state, authSettings) {
+		if (state.currentPackagedUi && state.currentPackagedUi.exitCode === null && state.currentPackagedUi.signalCode === null) await this.devTrackedProcessTreeKiller.killProcessTreeRootedAt(state.currentPackagedUi);
+		state.currentPackagedUi = null;
+		const uiProxyBaseUrl = state.currentPackagedUiBaseUrl;
+		if (!uiProxyBaseUrl) throw new Error("Packaged UI proxy base URL is missing during UI restart.");
+		await this.spawnPackagedUi(prepared, state, authSettings, prepared.gatewayPort, uiProxyBaseUrl);
+	}
+	async restartDevUi(prepared, state, gatewayBaseUrl, authSettings) {
+		if (state.currentDevUi && state.currentDevUi.exitCode === null && state.currentDevUi.signalCode === null) await this.devTrackedProcessTreeKiller.killProcessTreeRootedAt(state.currentDevUi);
+		state.currentDevUi = null;
+		await this.spawnDevUi(prepared, state, gatewayBaseUrl, authSettings);
+	}
+	async failDevSessionAfterIrrecoverableSourceError(state, proxyServer, error) {
+		const exception = error instanceof Error ? error : new Error(String(error));
+		state.stopRequested = true;
+		await this.stopLiveProcesses(state, proxyServer);
+		state.stopReject?.(exception);
+	}
+	async stopLiveProcesses(state, proxyServer) {
+		await this.stopCurrentRuntime(state, proxyServer);
+		const children = [];
+		for (const child of [state.currentPackagedUi, state.currentDevUi]) if (child && child.exitCode === null && child.signalCode === null) children.push(child);
+		await Promise.all(children.map((child) => this.devTrackedProcessTreeKiller.killProcessTreeRootedAt(child)));
+		if (proxyServer) await proxyServer.stop();
+	}
+	async stopCurrentRuntime(state, proxyServer) {
+		const runtime = state.currentRuntime;
+		state.currentRuntime = null;
+		if (proxyServer) await proxyServer.activateRuntime(null);
+		if (runtime) await runtime.stop();
+	}
+	async createRuntime(prepared) {
+		const runtimeEnvironment = this.session.consumerEnvLoader.mergeIntoProcessEnvironment(process$1.env, prepared.consumerEnv);
+		return await this.devApiRuntimeFactory.create({
+			consumerRoot: prepared.paths.consumerRoot,
+			runtimeWorkingDirectory: process$1.cwd(),
+			env: {
+				...runtimeEnvironment,
+				CODEMATION_DEV_SERVER_TOKEN: prepared.developmentServerToken,
+				CODEMATION_SKIP_STARTUP_MIGRATIONS: "true",
+				NODE_OPTIONS: this.session.sourceMapNodeOptions.appendToNodeOptions(process$1.env.NODE_OPTIONS),
+				WS_NO_BUFFER_UTIL: "1",
+				WS_NO_UTF_8_VALIDATE: "1"
 			}
 		});
 	}
-	logConsumerDevHintWhenNeeded(devMode, gatewayPort) {
-		if (devMode !== "consumer") return;
-		this.cliLogger.info(`codemation dev (consumer): open http://127.0.0.1:${gatewayPort} — uses the packaged @codemation/next-host UI. For framework UI HMR, set CODEMATION_DEV_MODE=framework.`);
+	logPackagedUiDevHintWhenNeeded(devMode, gatewayPort) {
+		if (devMode !== "packaged-ui") return;
+		this.cliLogger.info(`codemation dev: open http://127.0.0.1:${gatewayPort} — this uses the packaged @codemation/next-host UI. Use \`codemation dev --watch-framework\` only when working on the framework UI itself.`);
 	}
 };
 
@@ -424,8 +486,9 @@ var DevCommand = class {
 //#region src/commands/ServeWebCommand.ts
 var ServeWebCommand = class {
 	require = createRequire(import.meta.url);
-	constructor(pathResolver, pluginDiscovery, artifactsPublisher, tsRuntime, sourceMapNodeOptions, outputBuilderLoader, envLoader, listenPortResolver, nextHostConsumerServerCommandFactory) {
+	constructor(pathResolver, configLoader, pluginDiscovery, artifactsPublisher, tsRuntime, sourceMapNodeOptions, outputBuilderLoader, envLoader, listenPortResolver, nextHostConsumerServerCommandFactory, frontendAuthSnapshotFactory, frontendAppConfigJsonCodec) {
 		this.pathResolver = pathResolver;
+		this.configLoader = configLoader;
 		this.pluginDiscovery = pluginDiscovery;
 		this.artifactsPublisher = artifactsPublisher;
 		this.tsRuntime = tsRuntime;
@@ -434,6 +497,8 @@ var ServeWebCommand = class {
 		this.envLoader = envLoader;
 		this.listenPortResolver = listenPortResolver;
 		this.nextHostConsumerServerCommandFactory = nextHostConsumerServerCommandFactory;
+		this.frontendAuthSnapshotFactory = frontendAuthSnapshotFactory;
+		this.frontendAppConfigJsonCodec = frontendAppConfigJsonCodec;
 	}
 	async execute(consumerRoot, buildOptions) {
 		const paths = await this.pathResolver.resolve(consumerRoot);
@@ -444,6 +509,15 @@ var ServeWebCommand = class {
 		const nextHostRoot = path.dirname(this.require.resolve("@codemation/next-host/package.json"));
 		const nextHostCommand = await this.nextHostConsumerServerCommandFactory.create({ nextHostRoot });
 		const consumerEnv = this.envLoader.load(paths.consumerRoot);
+		const configResolution = await this.configLoader.load({ consumerRoot: paths.consumerRoot });
+		const frontendAuthSnapshot = this.frontendAuthSnapshotFactory.createFromResolvedInputs({
+			authConfig: configResolution.config.auth,
+			env: {
+				...process$1.env,
+				...consumerEnv
+			},
+			uiAuthEnabled: !(consumerEnv.NODE_ENV !== "production" && configResolution.config.auth?.allowUnauthenticatedInDevelopment === true)
+		});
 		const nextPort = this.listenPortResolver.resolvePrimaryApplicationPort(process$1.env.PORT);
 		const websocketPort = this.listenPortResolver.resolveWebsocketPortRelativeToHttp({
 			nextPort,
@@ -457,6 +531,11 @@ var ServeWebCommand = class {
 				...process$1.env,
 				...consumerEnv,
 				PORT: String(nextPort),
+				CODEMATION_FRONTEND_APP_CONFIG_JSON: this.frontendAppConfigJsonCodec.serialize({
+					auth: frontendAuthSnapshot,
+					productName: "Codemation",
+					logoUrl: null
+				}),
 				CODEMATION_CONSUMER_OUTPUT_MANIFEST_PATH: manifest.manifestPath,
 				CODEMATION_CONSUMER_ROOT: paths.consumerRoot,
 				CODEMATION_WS_PORT: String(websocketPort),
@@ -482,34 +561,46 @@ var ServeWebCommand = class {
 //#endregion
 //#region src/commands/ServeWorkerCommand.ts
 var ServeWorkerCommand = class {
-	require = createRequire(import.meta.url);
-	constructor(sourceMapNodeOptions) {
-		this.sourceMapNodeOptions = sourceMapNodeOptions;
+	constructor(pathResolver, appConfigLoader, appContainerFactory) {
+		this.pathResolver = pathResolver;
+		this.appConfigLoader = appConfigLoader;
+		this.appContainerFactory = appContainerFactory;
 	}
 	async execute(consumerRoot, configPathOverride) {
-		const workerPackageRoot = path.dirname(this.require.resolve("@codemation/worker-cli/package.json"));
-		const args = [path.join(workerPackageRoot, "bin", "codemation-worker.js")];
-		if (configPathOverride !== void 0 && configPathOverride.trim().length > 0) args.push("--config", path.resolve(process$1.cwd(), configPathOverride.trim()));
-		args.push("--consumer-root", consumerRoot);
-		const child = spawn(process$1.execPath, args, {
-			cwd: consumerRoot,
-			stdio: "inherit",
-			env: {
-				...process$1.env,
-				NODE_OPTIONS: this.sourceMapNodeOptions.appendToNodeOptions(process$1.env.NODE_OPTIONS)
-			}
+		const paths = await this.pathResolver.resolve(consumerRoot);
+		const loadResult = await this.appConfigLoader.load({
+			consumerRoot,
+			repoRoot: paths.repoRoot,
+			env: process$1.env,
+			configPathOverride
 		});
-		await new Promise((resolve, reject) => {
-			child.on("exit", (code) => {
-				if ((code ?? 0) === 0) {
-					resolve();
-					return;
-				}
-				reject(/* @__PURE__ */ new Error(`codemation-worker exited with code ${code ?? 0}.`));
-			});
-			child.on("error", reject);
+		if (loadResult.appConfig.scheduler.kind !== "bullmq") throw new Error("Worker mode requires runtime.scheduler.kind = \"bullmq\".");
+		const container = await this.appContainerFactory.create({
+			appConfig: loadResult.appConfig,
+			sharedWorkflowWebsocketServer: null
+		});
+		const workerQueues = loadResult.appConfig.scheduler.workerQueues.length > 0 ? loadResult.appConfig.scheduler.workerQueues : ["default"];
+		const handle = await container.resolve(WorkerRuntime).start(workerQueues);
+		await new Promise((resolve) => {
+			this.bindSignals(handle.stop, resolve);
 		});
 	}
+	bindSignals(stop, resolve) {
+		let stopping = false;
+		const onSignal = async () => {
+			if (stopping) return;
+			stopping = true;
+			try {
+				await stop();
+			} finally {
+				resolve();
+				process$1.exit(0);
+			}
+		};
+		process$1.on("SIGINT", () => void onSignal());
+		process$1.on("SIGTERM", () => void onSignal());
+		process$1.on("SIGQUIT", () => void onSignal());
+	}
 };
 
 //#endregion
@@ -1210,13 +1301,36 @@ var ConsumerOutputBuilderLoader = class {
 * Resolves TCP PostgreSQL vs PGlite vs none from env + {@link CodemationConfig} (same rules as the host runtime).
