@geekmidas/cli 10.0.0-alpha.24 → 10.0.0-alpha.26

package/dist/index.mjs

@@ -1,15 +1,15 @@
 #!/usr/bin/env -S npx tsx
 import { n as __require, t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
-import { i as DEFAULT_CACHE, r as ConstructGenerator, s as isPartitionedRoutes, t as discover } from "./discover-CK-n3w6b.mjs";
-import { i as loadConfig, l as derivedApps, n as getAppNameFromCwd, o as loadWorkspaceConfig, r as loadAppConfig, s as parseModuleConfig } from "./config-DdKkoUE1.mjs";
+import { i as DEFAULT_CACHE, r as ConstructGenerator, s as isPartitionedRoutes, t as discover } from "./discover-0fhCbnk0.mjs";
+import { i as loadConfig, l as derivedApps, n as getAppNameFromCwd, o as loadWorkspaceConfig, r as loadAppConfig, s as parseModuleConfig } from "./config-DBGpRTUy.mjs";
 import { A as stripPublicPrefix, C as InvalidStages, D as stageProblems, E as deployedProblems, T as assertDeployedStage, a as getAppBuildOrder, k as getPublicEnvPrefix, o as getAppGkmConfig, s as getDependencyEnvVars, t as allConstructGlobs, v as getDeployTargetError, w as TEST_STAGE, y as isDeployTargetSupported } from "./workspace-Bu3xNCej.mjs";
-import { C as providerOf, S as eventsBackendFor, _ as COMPOSE_PATH, a as loadEnvFiles, b as resourceName, c as resolveServicePorts, d as backendsOf, f as constructGlobs, h as usesConstructs, i as isPortAvailable, l as rewriteUrlsWithPorts, m as reconcileWorkspace, n as createEntryWrapper, o as loadSecretsForApp, p as derivedContainers, r as findAvailablePort, s as prepareEntryCredentials, t as createCredentialsPreload, u as startWorkspaceServices, v as LOCAL_CA_PATH, w as storageBackendFor, x as cacheBackendFor, y as applyPostgres } from "./credentials-D9TKJJZc.mjs";
+import { C as providerOf, S as eventsBackendFor, _ as COMPOSE_PATH, a as loadEnvFiles, b as resourceName, c as resolveServicePorts, d as backendsOf, f as constructGlobs, h as usesConstructs, i as isPortAvailable, l as rewriteUrlsWithPorts, m as reconcileWorkspace, n as createEntryWrapper, o as loadSecretsForApp, p as derivedContainers, r as findAvailablePort, s as prepareEntryCredentials, t as createCredentialsPreload, u as startWorkspaceServices, v as LOCAL_CA_PATH, w as storageBackendFor, x as cacheBackendFor, y as applyPostgres } from "./credentials-DI9kJcaP.mjs";
 import { a as generateServiceCredentials, i as generateSecurePassword, n as generateConnectionUrls, o as rotateServicePassword, t as createStageSecrets } from "./generator-LfZU7NlU.mjs";
 import { c as getKeyPath, i as setCustomSecret, n as readStageSecrets, o as toEmbeddableSecrets, r as secretsExist, s as writeStageSecrets, t as maskPassword } from "./storage-TP0x118M.mjs";
-import { a as openapiCommand, c as EndpointGenerator, l as runtimeFor, n as generateOpenApi, o as resolveOpenApiConfig, r as generateOpenApiFrom, s as OpenApiTsGenerator, t as OPENAPI_OUTPUT_PATH$1 } from "./openapi-Co2Tv7zh.mjs";
+import { a as openapiCommand, c as EndpointGenerator, l as runtimeFor, n as generateOpenApi, o as resolveOpenApiConfig, s as OpenApiTsGenerator, t as OPENAPI_OUTPUT_PATH$1 } from "./openapi-DHQlstv6.mjs";
 import { i as withRoutes, r as withCompute } from "./emit-Bzq7JsMP.mjs";
 import { i as writeDockerEnvFromSecrets, r as generateFullstackCustomSecrets } from "./reconcile-gb1lz1Dk.mjs";
-import { a as isRemoteStore, n as pullStageSecrets, r as pushStageSecrets, t as NoStoredSecrets } from "./transfer-Bk5YlRyB.mjs";
+import { a as isRemoteStore, n as pullStageSecrets, r as pushStageSecrets, t as NoStoredSecrets } from "./transfer-CAJs_vhu.mjs";
 import { createRequire } from "node:module";