 */
 var ConsumerDatabaseConnectionResolver = class {
-	resolver = new DatabasePersistenceResolver();
 	resolve(processEnv, config$1, consumerRoot) {
-		return this.resolver.resolve({
-			runtimeConfig: config$1.runtime ?? {},
-			env: processEnv,
-			consumerRoot
-		});
+		const database = config$1.runtime?.database;
+		if (!database) return { kind: "none" };
+		if (this.resolveDatabaseKind(database.kind, database.url, processEnv) === "postgresql") {
+			const databaseUrl = database.url?.trim() ?? "";
+			if (!databaseUrl) throw new Error("runtime.database.kind is \"postgresql\" but no database URL was set (runtime.database.url).");
+			return {
+				kind: "postgresql",
+				databaseUrl
+			};
+		}
+		return {
+			kind: "pglite",
+			dataDir: this.resolvePgliteDataDir(database.pgliteDataDir, processEnv, consumerRoot)
+		};
+	}
+	resolveDatabaseKind(configuredKind, databaseUrl, env) {
+		const kindFromEnv = env.CODEMATION_DATABASE_KIND?.trim();
+		if (kindFromEnv === "postgresql" || kindFromEnv === "pglite") return kindFromEnv;
+		if (configuredKind) return configuredKind;
+		const trimmedUrl = databaseUrl?.trim();
+		if (trimmedUrl && (trimmedUrl.startsWith("postgresql://") || trimmedUrl.startsWith("postgres://"))) return "postgresql";
+		return "pglite";
+	}
+	resolvePgliteDataDir(configuredPath, env, consumerRoot) {
+		const envPath = env.CODEMATION_PGLITE_DATA_DIR?.trim();
+		if (envPath && envPath.length > 0) return path.isAbsolute(envPath) ? envPath : path.resolve(consumerRoot, envPath);
+		const trimmedConfiguredPath = configuredPath?.trim();
+		if (trimmedConfiguredPath && trimmedConfiguredPath.length > 0) return path.isAbsolute(trimmedConfiguredPath) ? trimmedConfiguredPath : path.resolve(consumerRoot, trimmedConfiguredPath);
+		return path.resolve(consumerRoot, ".codemation", "pglite");
 	}
 };
 
@@ -1292,7 +1406,7 @@ var HostPackageRootResolver = class {
 //#endregion
 //#region src/dev/DevBootstrapSummaryFetcher.ts
 /**
-* Fetches {@link DevBootstrapSummaryJson} from the dev gateway (proxied to runtime-dev).
+* Fetches {@link DevBootstrapSummaryJson} from the stable CLI-owned dev endpoint.
 */
 var DevBootstrapSummaryFetcher = class {
 	async fetch(gatewayBaseUrl) {
@@ -1442,6 +1556,710 @@ var DevConsumerPublishBootstrap = class {
 	}
 };
 
+//#endregion
+//#region src/dev/CliDevProxyServer.ts
+var CliDevProxyServer = class {
+	proxy = httpProxy.createProxyServer({
+		ws: true,
+		xfwd: true
+	});
+	devClients = /* @__PURE__ */ new Set();
+	devWss = new WebSocketServer({ noServer: true });
+	workflowClients = /* @__PURE__ */ new Set();
+	workflowWss = new WebSocketServer({ noServer: true });
+	roomIdsByWorkflowClient = /* @__PURE__ */ new Map();
+	workflowClientCountByRoomId = /* @__PURE__ */ new Map();
+	activeRuntime = null;
+	activeBuildStatus = "idle";
+	childWorkflowSocket = null;
+	server = null;
+	uiProxyTarget = null;
+	constructor(listenPort) {
+		this.listenPort = listenPort;
+	}
+	async start() {
+		if (this.server) return;
+		this.bindDevWebSocket();
+		this.bindWorkflowWebSocket();
+		this.proxy.on("error", (error, _req, res) => {
+			if (res && "writeHead" in res && typeof res.writeHead === "function") {
+				const serverResponse = res;
+				if (!serverResponse.headersSent) {
+					serverResponse.writeHead(502, { "content-type": "text/plain" });
+					serverResponse.end(`Bad gateway: ${error.message}`);
+				}
+			}
+		});
+		const server = createServer((req, res) => {
+			this.handleHttpRequest(req, res);
+		});
+		server.on("upgrade", (request, socket, head) => {
+			this.handleUpgrade(request, socket, head);
+		});
+		await new Promise((resolve, reject) => {
+			server.once("error", reject);
+			server.listen(this.listenPort, "127.0.0.1", () => {
+				resolve();
+			});
+		});
+		this.server = server;
+	}
+	async stop() {
+		await this.disconnectChildWorkflowSocket();
+		this.activeRuntime = null;
+		const server = this.server;
+		this.server = null;
+		for (const client of this.devClients) client.terminate();
+		this.devClients.clear();
+		for (const client of this.workflowClients) client.terminate();
+		this.workflowClients.clear();
+		this.roomIdsByWorkflowClient.clear();
+		this.workflowClientCountByRoomId.clear();
+		if (!server) return;
+		await new Promise((resolve, reject) => {
+			server.close((error) => {
+				if (error) {
+					reject(error);
+					return;
+				}
+				resolve();
+			});
+		});
+	}
+	setUiProxyTarget(target) {
+		this.uiProxyTarget = target?.trim() ? target.trim() : null;
+	}
+	async activateRuntime(target) {
+		this.activeRuntime = target;
+		await this.connectChildWorkflowSocket();
+	}
+	setBuildStatus(status) {
+		this.activeBuildStatus = status;
+	}
+	broadcastBuildStarted() {
+		this.broadcastDev({ kind: "devBuildStarted" });
+		this.broadcastWorkflowLifecycleToSubscribedRooms((roomId) => ({
+			kind: "devBuildStarted",
+			workflowId: roomId
+		}));
+	}
+	broadcastBuildCompleted(buildVersion) {
+		this.broadcastDev({
+			kind: "devBuildCompleted",
+			buildVersion
+		});
+		this.broadcastWorkflowLifecycleToSubscribedRooms((roomId) => ({
+			kind: "devBuildCompleted",
+			workflowId: roomId,
+			buildVersion
+		}));
+	}
+	broadcastBuildFailed(message) {
+		this.broadcastDev({
+			kind: "devBuildFailed",
+			message
+		});
+		this.broadcastWorkflowLifecycleToSubscribedRooms((roomId) => ({
+			kind: "devBuildFailed",
+			workflowId: roomId,
+			message
+		}));
+	}
+	bindDevWebSocket() {
+		this.devWss.on("connection", (socket) => {
+			this.devClients.add(socket);
+			socket.on("close", () => {
+				this.devClients.delete(socket);
+			});
+		});
+	}
+	bindWorkflowWebSocket() {
+		this.workflowWss.on("connection", (socket) => {
+			this.connectWorkflowClient(socket);
+		});
+	}
+	async handleHttpRequest(req, res) {
+		const pathname = this.safePathname(req.url ?? "");
+		const uiProxyTarget = this.uiProxyTarget;
+		const activeRuntimeTarget = this.activeRuntime ? `http://127.0.0.1:${this.activeRuntime.httpPort}` : void 0;
+		if (pathname === "/api/dev/health" && req.method === "GET") {
+			res.writeHead(200, { "content-type": "application/json" });
+			res.end(JSON.stringify({
+				ok: true,
+				runtime: { status: this.activeRuntime ? this.activeBuildStatus === "building" ? "building" : "ready" : "stopped" }
+			}));
+			return;
+		}
+		if (pathname === "/api/dev/bootstrap-summary") {
+			if (!activeRuntimeTarget) {
+				res.writeHead(503, { "content-type": "text/plain" });
+				res.end("Runtime is rebuilding.");
+				return;
+			}
+			this.proxy.web(req, res, { target: activeRuntimeTarget });
+			return;
+		}
+		if (uiProxyTarget && pathname.startsWith("/api/auth/")) {
+			this.proxy.web(req, res, { target: uiProxyTarget.replace(/\/$/, "") });
+			return;
+		}
+		if (pathname.startsWith("/api/")) {
+			if (this.activeBuildStatus === "building" || !this.activeRuntime) {
+				res.writeHead(503, { "content-type": "text/plain" });
+				res.end("Runtime is rebuilding.");
+				return;
+			}
+			this.proxy.web(req, res, { target: activeRuntimeTarget });
+			return;
+		}
+		if (uiProxyTarget) {
+			this.proxy.web(req, res, { target: uiProxyTarget.replace(/\/$/, "") });
+			return;
+		}
+		res.writeHead(404, { "content-type": "text/plain" });
+		res.end("Not found.");
+	}
+	handleUpgrade(request, socket, head) {
+		const pathname = this.safePathname(request.url ?? "");
+		if (pathname === ApiPaths.devGatewaySocket()) {
+			this.devWss.handleUpgrade(request, socket, head, (ws) => {
+				this.devWss.emit("connection", ws, request);
+			});
+			return;
+		}
+		if (pathname === ApiPaths.workflowWebsocket()) {
+			this.workflowWss.handleUpgrade(request, socket, head, (ws) => {
+				this.workflowWss.emit("connection", ws, request);
+			});
+			return;
+		}
+		const uiProxyTarget = this.uiProxyTarget;
+		if (uiProxyTarget && !pathname.startsWith("/api/")) {
+			this.proxy.ws(request, socket, head, { target: uiProxyTarget.replace(/\/$/, "") });
+			return;
+		}
+		socket.destroy();
+	}
+	safePathname(url) {
+		try {
+			return new URL(url, "http://127.0.0.1").pathname;
+		} catch {
+			return url.split("?")[0] ?? url;
+		}
+	}
+	broadcastDev(message) {
+		const text = JSON.stringify(message);
+		for (const client of this.devClients) if (client.readyState === WebSocket.OPEN) client.send(text);
+	}
+	broadcastWorkflowLifecycleToSubscribedRooms(createMessage) {
+		for (const roomId of this.workflowClientCountByRoomId.keys()) this.broadcastWorkflowTextToRoom(roomId, JSON.stringify(createMessage(roomId)));
+	}
+	async connectWorkflowClient(socket) {
+		this.workflowClients.add(socket);
+		this.roomIdsByWorkflowClient.set(socket, /* @__PURE__ */ new Set());
+		socket.send(JSON.stringify({ kind: "ready" }));
+		socket.on("message", (rawData) => {
+			this.handleWorkflowClientMessage(socket, rawData);
+		});
+		socket.on("close", () => {
+			this.disconnectWorkflowClient(socket);
+		});
+		socket.on("error", () => {
+			this.disconnectWorkflowClient(socket);
+		});
+	}
+	disconnectWorkflowClient(socket) {
+		const roomIds = this.roomIdsByWorkflowClient.get(socket);
+		if (roomIds) for (const roomId of roomIds) this.releaseWorkflowRoom(roomId);
+		this.roomIdsByWorkflowClient.delete(socket);
+		this.workflowClients.delete(socket);
+	}
+	async handleWorkflowClientMessage(socket, rawData) {
+		try {
+			const message = this.parseWorkflowClientMessage(rawData);
+			if (message.kind === "subscribe") {
+				const roomIds$1 = this.roomIdsByWorkflowClient.get(socket);
+				if (!roomIds$1) return;
+				if (!roomIds$1.has(message.roomId)) {
+					roomIds$1.add(message.roomId);
+					this.retainWorkflowRoom(message.roomId);
+				}
+				socket.send(JSON.stringify({
+					kind: "subscribed",
+					roomId: message.roomId
+				}));
+				return;
+			}
+			const roomIds = this.roomIdsByWorkflowClient.get(socket);
+			if (!roomIds) return;
+			if (roomIds.delete(message.roomId)) this.releaseWorkflowRoom(message.roomId);
+			socket.send(JSON.stringify({
+				kind: "unsubscribed",
+				roomId: message.roomId
+			}));
+		} catch (error) {
+			const exception = error instanceof Error ? error : new Error(String(error));
+			if (socket.readyState === WebSocket.OPEN) socket.send(JSON.stringify({
+				kind: "error",
+				message: exception.message
+			}));
+		}
+	}
+	parseWorkflowClientMessage(rawData) {
+		const value = typeof rawData === "string" ? rawData : Buffer.isBuffer(rawData) ? rawData.toString("utf8") : "";
+		const message = JSON.parse(value);
+		if (message.kind === "subscribe" && typeof message.roomId === "string") return {
+			kind: "subscribe",
+			roomId: message.roomId
+		};
+		if (message.kind === "unsubscribe" && typeof message.roomId === "string") return {
+			kind: "unsubscribe",
+			roomId: message.roomId
+		};
+		throw new Error("Unsupported websocket client message.");
+	}
+	retainWorkflowRoom(roomId) {
+		const nextCount = (this.workflowClientCountByRoomId.get(roomId) ?? 0) + 1;
+		this.workflowClientCountByRoomId.set(roomId, nextCount);
+		if (nextCount === 1) this.sendToChildWorkflowSocket({
+			kind: "subscribe",
+			roomId
+		});
+	}
+	releaseWorkflowRoom(roomId) {
+		const currentCount = this.workflowClientCountByRoomId.get(roomId) ?? 0;
+		if (currentCount <= 1) {
+			this.workflowClientCountByRoomId.delete(roomId);
+			this.sendToChildWorkflowSocket({
+				kind: "unsubscribe",
+				roomId
+			});
+			return;
+		}
+		this.workflowClientCountByRoomId.set(roomId, currentCount - 1);
+	}
+	sendToChildWorkflowSocket(message) {
+		if (!this.childWorkflowSocket || this.childWorkflowSocket.readyState !== WebSocket.OPEN) return;
+		this.childWorkflowSocket.send(JSON.stringify(message));
+	}
+	async connectChildWorkflowSocket() {
+		await this.disconnectChildWorkflowSocket();
+		if (!this.activeRuntime || this.activeBuildStatus === "building") return;
+		const childWorkflowSocket = await this.openChildWorkflowSocket(this.activeRuntime.workflowWebSocketPort);
+		this.childWorkflowSocket = childWorkflowSocket;
+		childWorkflowSocket.on("message", (rawData) => {
+			this.handleChildWorkflowSocketMessage(rawData);
+		});
+		childWorkflowSocket.on("close", () => {
+			if (this.childWorkflowSocket === childWorkflowSocket) this.childWorkflowSocket = null;
+		});
+		childWorkflowSocket.on("error", () => {
+			if (this.childWorkflowSocket === childWorkflowSocket) this.childWorkflowSocket = null;
+		});
+		for (const roomId of this.workflowClientCountByRoomId.keys()) this.sendToChildWorkflowSocket({
+			kind: "subscribe",
+			roomId
+		});
+	}
+	openChildWorkflowSocket(workflowWebSocketPort) {
+		return new Promise((resolve, reject) => {
+			const socket = new WebSocket(`ws://127.0.0.1:${workflowWebSocketPort}${ApiPaths.workflowWebsocket()}`);
+			socket.once("open", () => {
+				resolve(socket);
+			});
+			socket.once("error", (error) => {
+				socket.close();
+				reject(error);
+			});
+		});
+	}
+	async disconnectChildWorkflowSocket() {
+		if (!this.childWorkflowSocket) return;
+		const socket = this.childWorkflowSocket;
+		this.childWorkflowSocket = null;
+		await new Promise((resolve) => {
+			socket.once("close", () => {
+				resolve();
+			});
+			socket.close();
+		});
+	}
+	handleChildWorkflowSocketMessage(rawData) {
+		const text = typeof rawData === "string" ? rawData : Buffer.isBuffer(rawData) ? rawData.toString("utf8") : "";
+		if (text.trim().length === 0) return;
+		try {
+			const message = JSON.parse(text);
+			if (message.kind === "event" && typeof message.event?.workflowId === "string") {
+				this.broadcastWorkflowTextToRoom(message.event.workflowId, text);
+				return;
+			}
+			if ((message.kind === "workflowChanged" || message.kind === "devBuildStarted" || message.kind === "devBuildCompleted" || message.kind === "devBuildFailed") && typeof message.workflowId === "string") {
+				this.broadcastWorkflowTextToRoom(message.workflowId, text);
+				return;
+			}
+			if (message.kind === "error" && typeof message.message === "string") this.broadcastWorkflowTextToAll(text);
+		} catch {}
+	}
+	broadcastWorkflowTextToRoom(roomId, text) {
+		for (const [client, roomIds] of this.roomIdsByWorkflowClient) {
+			if (client.readyState !== WebSocket.OPEN || !roomIds.has(roomId)) continue;
+			client.send(text);
+		}
+	}
+	broadcastWorkflowTextToAll(text) {
+		for (const client of this.workflowClients) if (client.readyState === WebSocket.OPEN) client.send(text);
+	}
+};
+
+//#endregion
+//#region src/dev/CliDevProxyServerFactory.ts
+var CliDevProxyServerFactory = class {
+	create(gatewayPort) {
+		return new CliDevProxyServer(gatewayPort);
+	}
+};
+
+//#endregion
+//#region ../host/src/presentation/server/CodemationTsyringeParamInfoReader.ts
+var CodemationTsyringeParamInfoReader = class {