 import { Command } from "commander";
 import { stdin, stdout } from "node:process";
@@ -28,18 +28,18 @@ import { ownerRole, readerRole, roleStatements } from "@geekmidas/db/pg/roles";
 import { Client } from "pg";
 import { promisify } from "node:util";
 import { cacheTableStatements } from "@geekmidas/cache/postgres";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { Cron } from "@geekmidas/constructs/crons";
 import { Function } from "@geekmidas/constructs/functions";
 import { Queue } from "@geekmidas/constructs/queue";
 import { Subscriber } from "@geekmidas/constructs/subscribers";
 import { Topic } from "@geekmidas/constructs/topic";
-import { fileURLToPath, pathToFileURL } from "node:url";
 import { lookup } from "node:dns/promises";
 import prompts from "prompts";
 import { EnvironmentParser } from "@geekmidas/envkit";
 import { serviceContext } from "@geekmidas/services";
 //#region package.json
-var version = "10.0.0-alpha.24";
+var version = "10.0.0-alpha.26";
 //#endregion
 //#region src/auth/credentials.ts
 /**
@@ -324,76 +324,6 @@ function maskToken(token) {
 	return `${token.slice(0, 4)}...${token.slice(-4)}`;
 }
 //#endregion
-//#region src/build/owners.ts
-/**
-* What a generated entry imports its runtime from, read off the discovered
-* constructs: the surface it serves, every construct a runnable can be built
-* from, and the database Studio browses.
-*
-* `gkm build` and `gkm dev` both write entries that import the surface for its
-* logger and environment parser, so both ask here. A dev server that skipped it
-* had nothing to import them from.
-*/
-function ownersContext(options) {
-	const { declared, sources, workspaceRoot, appRoot, studio } = options;
-	const surfaces = restApis(declared);
-	const primary = servedSurface(declared, workspaceRoot, appRoot) ?? surfaces.find((d) => d.endpoints.length === 0) ?? surfaces[0];
-	const browsable = Object.entries(declared).find(([, d]) => d.kind === "database");
-	const browsableSource = browsable ? sources[browsable[0]] : void 0;
-	const owners = {};
-	for (const [id, declaration] of Object.entries(declared)) {
-		if (declaration.kind !== "rest-api" && declaration.kind !== "worker") continue;
-		const source = sources[id];
-		if (!source) continue;
-		owners[id] = {
-			specifier: source.file,
-			exportName: source.exportName
-		};
-	}
-	const primarySource = primary ? sources[primary.id] : void 0;
-	return {
-		owners,
-		...primary ? { surface: {
-			id: primary.id,
-			trustedOriginsKey: provideKey(primary.id, "trustedOrigins"),
-			...primary.cors ? { cors: primary.cors } : {},
-			...primarySource ? { module: {
-				specifier: primarySource.file,
-				exportName: primarySource.exportName
-			} } : {}
-		} } : {},
-		studio: studio && browsableSource ? {
-			...studio,
-			database: {
-				specifier: browsableSource.file,
-				exportName: browsableSource.exportName
-			}
-		} : studio
-	};
-}
-/**
-* The endpoints one surface serves.
-*
-* One glob finds every surface's endpoints, wherever their files live. A build
-* keeps the ones built from the surface it serves; one built from no surface at
-* all has nowhere else to go.
-*/
-function servedBy(endpoints, surface) {
-	if (!surface) return endpoints;
-	return endpoints.filter(({ construct }) => !construct.surface || construct.surface.id === surface.id);
-}
-function restApis(declared) {
-	return Object.values(declared).filter((d) => d.kind === "rest-api");
-}
-/**
-* The surface whose declared `path` is the directory being built — asked of
-* every surface, because a workspace has several and each app's build serves
-* exactly one.