+	static injectionTokenMetadataKey = "injectionTokens";
+	static designParamTypesMetadataKey = "design:paramtypes";
+	static read(target) {
+		const designParamTypes = this.readDesignParamTypes(target);
+		const injectionTokens = this.readInjectionTokens(target);
+		Object.keys(injectionTokens).forEach((key) => {
+			designParamTypes[Number(key)] = injectionTokens[key];
+		});
+		return designParamTypes;
+	}
+	static readDesignParamTypes(target) {
+		const reflected = Reflect.getMetadata?.(this.designParamTypesMetadataKey, target);
+		return Array.isArray(reflected) ? [...reflected] : [];
+	}
+	static readInjectionTokens(target) {
+		const reflected = Reflect.getOwnMetadata?.(this.injectionTokenMetadataKey, target);
+		if (!reflected || typeof reflected !== "object") return {};
+		return reflected;
+	}
+};
+
+//#endregion
+//#region ../host/src/presentation/server/CodemationTsyringeTypeInfoRegistrar.ts
+var CodemationTsyringeTypeInfoRegistrar = class {
+	visitedTokens = /* @__PURE__ */ new Set();
+	visitedConfigObjects = /* @__PURE__ */ new Set();
+	constructor(container) {
+		this.container = container;
+	}
+	registerWorkflowDefinitions(workflows) {
+		for (const workflow of workflows) for (const node of workflow.nodes) {
+			this.registerTypeToken(node.type);
+			this.registerConfigTokens(node.config);
+		}
+	}
+	registerTypeToken(token) {
+		if (typeof token !== "function" || this.visitedTokens.has(token)) return;
+		this.visitedTokens.add(token);
+		const paramInfo = CodemationTsyringeParamInfoReader.read(token);
+		for (const dependency of paramInfo) this.registerDependency(dependency);
+		this.registerFactoryProvider(token, paramInfo);
+	}
+	registerDependency(dependency) {
+		const token = this.resolveDependencyToken(dependency);
+		if (typeof token !== "function") return;
+		if (!this.container.isRegistered(token, true)) return;
+		this.registerTypeToken(token);
+	}
+	registerConfigTokens(value) {
+		if (Array.isArray(value)) {
+			value.forEach((entry) => this.registerConfigTokens(entry));
+			return;
+		}
+		if (!value || typeof value !== "object") return;
+		if (this.visitedConfigObjects.has(value)) return;
+		this.visitedConfigObjects.add(value);
+		if ("type" in value && typeof value.type === "function") this.registerTypeToken(value.type);
+		Object.values(value).forEach((entry) => this.registerConfigTokens(entry));
+	}
+	registerFactoryProvider(token, paramInfo) {
+		if (this.container.isRegistered(token, true)) return;
+		const classToken = token;
+		const constructorToken = token;
+		this.container.register(classToken, { useFactory: (dependencyContainer) => {
+			return new constructorToken(...paramInfo.map((dependency) => this.resolveFactoryDependency(dependencyContainer, dependency)));
+		} });
+	}
+	resolveDependencyToken(dependency) {
+		if (this.isInjectionDescriptor(dependency)) return dependency.token;
+		return dependency;
+	}
+	resolveFactoryDependency(dependencyContainer, dependency) {
+		const token = this.resolveDependencyToken(dependency);
+		if (typeof token === "function") {
+			if (dependencyContainer.isRegistered(token, true)) try {
+				return dependencyContainer.resolve(token);
+			} catch (error) {
+				if (!this.isMissingTypeInfoError(error)) throw error;
+			}
+			this.registerTypeToken(token);
+			return new token(...CodemationTsyringeParamInfoReader.read(token).map((entry) => this.resolveFactoryDependency(dependencyContainer, entry)));
+		}
+		return dependencyContainer.resolve(token);
+	}
+	isInjectionDescriptor(value) {
+		return value !== null && typeof value === "object" && "token" in value;
+	}
+	isMissingTypeInfoError(error) {
+		return error instanceof Error && error.message.includes("TypeInfo not known for");
+	}
+};
+
+//#endregion
+//#region src/dev/DevApiRuntimeHost.ts
+var DevApiRuntimeHost = class {
+	pluginListMerger = new CodemationPluginListMerger();
+	contextPromise = null;
+	constructor(configLoader, pluginDiscovery, args) {
+		this.configLoader = configLoader;
+		this.pluginDiscovery = pluginDiscovery;
+		this.args = args;
+	}
+	async prepare() {
+		if (!this.contextPromise) this.contextPromise = this.createContext();
+		return await this.contextPromise;
+	}
+	async stop() {
+		const contextPromise = this.contextPromise;
+		this.contextPromise = null;
+		if (!contextPromise) return;
+		await (await contextPromise).container.resolve(AppContainerLifecycle$1).stop();
+	}
+	async createContext() {
+		const consumerRoot = path.resolve(this.args.consumerRoot);
+		const repoRoot = await this.detectWorkspaceRoot(consumerRoot);
+		const prismaCliOverride = await this.resolvePrismaCliOverride();
+		const hostPackageRoot = path.resolve(repoRoot, "packages", "host");
+		const env = { ...this.args.env };
+		if (prismaCliOverride) env.CODEMATION_PRISMA_CLI_PATH = prismaCliOverride;
+		env.CODEMATION_HOST_PACKAGE_ROOT = hostPackageRoot;
+		env.CODEMATION_PRISMA_CONFIG_PATH = path.resolve(hostPackageRoot, "prisma.config.ts");
+		env.CODEMATION_CONSUMER_ROOT = consumerRoot;
+		const configResolution = await this.configLoader.load({
+			consumerRoot,
+			repoRoot,
+			env
+		});
+		const discoveredPlugins = await this.loadDiscoveredPlugins(consumerRoot);
+		const appConfig = {
+			...configResolution.appConfig,
+			env,
+			plugins: discoveredPlugins.length > 0 ? this.pluginListMerger.merge(configResolution.appConfig.plugins, discoveredPlugins) : configResolution.appConfig.plugins
+		};
+		const container = await new AppContainerFactory$1().create({
+			appConfig,
+			sharedWorkflowWebsocketServer: null
+		});
+		new CodemationTsyringeTypeInfoRegistrar(container).registerWorkflowDefinitions(appConfig.workflows ?? []);
+		await container.resolve(FrontendRuntime).start();
+		return {
+			buildVersion: this.createBuildVersion(),
+			container,
+			consumerRoot,
+			repoRoot,
+			workflowIds: appConfig.workflows.map((workflow) => workflow.id),
+			workflowSources: appConfig.workflowSources
+		};
+	}
+	async loadDiscoveredPlugins(consumerRoot) {
+		return (await this.pluginDiscovery.resolvePlugins(consumerRoot)).map((resolvedPackage) => resolvedPackage.plugin);
+	}
+	async detectWorkspaceRoot(startDirectory) {
+		let currentDirectory = path.resolve(startDirectory);
+		while (true) {
+			if (await this.exists(path.resolve(currentDirectory, "pnpm-workspace.yaml"))) return currentDirectory;
+			const parentDirectory = path.dirname(currentDirectory);
+			if (parentDirectory === currentDirectory) return startDirectory;
+			currentDirectory = parentDirectory;
+		}
+	}
+	async resolvePrismaCliOverride() {
+		const candidate = path.resolve(this.args.runtimeWorkingDirectory, "node_modules", "prisma", "build", "index.js");
+		return await this.exists(candidate) ? candidate : null;
+	}
+	createBuildVersion() {
+		return `${Date.now()}-${process$1.pid}`;
+	}
+	async exists(filePath) {
+		try {
+			await access(filePath);
+			return true;
+		} catch {
+			return false;
+		}
+	}
+};
+
+//#endregion
+//#region src/dev/DevApiRuntimeServer.ts
+var DevApiRuntimeServer = class {
+	bootstrapLogger = new ServerLoggerFactory(logLevelPolicyFactory).create("codemation-cli.dev-runtime");
+	server = null;
+	constructor(httpPort, workflowWebSocketPort, host) {
+		this.httpPort = httpPort;
+		this.workflowWebSocketPort = workflowWebSocketPort;
+		this.host = host;
+	}
+	async start() {
+		const root = new Hono();
+		root.get("/health", (c) => c.json({ ok: true }));
+		root.all("*", async (c) => {
+			return (await this.host.prepare()).container.resolve(CodemationHonoApiApp).fetch(c.req.raw);
+		});
+		await this.listen(root);
+		try {
+			return await this.host.prepare();
+		} catch (error) {
+			await this.stop();
+			throw error;
+		}
+	}
+	async stop() {
+		const server = this.server;
+		this.server = null;
+		const failures = [];
+		if (server) try {
+			await this.closeServer(server);
+		} catch (error) {
+			failures.push(this.normalizeError(error));
+		}
+		try {
+			await this.host.stop();
+		} catch (error) {
+			failures.push(this.normalizeError(error));
+		}
+		if (failures.length > 0) throw failures[0];
+	}
+	async listen(root) {
+		if (this.server) return;
+		await new Promise((resolve, reject) => {
+			let resolved = false;
+			const server = serve({
+				fetch: root.fetch,
+				port: this.httpPort,
+				hostname: "127.0.0.1"
+			}, () => {
+				resolved = true;
+				this.server = server;
+				resolve();
+			});
+			server.on("error", (error) => {
+				if (resolved) {
+					this.bootstrapLogger.error("runtime HTTP server error", this.normalizeError(error));
+					return;
+				}
+				reject(error);
+			});
+		});
+		this.bootstrapLogger.debug(`runtime listening httpPort=${this.httpPort} workflowWebSocketPort=${this.workflowWebSocketPort}`);
+	}
+	closeServer(server) {
+		return new Promise((resolve, reject) => {
+			server.close((error) => {
+				if (error) {
+					reject(error);
+					return;
+				}
+				resolve();
+			});
+		});
+	}
+	normalizeError(error) {
+		return error instanceof Error ? error : new Error(String(error));
+	}
+};
+
+//#endregion
+//#region src/dev/DevApiRuntimeFactory.ts
+var DevApiRuntimeFactory = class {
+	constructor(portAllocator, configLoader, pluginDiscovery) {
+		this.portAllocator = portAllocator;
+		this.configLoader = configLoader;
+		this.pluginDiscovery = pluginDiscovery;
+	}
+	async create(args) {
+		const httpPort = await this.portAllocator.allocate();
+		const workflowWebSocketPort = await this.portAllocator.allocate();
+		const runtime = new DevApiRuntimeServer(httpPort, workflowWebSocketPort, new DevApiRuntimeHost(this.configLoader, this.pluginDiscovery, {
+			consumerRoot: args.consumerRoot,
+			env: {
+				...args.env,
+				CODEMATION_WS_PORT: String(workflowWebSocketPort),
+				NEXT_PUBLIC_CODEMATION_WS_PORT: String(workflowWebSocketPort)
+			},
+			runtimeWorkingDirectory: args.runtimeWorkingDirectory
+		}));
+		const context = await runtime.start();
+		return {
+			buildVersion: context.buildVersion,
+			httpPort,
+			stop: async () => {
+				await runtime.stop();
+			},
+			workflowIds: context.workflowIds,
+			workflowWebSocketPort
+		};
+	}
+};
+
+//#endregion
+//#region src/dev/DevRebuildQueue.ts
+var DevRebuildQueue = class {
+	pendingRequest = null;
+	drainPromise = null;
+	constructor(handler) {
+		this.handler = handler;
+	}
+	async enqueue(request) {
+		this.pendingRequest = this.mergePendingRequest(this.pendingRequest, request);
+		if (!this.drainPromise) this.drainPromise = this.drain();
+		return await this.drainPromise;
+	}
+	async drain() {
+		try {
+			while (this.pendingRequest) {
+				const nextRequest = this.pendingRequest;
+				this.pendingRequest = null;
+				await this.handler.run(nextRequest);
+			}
+		} finally {
+			this.drainPromise = null;
+			if (this.pendingRequest) {
+				this.drainPromise = this.drain();
+				await this.drainPromise;
+			}
+		}
+	}
+	mergePendingRequest(current, next) {
+		if (!current) return {
+			...next,
+			changedPaths: [...next.changedPaths]
+		};
+		return {
+			changedPaths: [...new Set([...current.changedPaths, ...next.changedPaths])],
+			shouldRepublishConsumerOutput: current.shouldRepublishConsumerOutput || next.shouldRepublishConsumerOutput,
+			shouldRestartUi: current.shouldRestartUi || next.shouldRestartUi
+		};
+	}
+};
+
+//#endregion
+//#region src/dev/DevRebuildQueueFactory.ts
+var DevRebuildQueueFactory = class {
+	create(handler) {
+		return new DevRebuildQueue(handler);
+	}
+};
+
 //#endregion
 //#region src/runtime/ListenPortResolver.ts
 /**
@@ -1476,36 +2294,13 @@ var SourceMapNodeOptions = class {
 	}
 };
 
-//#endregion
-//#region src/dev/DevelopmentGatewayNotifier.ts
-var DevelopmentGatewayNotifier = class {
-	constructor(cliLogger) {
-		this.cliLogger = cliLogger;
-	}
-	async notify(args) {
-		const targetUrl = `${args.gatewayBaseUrl.replace(/\/$/, "")}${ApiPaths.devGatewayNotify()}`;
-		try {
-			const response = await fetch(targetUrl, {
-				method: "POST",
-				headers: {
-					"content-type": "application/json",
-					"x-codemation-dev-token": args.developmentServerToken
-				},
-				body: JSON.stringify(args.payload)
-			});
-			if (!response.ok) this.cliLogger.warn(`failed to notify dev gateway status=${response.status}`);
-		} catch (error) {
-			this.cliLogger.warn(`failed to notify dev gateway: ${error instanceof Error ? error.message : String(error)}`);
-		}
-	}
-};
-
 //#endregion
 //#region src/dev/DevAuthSettingsLoader.ts
 var DevAuthSettingsLoader = class DevAuthSettingsLoader {
 	static defaultDevelopmentAuthSecret = "codemation-dev-auth-secret-not-for-production";
-	constructor(configLoader) {
+	constructor(configLoader, consumerEnvLoader) {
 		this.configLoader = configLoader;
+		this.consumerEnvLoader = consumerEnvLoader;
 	}
 	resolveDevelopmentServerToken(rawToken) {
 		if (rawToken && rawToken.trim().length > 0) return rawToken;
@@ -1513,14 +2308,15 @@ var DevAuthSettingsLoader = class DevAuthSettingsLoader {
 	}
 	async loadForConsumer(consumerRoot) {
 		const resolution = await this.configLoader.load({ consumerRoot });
+		const envForAuthSecret = this.consumerEnvLoader.mergeConsumerRootIntoProcessEnvironment(consumerRoot, process.env);
 		return {
 			authConfigJson: JSON.stringify(resolution.config.auth ?? null),
-			authSecret: this.resolveDevelopmentAuthSecret(process.env),
+			authSecret: this.resolveDevelopmentAuthSecret(envForAuthSecret),
 			skipUiAuth: resolution.config.auth?.allowUnauthenticatedInDevelopment === true
 		};
 	}
 	resolveDevelopmentAuthSecret(env) {
-		const configuredSecret = env.AUTH_SECRET ?? env.NEXTAUTH_SECRET;
+		const configuredSecret = env.AUTH_SECRET;
 		if (configuredSecret && configuredSecret.trim().length > 0) return configuredSecret;
 		return DevAuthSettingsLoader.defaultDevelopmentAuthSecret;
 	}
@@ -1532,8 +2328,8 @@ var DevHttpProbe = class {
 	async waitUntilUrlRespondsOk(url) {
 		for (let attempt = 0; attempt < 200; attempt += 1) {
 			try {
-				const response = await fetch(url);
-				if (response.ok || response.status === 404) return;
+				const response = await fetch(url, { redirect: "manual" });
+				if (response.ok || response.status === 404 || this.isRedirectStatus(response.status)) return;
 			} catch {}
 			await setTimeout$1(50);
 		}
@@ -1547,10 +2343,10 @@ var DevHttpProbe = class {
 			} catch {}
 			await setTimeout$1(50);
 		}
-		throw new Error("Timed out waiting for dev gateway HTTP health check.");
+		throw new Error("Timed out waiting for the stable dev HTTP health check.");
 	}
 	/**
-	* Polls until the runtime child serves bootstrap summary (after gateway is up, the disposable runtime may still be wiring).
+	* Polls until the active disposable runtime serves bootstrap summary through the stable CLI dev endpoint.