-*/
-function servedSurface(declared, workspaceRoot, appRoot) {
-	return restApis(declared).find((d) => resolve(workspaceRoot, d.path) === resolve(appRoot));
-}
-//#endregion
 //#region src/build/providerResolver.ts
 /**
 * Resolves provider configuration from the new simplified system
@@ -464,1786 +394,1845 @@ function isEnabled(config) {
 	return config.enabled !== false;
 }
 //#endregion
-//#region src/generators/CronGenerator.ts
-var CronGenerator = class extends ConstructGenerator {
-	async build(context, constructs, outputDir, options) {
-		const provider = options?.provider || "aws-lambda";
-		const logger = console;
-		const cronInfos = [];
-		if (provider === "server") {
-			await this.generateServerCronsFile(outputDir, constructs);
-			logger.log(`Generated server crons file with ${constructs.length} crons`);
-			return cronInfos;
-		}
-		if (constructs.length === 0 || provider !== "aws-lambda") return cronInfos;
-		const cronsDir = join(outputDir, "crons");
-		await mkdir(cronsDir, { recursive: true });
-		for (const { key, construct, path } of constructs) {
-			const handlerFile = await this.generateCronHandler(cronsDir, path.relative, key, context, construct.owner);
-			cronInfos.push({
-				name: key,
-				handler: relative(process.cwd(), handlerFile).replace(/\.ts$/, ".handler"),
-				schedule: construct.schedule || "rate(1 hour)",
-				timeout: construct.timeout,
-				memorySize: construct.memorySize,
-				environment: await construct.getEnvironment({ markOptional: context.markOptional }),
-				dependencies: construct.constructs
-			});
-			logger.log(`Generated cron handler: ${key}`);
+//#region src/workspace/client-generator.ts
+/**
+* Normalize routes to an array of patterns.
+* Handles string, string[], and PartitionedRoutes (extracts paths).
+* @internal Exported for use in dev command
+*/
+function normalizeRoutes(routes) {
+	if (!routes) return [];
+	if (isPartitionedRoutes(routes)) return Array.isArray(routes.paths) ? routes.paths : [routes.paths];
+	return Array.isArray(routes) ? routes : [routes];
+}
+//#endregion
+//#region src/exec/index.ts
+const logger$12 = console;
+/** `gkm exec` was given nothing to run. */
+var NoCommandSpecified = class extends Error {
+	constructor() {
+		super("No command specified. Usage: gkm exec -- <command>");
+		this.name = "NoCommandSpecified";
+	}
+};
+/**
+* Run a command with secrets injected into Credentials.
+* Uses Node's --import flag to preload a script that populates Credentials
+* before the command loads any modules that depend on them.
+*
+* @example
+* ```bash
+* gkm exec -- npx @better-auth/cli migrate
+* gkm exec -- npx prisma migrate dev
+* ```
+*/
+async function execCommand(commandArgs, options = {}) {
+	const cwd = options.cwd ?? process.cwd();
+	if (!commandArgs[0]) throw new NoCommandSpecified();
+	const defaultEnv = loadEnvFiles(".env");
+	if (defaultEnv.loaded.length > 0) logger$12.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
+	const { credentials, secretsJsonPath, appName } = await prepareEntryCredentials({
+		cwd,
+		resolveDockerPorts: "readonly"
+	});
+	if (appName) logger$12.log(`📦 App: ${appName}`);
+	const secretCount = Object.keys(credentials).filter((k) => k !== "PORT").length;
+	if (secretCount > 0) logger$12.log(`🔐 Loaded ${secretCount} secret(s)`);
+	const preloadDir = join(cwd, ".gkm");
+	await mkdir(preloadDir, { recursive: true });
+	const preloadPath = join(preloadDir, "credentials-preload.mjs");
+	await createCredentialsPreload(preloadPath, secretsJsonPath);
+	const [cmd, ...args] = commandArgs;
+	logger$12.log(`🚀 Running: ${[cmd, ...args].join(" ")}`);
+	const nodeOptions = [(process.env.NODE_OPTIONS ?? "").replace(/--import[= ]\S+/g, "").trim(), `--import=${preloadPath}`].filter(Boolean).join(" ");
+	const child = spawn(cmd, args, {
+		cwd,
+		stdio: "inherit",
+		env: {
+			...process.env,
+			...credentials,
+			NODE_OPTIONS: nodeOptions
 		}
-		return cronInfos;
+	});
+	const exitCode = await new Promise((resolve) => {
+		child.on("close", (code) => resolve(code ?? 0));
+		child.on("error", (error) => {
+			logger$12.error(`Failed to run command: ${error.message}`);
+			resolve(1);
+		});
+	});
+	if (exitCode !== 0) process.exit(exitCode);
+}
+//#endregion
+//#region src/dev/index.ts
+const logger$11 = console;
+/**
+* Normalize telescope configuration
+* @internal Exported for testing
+*/
+function normalizeTelescopeConfig(config) {
+	if (config === false) return;
+	if (typeof config === "string") {
+		const { path: telescopePath, importPattern: telescopeImportPattern } = parseModuleConfig(config, "telescope");
+		return {
+			enabled: true,
+			telescopePath,
+			telescopeImportPattern,
+			path: "/__telescope",
+			ignore: [],
+			recordBody: true,
+			maxEntries: 1e3,
+			websocket: true
+		};
 	}
-	isConstruct(value) {
-		return Cron.isCron(value);
+	if (!(config === true || config === void 0 || config.enabled !== false)) return;
+	const telescopeConfig = typeof config === "object" ? config : {};
+	return {
+		enabled: true,
+		path: telescopeConfig.path ?? "/__telescope",
+		ignore: telescopeConfig.ignore ?? [],
+		recordBody: telescopeConfig.recordBody ?? true,
+		maxEntries: telescopeConfig.maxEntries ?? 1e3,
+		websocket: telescopeConfig.websocket ?? true
+	};
+}
+/**
+* Normalize studio configuration
+* @internal Exported for testing
+*/
+function normalizeStudioConfig(config) {
+	if (config === false) return;
+	if (typeof config === "string") {
+		const { path: studioPath, importPattern: studioImportPattern } = parseModuleConfig(config, "studio");
+		return {
+			enabled: true,
+			studioPath,
+			studioImportPattern,
+			path: "/__studio",
+			schema: "public"
+		};
 	}
-	/**
-	* The crons file a server entry imports.
-	*
-	* Shaped after `generateServerSubscribersFile`: one module, every cron, a
-	* `setupCrons` the generated entry calls beside `setupSubscribers`.
-	*
-	* It picks its scheduler from what the process can reach. With a Postgres it
-	* uses pg-boss, whose schedules live in the database — so a deployment
-	* running four replicas fires each job once, which is the thing a timer in
-	* every process gets wrong and does not report. With no database it falls
-	* back to timers and says plainly that it is doing so.
-	*/
-	async generateServerCronsFile(outputDir, crons) {
-		await mkdir(outputDir, { recursive: true });
-		const cronsPath = join(outputDir, "crons.ts");
-		const importsByFile = /* @__PURE__ */ new Map();
-		for (const { path, key } of crons) {
-			const importPath = relative(dirname(cronsPath), path.relative).replace(/\.ts$/, ".js");
-			if (!importsByFile.has(importPath)) importsByFile.set(importPath, []);
-			importsByFile.get(importPath)?.push(key);
-		}
-		const content = `/**
- * Generated cron setup.
- *
- * Schedules every cron this app declares, in the process that serves it.
- *
- * The schedule lives in Postgres, through pg-boss, in the database the worker
- * named with \`.database(db)\`. That is what makes running several replicas
- * safe: each job fires once, where a timer in every process fires it once per
- * replica and reports nothing.
- *
- * No connection string appears here. The construct that owns the database is
- * the only thing that knows its key, and it is resolved through service
- * discovery like any other dependency.
- */
-import type { EnvironmentParser } from '@geekmidas/envkit';
-import type { Logger } from '@geekmidas/logger';
-import { toCronExpression } from '@geekmidas/constructs/crons';
-import { ServiceDiscovery } from '@geekmidas/services';
-${Array.from(importsByFile.entries()).map(([importPath, exports]) => `import { ${exports.join(", ")} } from '${importPath}';`).join("\n")}
-
-const crons = [
-${crons.map(({ key }) => `  { name: '${key}', cron: ${key} }`).join(",\n")}
-];
-
-type Stoppable = { stop: () => Promise<void> | void };
-const running: Stoppable[] = [];
-
-export async function setupCrons(
-  envParser: EnvironmentParser<any>,
-  logger: Logger,
-): Promise<void> {
-  if (crons.length === 0) {
-    return;
-  }
-
-  const serviceDiscovery = ServiceDiscovery.getInstance(envParser);
-
-  // Resolved once per cron rather than per firing: registering services on
-  // every tick would reconnect a database every minute.
-  const prepared = [];
-  for (const { name, cron } of crons) {
-    try {
-      const schedule = toCronExpression(cron.schedule);
-      const services = cron.services.length > 0
-        ? await serviceDiscovery.register(cron.services)
-        : {};
-
-      prepared.push({ name, cron, schedule, services });
-    } catch (error) {
-      // An unrepresentable schedule is a build-time mistake, and failing the
-      // process for it would take the HTTP server down with it.