 	*/
 	async waitUntilBootstrapSummaryReady(gatewayBaseUrl) {
 		const url = `${gatewayBaseUrl.replace(/\/$/, "")}/api/dev/bootstrap-summary`;
@@ -1562,26 +2358,60 @@ var DevHttpProbe = class {
 		}
 		throw new Error("Timed out waiting for dev runtime bootstrap summary.");
 	}
+	isRedirectStatus(status) {
+		return status >= 300 && status < 400;
+	}
 };
 
 //#endregion
 //#region src/dev/DevNextHostEnvironmentBuilder.ts
 var DevNextHostEnvironmentBuilder = class {
-	constructor(consumerEnvLoader, sourceMapNodeOptions) {
+	constructor(consumerEnvLoader, sourceMapNodeOptions, frontendAuthSnapshotFactory = new CodemationFrontendAuthSnapshotFactory$1(), frontendAppConfigJsonCodec = new FrontendAppConfigJsonCodec$1()) {
 		this.consumerEnvLoader = consumerEnvLoader;
 		this.sourceMapNodeOptions = sourceMapNodeOptions;
+		this.frontendAuthSnapshotFactory = frontendAuthSnapshotFactory;
+		this.frontendAppConfigJsonCodec = frontendAppConfigJsonCodec;
+	}
+	buildConsumerUiProxy(args) {
+		return {
+			...this.build({
+				authConfigJson: args.authConfigJson,
+				authSecret: args.authSecret,
+				consumerRoot: args.consumerRoot,
+				developmentServerToken: args.developmentServerToken,
+				nextPort: args.nextPort,
+				runtimeDevUrl: args.runtimeDevUrl,
+				skipUiAuth: args.skipUiAuth,
+				websocketPort: args.websocketPort,
+				consumerOutputManifestPath: args.consumerOutputManifestPath
+			}),
+			HOSTNAME: "127.0.0.1",
+			AUTH_SECRET: args.authSecret,
+			AUTH_URL: args.publicBaseUrl
+		};
 	}
 	build(args) {
 		const merged = this.consumerEnvLoader.mergeConsumerRootIntoProcessEnvironment(args.consumerRoot, process$1.env);
 		const manifestPath = args.consumerOutputManifestPath ?? path.resolve(args.consumerRoot, ".codemation", "output", "current.json");
+		const authSecret = args.authSecret ?? merged.AUTH_SECRET;
+		const authSnapshot = this.frontendAuthSnapshotFactory.createFromResolvedInputs({
+			authConfig: this.parseAuthConfig(args.authConfigJson),
+			env: {
+				...merged,
+				...typeof authSecret === "string" && authSecret.trim().length > 0 ? { AUTH_SECRET: authSecret } : {}
+			},
+			uiAuthEnabled: !args.skipUiAuth
+		});
 		return {
 			...merged,
 			PORT: String(args.nextPort),
-			CODEMATION_AUTH_CONFIG_JSON: args.authConfigJson,
 			CODEMATION_CONSUMER_ROOT: args.consumerRoot,
 			CODEMATION_CONSUMER_OUTPUT_MANIFEST_PATH: manifestPath,
-			CODEMATION_SKIP_UI_AUTH: args.skipUiAuth ? "true" : "false",
-			NEXT_PUBLIC_CODEMATION_SKIP_UI_AUTH: args.skipUiAuth ? "true" : "false",
+			CODEMATION_FRONTEND_APP_CONFIG_JSON: this.frontendAppConfigJsonCodec.serialize({
+				auth: authSnapshot,
+				productName: "Codemation",
+				logoUrl: null
+			}),
 			CODEMATION_WS_PORT: String(args.websocketPort),
 			NEXT_PUBLIC_CODEMATION_WS_PORT: String(args.websocketPort),
 			CODEMATION_DEV_SERVER_TOKEN: args.developmentServerToken,
@@ -1592,6 +2422,10 @@ var DevNextHostEnvironmentBuilder = class {
 			...args.runtimeDevUrl !== void 0 && args.runtimeDevUrl.trim().length > 0 ? { CODEMATION_RUNTIME_DEV_URL: args.runtimeDevUrl.trim() } : {}
 		};
 	}
+	parseAuthConfig(authConfigJson) {
+		if (authConfigJson.trim().length === 0) return;
+		return JSON.parse(authConfigJson) ?? void 0;
+	}
 };
 
 //#endregion
@@ -1605,7 +2439,7 @@ var DevSessionPortsResolver = class {
 		const nextPort = this.listenPorts.resolvePrimaryApplicationPort(args.portEnv);
 		return {
 			nextPort,
-			gatewayPort: this.listenPorts.parsePositiveInteger(args.gatewayPortEnv) ?? (args.devMode === "consumer" ? nextPort : await this.loopbackPorts.allocate())
+			gatewayPort: this.listenPorts.parsePositiveInteger(args.gatewayPortEnv) ?? (args.devMode === "packaged-ui" ? nextPort : await this.loopbackPorts.allocate())
 		};
 	}
 };
@@ -1616,58 +2450,48 @@ var DevSessionPortsResolver = class {
 * Bundles dependencies for {@link DevCommand} so the command stays a thin orchestrator.
 */
 var DevSessionServices = class {
-	constructor(consumerEnvLoader, sourceMapNodeOptions, sessionPorts, loopbackPortAllocator, devHttpProbe, runtimeEntrypointResolver, devAuthLoader, nextHostEnvBuilder, watchRootsResolver, sourceRestartCoordinator) {
+	constructor(consumerEnvLoader, sourceMapNodeOptions, sessionPorts, loopbackPortAllocator, devHttpProbe, devAuthLoader, nextHostEnvBuilder, watchRootsResolver, sourceChangeClassifier) {
 		this.consumerEnvLoader = consumerEnvLoader;
 		this.sourceMapNodeOptions = sourceMapNodeOptions;
 		this.sessionPorts = sessionPorts;
 		this.loopbackPortAllocator = loopbackPortAllocator;
 		this.devHttpProbe = devHttpProbe;
-		this.runtimeEntrypointResolver = runtimeEntrypointResolver;
 		this.devAuthLoader = devAuthLoader;
 		this.nextHostEnvBuilder = nextHostEnvBuilder;
 		this.watchRootsResolver = watchRootsResolver;
-		this.sourceRestartCoordinator = sourceRestartCoordinator;
+		this.sourceChangeClassifier = sourceChangeClassifier;
 	}
 };
 
 //#endregion
-//#region src/dev/DevSourceRestartCoordinator.ts
-var DevSourceRestartCoordinator = class {
-	constructor(gatewayNotifier, performanceDiagnosticsLogger, cliLogger) {
-		this.gatewayNotifier = gatewayNotifier;
-		this.performanceDiagnosticsLogger = performanceDiagnosticsLogger;
-		this.cliLogger = cliLogger;
-	}
-	async runHandshakeAfterSourceChange(gatewayBaseUrl, developmentServerToken) {
-		const restartStarted = performance.now();
-		try {
-			await this.gatewayNotifier.notify({
-				gatewayBaseUrl,
-				developmentServerToken,
-				payload: { kind: "buildStarted" }
-			});
-			await this.gatewayNotifier.notify({
-				gatewayBaseUrl,
-				developmentServerToken,
-				payload: {
-					kind: "buildCompleted",
-					buildVersion: `${Date.now()}-${process$1.pid}`
-				}
-			});
-			const totalMs = performance.now() - restartStarted;
-			this.performanceDiagnosticsLogger.info(`triggered source-based runtime restart timingMs={total:${totalMs.toFixed(1)}}`);
-		} catch (error) {
-			const exception = error instanceof Error ? error : new Error(String(error));
-			await this.gatewayNotifier.notify({
-				gatewayBaseUrl,
-				developmentServerToken,
-				payload: {
-					kind: "buildFailed",
-					message: exception.message
-				}
-			});
-			this.cliLogger.error("source-based runtime restart request failed", exception);
-		}
+//#region src/dev/DevSourceChangeClassifier.ts
+var DevSourceChangeClassifier = class DevSourceChangeClassifier {
+	static configFileNames = new Set([
+		"codemation.config.ts",
+		"codemation.config.js",
+		"codemation.config.mjs"
+	]);
+	shouldRepublishConsumerOutput(args) {
+		const resolvedConsumerRoot = path.resolve(args.consumerRoot);
+		return args.changedPaths.some((changedPath) => this.isPathInsideDirectory(changedPath, resolvedConsumerRoot));
+	}
+	requiresUiRestart(args) {
+		const resolvedConsumerRoot = path.resolve(args.consumerRoot);
+		return args.changedPaths.some((changedPath) => this.pathRequiresUiRestart(path.resolve(changedPath), resolvedConsumerRoot));
+	}
+	isPathInsideDirectory(filePath, directoryPath) {
+		const resolvedFilePath = path.resolve(filePath);
+		const relativePath = path.relative(directoryPath, resolvedFilePath);
+		return relativePath.length === 0 || !relativePath.startsWith("..") && !path.isAbsolute(relativePath);
+	}
+	pathRequiresUiRestart(resolvedPath, consumerRoot) {
+		if (!this.isPathInsideDirectory(resolvedPath, consumerRoot)) return false;
+		const relativePath = path.relative(consumerRoot, resolvedPath);
+		if (DevSourceChangeClassifier.configFileNames.has(path.basename(relativePath))) return true;
+		if (relativePath.startsWith(path.join("src", "workflows"))) return false;
+		if (relativePath.startsWith(path.join("src", "plugins"))) return false;
+		if (relativePath.includes("credential")) return true;
+		return false;
 	}
 };
 
@@ -1676,7 +2500,7 @@ var DevSourceRestartCoordinator = class {
 var LoopbackPortAllocator = class {
 	async allocate() {
 		return await new Promise((resolve, reject) => {
-			const server = createServer();
+			const server = createServer$1();
 			server.once("error", reject);
 			server.listen(0, "127.0.0.1", () => {
 				const address = server.address();
@@ -1692,52 +2516,20 @@ var LoopbackPortAllocator = class {
 	}
 };
 
-//#endregion
-//#region src/dev/RuntimeToolEntrypointResolver.ts