-      logger.error({ error, cron: name }, 'Cron has no runnable schedule, skipping');
-    }
-  }
-
-  const run = async (entry: (typeof prepared)[number]) => {
-    try {
-      await entry.cron.handler({
-        input: undefined,
-        services: entry.services,
-        logger: entry.cron.logger,
-      });
-    } catch (error) {
-      logger.error({ error, cron: entry.name }, 'Cron failed');
-    }
-  };
-
-  // Declared once on the worker, carried onto every cron it built — so this
-  // reads it from any of them rather than from config or the environment.
-  const scheduleStore = prepared.find(({ cron }) => cron.scheduleStore)?.cron
-    .scheduleStore;
-
-  if (!scheduleStore) {
-    // Declared, not discovered. A worker says where its schedules live with
-    // \`.database(db)\`; inferring one from whatever database happened to be
-    // around would move the schedules the day an app declared a second.
-    logger.error(
-      { crons: prepared.map(({ name }) => name) },
-      'These crons have nowhere to keep their schedule. A server fires its own ' +
-        'crons, and a process scheduling in memory fires each job once per ' +
-        'replica — so the schedule lives in Postgres. Say where with ' +
-        '\`new Worker(…).database(db)\`.',
-    );
-    return;
-  }
-
-  const [store] = await serviceDiscovery
-    .register([scheduleStore])
-    .then((s) => Object.values(s));
-
-  const { PgBoss } = await import('pg-boss');
-  // The pool the construct already opened — no connection string is read here,
-  // and none is named anywhere outside the construct that owns it.
-  const boss = new PgBoss({ db: store as never });
-  await boss.start();
-
-  // What this app declares now. Anything else under the prefix belonged to a
-  // cron since renamed or deleted, and would keep firing at a handler that has
-  // gone.
-  //
-  // The prefix is \`cron.\` rather than \`cron:\`: pg-boss accepts
-  // alphanumerics, underscores, hyphens, periods and slashes in a queue name,
-  // and rejects a colon outright.
-  const declared = new Set(prepared.map(({ name }) => \`cron.\${name}\`));
-  for (const existing of await boss.getSchedules()) {
-    if (existing.name.startsWith('cron.') && !declared.has(existing.name)) {
-      await boss.unschedule(existing.name);
-      logger.info({ cron: existing.name }, 'Removed a schedule nothing declares');
-    }
-  }
-
-  for (const entry of prepared) {
-    const queue = \`cron.\${entry.name}\`;
-    await boss.createQueue(queue);
-    // UTC, so this agrees with the schedule a deploy target would have made.
-    await boss.schedule(queue, entry.schedule, undefined, { tz: 'UTC' });
-    await boss.work(queue, () => run(entry));
-
-    logger.info({ cron: entry.name, schedule: entry.schedule }, 'Cron scheduled');
-  }
-
-  running.push({ stop: () => boss.stop() });
-  logger.info({ count: prepared.length }, 'Crons scheduled');
-}
-
-export async function stopCrons(): Promise<void> {
-  await Promise.all(running.map((r) => r.stop()));
-  running.length = 0;
+	if (!(config === true || config === void 0 || config.enabled !== false)) return;
+	const studioConfig = typeof config === "object" ? config : {};
+	return {
+		enabled: true,
+		path: studioConfig.path ?? "/__studio",
+		schema: studioConfig.schema ?? "public"
+	};
 }
-`;
-		await writeFile(cronsPath, content);
-		return cronsPath;
-	}
-	async generateCronHandler(outputDir, sourceFile, exportName, context, owner) {
-		const handlerFileName = `${exportName}.ts`;
-		const handlerPath = join(outputDir, handlerFileName);
-		const importPath = relative(dirname(handlerPath), sourceFile).replace(/\.ts$/, ".js");
-		const runtime = runtimeFor(context, dirname(handlerPath), owner);
-		const content = `import { AWSScheduledFunction } from '@geekmidas/constructs/aws';
-import { ${exportName} } from '${importPath}';
-${runtime.imports}
-${runtime.bindings}
-
-const adapter = new AWSScheduledFunction(envParser, ${exportName});
-
-export const handler = adapter.handler;
-`;
-		await writeFile(handlerPath, content);
-		return handlerPath;
-	}
-};
-//#endregion
-//#region src/generators/drivers.ts
-/**
-* Driver registration for generated entry points.