-var RuntimeToolEntrypointResolver = class {
-	require = createRequire(import.meta.url);
-	async resolve(args) {
-		const sourceEntrypointPath = path.resolve(args.repoRoot, args.sourceEntrypoint);
-		if (await this.exists(sourceEntrypointPath)) return {
-			command: process$1.execPath,
-			args: [
-				"--import",
-				"tsx",
-				sourceEntrypointPath
-			],
-			env: { TSX_TSCONFIG_PATH: path.resolve(args.repoRoot, "tsconfig.codemation-tsx.json") }
-		};
-		return {
-			command: process$1.execPath,
-			args: [this.require.resolve(args.packageName)],
-			env: {}
-		};
-	}
-	async exists(filePath) {
-		try {
-			await access(filePath);
-			return true;
-		} catch {
-			return false;
-		}
-	}
-};
-
 //#endregion
 //#region src/dev/WatchRootsResolver.ts
 var WatchRootsResolver = class {
 	resolve(args) {
-		if (args.devMode === "consumer") return [args.consumerRoot];
+		if (args.devMode === "packaged-ui") return [args.consumerRoot];
 		return [
 			args.consumerRoot,
+			path.resolve(args.repoRoot, "packages", "cli"),
 			path.resolve(args.repoRoot, "packages", "core"),
 			path.resolve(args.repoRoot, "packages", "core-nodes"),
 			path.resolve(args.repoRoot, "packages", "core-nodes-gmail"),
 			path.resolve(args.repoRoot, "packages", "eventbus-redis"),
 			path.resolve(args.repoRoot, "packages", "host"),
-			path.resolve(args.repoRoot, "packages", "node-example"),
-			path.resolve(args.repoRoot, "packages", "queue-bullmq"),
-			path.resolve(args.repoRoot, "packages", "runtime-dev")
+			path.resolve(args.repoRoot, "packages", "node-example")
 		];
 	}
 };
@@ -1745,16 +2537,12 @@ var WatchRootsResolver = class {
 //#endregion
 //#region src/dev/Builder.ts
 var DevSessionServicesBuilder = class {
-	constructor(loggerFactory$1) {
-		this.loggerFactory = loggerFactory$1;
-	}
 	build() {
 		const consumerEnvLoader = new ConsumerEnvLoader();
 		const sourceMapNodeOptions = new SourceMapNodeOptions();
 		const listenPortResolver = new ListenPortResolver();
 		const loopbackPortAllocator = new LoopbackPortAllocator();
-		const cliLogger = this.loggerFactory.create("codemation-cli");
-		return new DevSessionServices(consumerEnvLoader, sourceMapNodeOptions, new DevSessionPortsResolver(listenPortResolver, loopbackPortAllocator), loopbackPortAllocator, new DevHttpProbe(), new RuntimeToolEntrypointResolver(), new DevAuthSettingsLoader(new CodemationConsumerConfigLoader()), new DevNextHostEnvironmentBuilder(consumerEnvLoader, sourceMapNodeOptions), new WatchRootsResolver(), new DevSourceRestartCoordinator(new DevelopmentGatewayNotifier(cliLogger), this.loggerFactory.createPerformanceDiagnostics("codemation-cli.performance"), cliLogger));
+		return new DevSessionServices(consumerEnvLoader, sourceMapNodeOptions, new DevSessionPortsResolver(listenPortResolver, loopbackPortAllocator), loopbackPortAllocator, new DevHttpProbe(), new DevAuthSettingsLoader(new CodemationConsumerConfigLoader(), consumerEnvLoader), new DevNextHostEnvironmentBuilder(consumerEnvLoader, sourceMapNodeOptions), new WatchRootsResolver(), new DevSourceChangeClassifier());
 	}
 };
 
@@ -2027,14 +2815,17 @@ var CliProgram = class {
 		program.command("build").description("Build consumer workflows/plugins output and write the manifest.").option("--consumer-root <path>", "Path to the consumer project root (defaults to cwd)").option("--no-source-maps", "Disable .js.map files for emitted workflow modules (recommended for locked-down production bundles).").option("--target <es2020|es2022>", "ECMAScript language version for emitted workflow JavaScript (default: es2022).", "es2022").action(async (opts) => {
 			await this.buildCommand.execute(resolveConsumerRoot(opts.consumerRoot), this.buildOptionsParser.parse(opts));
 		});
-		program.command("dev", { isDefault: true }).description("Start the dev gateway and runtime child. Default consumer mode uses the packaged Codemation UI; use CODEMATION_DEV_MODE=framework for Next dev HMR when working on the host itself.").option("--consumer-root <path>", "Path to the consumer project root (defaults to cwd)").action(async (opts) => {
-			await this.devCommand.execute(resolveConsumerRoot(opts.consumerRoot));
+		program.command("dev", { isDefault: true }).description("Start the stable dev endpoint and disposable API runtime. Uses the packaged Codemation UI by default.").option("--consumer-root <path>", "Path to the consumer project root (defaults to cwd)").option("--watch-framework", "Use Next dev HMR for framework UI work inside this repository.").action(async (opts) => {
+			await this.devCommand.execute({
+				consumerRoot: resolveConsumerRoot(opts.consumerRoot),
+				watchFramework: opts.watchFramework === true
+			});
 		});
-		const serve = program.command("serve").description("Run production web or worker processes (no dev watchers).");
-		serve.command("web").description("Start the packaged Codemation web host.").option("--consumer-root <path>", "Path to the consumer project root (defaults to cwd)").option("--no-source-maps", "Disable .js.map files for emitted workflow modules when this command runs the consumer build step.").option("--target <es2020|es2022>", "ECMAScript language version for emitted workflow JavaScript when building consumer output (default: es2022).", "es2022").action(async (opts) => {
+		const serve$1 = program.command("serve").description("Run production web or worker processes (no dev watchers).");
+		serve$1.command("web").description("Start the packaged Codemation web host.").option("--consumer-root <path>", "Path to the consumer project root (defaults to cwd)").option("--no-source-maps", "Disable .js.map files for emitted workflow modules when this command runs the consumer build step.").option("--target <es2020|es2022>", "ECMAScript language version for emitted workflow JavaScript when building consumer output (default: es2022).", "es2022").action(async (opts) => {
 			await this.serveWebCommand.execute(resolveConsumerRoot(opts.consumerRoot), this.buildOptionsParser.parse(opts));
 		});
-		serve.command("worker").description("Start the Codemation worker process.").option("--consumer-root <path>", "Path to the consumer project root (defaults to cwd)").option("--config <path>", "Override path to codemation.config.ts / .js").action(async (opts) => {
+		serve$1.command("worker").description("Start the Codemation worker process.").option("--consumer-root <path>", "Path to the consumer project root (defaults to cwd)").option("--config <path>", "Override path to codemation.config.ts / .js").action(async (opts) => {
 			await this.serveWorkerCommand.execute(resolveConsumerRoot(opts.consumerRoot), opts.config);
 		});
 		program.command("db").description("Database utilities (PostgreSQL / Prisma).").command("migrate").description("Apply pending Prisma migrations using the consumer database URL (DATABASE_URL in `.env`, or CodemationConfig.runtime.database.url).").option("--consumer-root <path>", "Path to the consumer project root (defaults to cwd)").option("--config <path>", "Override path to codemation.config.ts / .js").action(async (opts) => {
@@ -2107,7 +2898,9 @@ var NextHostConsumerServerCommandFactory = class {
 			args: [
 				"exec",
 				"next",
-				"start"
+				"start",
+				"-H",
+				"127.0.0.1"
 			],
 			cwd: args.nextHostRoot
 		};
@@ -2126,8 +2919,12 @@ var NextHostConsumerServerCommandFactory = class {
 //#region src/runtime/TypeScriptRuntimeConfigurator.ts
 var TypeScriptRuntimeConfigurator = class {
 	configure(repoRoot) {
+		if (this.hasExplicitOverride()) return;
 		process$1.env.CODEMATION_TSCONFIG_PATH = path.resolve(repoRoot, "tsconfig.base.json");
 	}
+	hasExplicitOverride() {
+		return typeof process$1.env.CODEMATION_TSCONFIG_PATH === "string" && process$1.env.CODEMATION_TSCONFIG_PATH.length > 0;
+	}
 };
 
 //#endregion
@@ -2179,22 +2976,20 @@ var CliDatabaseUrlDescriptor = class {
 //#endregion
 //#region src/bootstrap/CodemationCliApplicationSession.ts
 /**
-* Opens a {@link CodemationApplication} with persistence + command/query buses (no HTTP/WebSocket servers),
+* Opens an app container with persistence + command/query buses (no HTTP/WebSocket servers),
 * for CLI tools that dispatch application commands or queries (e.g. user admin).
 */
 var CodemationCliApplicationSession = class CodemationCliApplicationSession {
-	constructor(application) {
-		this.application = application;
+	constructor(container) {
+		this.container = container;
 	}
 	static async open(args) {
-		const app = new CodemationApplication().useConfig(args.resolution.config);
-		await app.bootCli(new CodemationBootstrapRequest({
-			repoRoot: args.bootstrap.repoRoot,
-			consumerRoot: args.bootstrap.consumerRoot,
-			env: args.bootstrap.env,
-			workflowSources: args.resolution.workflowSources
-		}));
-		return new CodemationCliApplicationSession(app);
+		const container = await new AppContainerFactory().create({
+			appConfig: args.appConfig,
+			sharedWorkflowWebsocketServer: null
+		});
+		if (args.appConfig.env.CODEMATION_SKIP_STARTUP_MIGRATIONS !== "true") await container.resolve(DatabaseMigrations).migrate();
+		return new CodemationCliApplicationSession(container);
 	}
 	getPrismaClient() {
 		const container = this.getContainer();
@@ -2208,10 +3003,10 @@ var CodemationCliApplicationSession = class CodemationCliApplicationSession {
 		return this.getContainer().resolve(ApplicationTokens.QueryBus);
 	}
 	async close() {
-		await this.application.stop({ stopWebsocketServer: false });
+		await this.container.resolve(AppContainerLifecycle).stop({ stopWebsocketServer: false });
 	}
 	getContainer() {
-		return this.application.getContainer();
+		return this.container;
 	}
 };
 
@@ -2221,37 +3016,26 @@ var CodemationCliApplicationSession = class CodemationCliApplicationSession {
 * Shared env/config/session wiring for `codemation user *` commands (local auth + database).
 */
 var UserAdminCliBootstrap = class {
-	constructor(configLoader, pathResolver, consumerDotenvLoader, tsconfigPreparation, databasePersistenceResolver) {
-		this.configLoader = configLoader;
+	constructor(appConfigLoader, pathResolver, consumerDotenvLoader, tsconfigPreparation) {
+		this.appConfigLoader = appConfigLoader;
 		this.pathResolver = pathResolver;
 		this.consumerDotenvLoader = consumerDotenvLoader;
 		this.tsconfigPreparation = tsconfigPreparation;
-		this.databasePersistenceResolver = databasePersistenceResolver;
 	}
 	async withSession(options, fn) {
 		const consumerRoot = options.consumerRoot ?? process.cwd();
 		this.consumerDotenvLoader.load(consumerRoot);
 		this.tsconfigPreparation.applyWorkspaceTsconfigForTsxIfPresent(consumerRoot);
-		const resolution = await this.configLoader.load({
+		const paths = await this.pathResolver.resolve(consumerRoot);
+		const loadResult = await this.appConfigLoader.load({
 			consumerRoot,
-			configPathOverride: options.configPath
-		});
-		if (resolution.config.auth?.kind !== "local") throw new Error("Codemation user commands require CodemationConfig.auth.kind to be \"local\".");
-		if (this.databasePersistenceResolver.resolve({
-			runtimeConfig: resolution.config.runtime ?? {},
+			repoRoot: paths.repoRoot,
 			env: process.env,
-			consumerRoot
-		}).kind === "none") throw new Error("Database persistence is not configured. Set CodemationConfig.runtime.database (postgresql URL or PGlite).");
-		const paths = await this.pathResolver.resolve(consumerRoot);
-		const session = await CodemationCliApplicationSession.open({
-			resolution,
-			bootstrap: new CodemationBootstrapRequest({
-				repoRoot: paths.repoRoot,
-				consumerRoot,
-				env: process.env,
-				workflowSources: resolution.workflowSources
-			})
+			configPathOverride: options.configPath
 		});
+		if (loadResult.appConfig.auth?.kind !== "local") throw new Error("Codemation user commands require CodemationConfig.auth.kind to be \"local\".");
+		if (loadResult.appConfig.persistence.kind === "none") throw new Error("Database persistence is not configured. Set CodemationConfig.runtime.database (postgresql URL or PGlite).");
+		const session = await CodemationCliApplicationSession.open({ appConfig: loadResult.appConfig });
 		try {
 			return await fn(session);
 		} finally {
@@ -2305,6 +3089,7 @@ const loggerFactory = new ServerLoggerFactory(logLevelPolicyFactory);
 var CliProgramFactory = class {
 	create() {
 		const cliLogger = loggerFactory.create("codemation-cli");
+		const appConfigLoader = new AppConfigLoader();
 		const pathResolver = new CliPathResolver();
 		const pluginDiscovery = new CodemationPluginDiscovery();
 		const artifactsPublisher = new ConsumerBuildArtifactsPublisher();
@@ -2312,15 +3097,15 @@ var CliProgramFactory = class {
 		const outputBuilderLoader = new ConsumerOutputBuilderLoader();
 		const sourceMapNodeOptions = new SourceMapNodeOptions();
 		const nextHostConsumerServerCommandFactory = new NextHostConsumerServerCommandFactory();
+		const devSessionServices = new DevSessionServicesBuilder().build();
 		const tsconfigPreparation = new ConsumerCliTsconfigPreparation();
-		const databasePersistenceResolver = new DatabasePersistenceResolver();
-		const userAdminBootstrap = new UserAdminCliBootstrap(new CodemationConsumerConfigLoader(), pathResolver, new UserAdminConsumerDotenvLoader(), tsconfigPreparation, databasePersistenceResolver);
+		const userAdminBootstrap = new UserAdminCliBootstrap(appConfigLoader, pathResolver, new UserAdminConsumerDotenvLoader(), tsconfigPreparation);
 		const hostPackageRoot = new HostPackageRootResolver().resolveHostPackageRoot();
 		const userAdminCliOptionsParser = new UserAdminCliOptionsParser();
 		const databaseMigrationsApplyService = new DatabaseMigrationsApplyService(cliLogger, new UserAdminConsumerDotenvLoader(), tsconfigPreparation, new CodemationConsumerConfigLoader(), new ConsumerDatabaseConnectionResolver(), new CliDatabaseUrlDescriptor(), hostPackageRoot, new PrismaMigrationDeployer());
 		const buildOptionsParser = new ConsumerBuildOptionsParser();
 		const devConsumerPublishBootstrap = new DevConsumerPublishBootstrap(cliLogger, pluginDiscovery, artifactsPublisher, outputBuilderLoader, buildOptionsParser);
-		return new CliProgram(buildOptionsParser, new BuildCommand(cliLogger, pathResolver, pluginDiscovery, artifactsPublisher, tsRuntime, outputBuilderLoader), new DevCommand(pathResolver, pluginDiscovery, tsRuntime, new DevLockFactory(), new DevSourceWatcherFactory(), cliLogger, new DevSessionServicesBuilder(loggerFactory).build(), databaseMigrationsApplyService, new DevBootstrapSummaryFetcher(), new DevCliBannerRenderer(), devConsumerPublishBootstrap, new ConsumerEnvDotenvFilePredicate(), new DevTrackedProcessTreeKiller(), nextHostConsumerServerCommandFactory), new ServeWebCommand(pathResolver, pluginDiscovery, artifactsPublisher, tsRuntime, sourceMapNodeOptions, outputBuilderLoader, new ConsumerEnvLoader(), new ListenPortResolver(), nextHostConsumerServerCommandFactory), new ServeWorkerCommand(sourceMapNodeOptions), new DbMigrateCommand(databaseMigrationsApplyService), new UserCreateCommand(new LocalUserCreator(userAdminBootstrap), userAdminCliOptionsParser), new UserListCommand(cliLogger, userAdminBootstrap, new CliDatabaseUrlDescriptor(), userAdminCliOptionsParser));
+		return new CliProgram(buildOptionsParser, new BuildCommand(cliLogger, pathResolver, pluginDiscovery, artifactsPublisher, tsRuntime, outputBuilderLoader), new DevCommand(pathResolver, tsRuntime, new DevLockFactory(), new DevSourceWatcherFactory(), cliLogger, devSessionServices, databaseMigrationsApplyService, new DevBootstrapSummaryFetcher(), new DevCliBannerRenderer(), devConsumerPublishBootstrap, new ConsumerEnvDotenvFilePredicate(), new DevTrackedProcessTreeKiller(), nextHostConsumerServerCommandFactory, new DevApiRuntimeFactory(devSessionServices.loopbackPortAllocator, appConfigLoader, pluginDiscovery), new CliDevProxyServerFactory(), new DevRebuildQueueFactory()), new ServeWebCommand(pathResolver, new CodemationConsumerConfigLoader(), pluginDiscovery, artifactsPublisher, tsRuntime, sourceMapNodeOptions, outputBuilderLoader, new ConsumerEnvLoader(), new ListenPortResolver(), nextHostConsumerServerCommandFactory, new CodemationFrontendAuthSnapshotFactory(), new FrontendAppConfigJsonCodec()), new ServeWorkerCommand(pathResolver, appConfigLoader, new AppContainerFactory()), new DbMigrateCommand(databaseMigrationsApplyService), new UserCreateCommand(new LocalUserCreator(userAdminBootstrap), userAdminCliOptionsParser), new UserListCommand(cliLogger, userAdminBootstrap, new CliDatabaseUrlDescriptor(), userAdminCliOptionsParser));
 	}
 };