-*
-* A construct declares that it needs object storage and is handed one URL; the
-* scheme in that URL picks the driver that builds the client. Which drivers
-* exist is therefore the *entry point's* decision, not the construct's and not
-* the application's — an app that never talks to S3 should never resolve the AWS
-* SDK, and application code that registers a driver has named a provider in the
-* one layer this design keeps provider-free.
-*
-* So the generated entries register: `gkm dev`'s server for local development,
-* and each Lambda handler for its own target. Registration is an explicit call
-* rather than an import side effect, because a side-effecting module is exactly
-* what a bundler is entitled to drop.
-*/
-/** The `s3://` driver, which serves MinIO locally and S3 deployed. */
-const S3 = {
-	imports: `import { registerStorageDriver } from '@geekmidas/storage';\nimport { s3Driver } from '@geekmidas/storage/aws';`,
-	setup: "registerStorageDriver(s3Driver);"
-};
-const NONE = {
-	imports: "",
-	setup: ""
-};
 /**
-* The cache driver for a backend — exactly one, never all three.
-*
-* Keyed off the *backend* rather than off a dependency, because unlike storage
-* the backend already says which driver is right: a project caching in Postgres
-* resolves `pg` and never `ioredis`, and one caching in Upstash resolves
-* neither. That is the whole reason the drivers live behind separate subpaths.
-*
-* Both HTTP schemes are registered for Upstash, because the local proxy speaks
-* `http://` and Upstash speaks `https://`, and an entry that registered one
-* would work in exactly one of the two places.
+* Normalize hooks configuration
+* @internal Exported for testing
 */
-const CACHE_DRIVERS = {
-	upstash: {
-		imports: `import { registerCacheDriver } from '@geekmidas/cache';\nimport { upstashCacheDriver, upstashInsecureCacheDriver } from '@geekmidas/cache/upstash';`,
-		setup: "registerCacheDriver(upstashCacheDriver);\nregisterCacheDriver(upstashInsecureCacheDriver);"
-	},
-	elasticache: {
-		imports: `import { registerCacheDriver } from '@geekmidas/cache';\nimport { redisCacheDriver, redissCacheDriver } from '@geekmidas/cache/redis';`,
-		setup: "registerCacheDriver(redisCacheDriver);\nregisterCacheDriver(redissCacheDriver);"
-	},
-	db: {
-		imports: `import { registerCacheDriver } from '@geekmidas/cache';\nimport { postgresCacheDriver } from '@geekmidas/cache/postgres';`,
-		setup: "registerCacheDriver(postgresCacheDriver);"
-	}
-};
+function normalizeHooksConfig(config, cwd = process.cwd()) {
+	if (!config?.server) return;
+	const serverPath = config.server.endsWith(".ts") ? config.server : `${config.server}.ts`;
+	return { serverHooksPath: resolve(cwd, serverPath) };
+}
 /**
-* Everything a generated entry should register: object storage, and the cache.
-*
-* Merged here rather than threaded separately, because a generated file has one
-* import block and one setup block whatever fills them.
+* Normalize production configuration
+* @internal Exported for testing
 */
-function driversFor(options) {
-	const backends = options.cache === false || options.cache === void 0 ? [] : typeof options.cache === "string" ? [options.cache] : options.cache;
-	const parts = [storageDriversFor(options.appRoot), ...[...new Set(backends)].map((backend) => CACHE_DRIVERS[backend] ?? CACHE_DRIVERS[DEFAULT_CACHE.aws])].filter((part) => part.imports || part.setup);
-	if (parts.length === 0) return NONE;
+function normalizeProductionConfig(cliProduction, configProduction) {
+	if (!cliProduction) return;
+	const config = configProduction ?? {};
 	return {
-		imports: parts.map((part) => part.imports).join("\n"),
-		setup: parts.map((part) => part.setup).join("\n")
+		enabled: true,
+		bundle: config.bundle ?? true,
+		minify: config.minify ?? true,
+		healthCheck: config.healthCheck ?? "/health",
+		gracefulShutdown: config.gracefulShutdown ?? true,
+		external: config.external ?? [],
+		subscribers: config.subscribers ?? "exclude",
+		openapi: config.openapi ?? false,
+		optimizedHandlers: config.optimizedHandlers ?? true
 	};
 }
 /**
-* Which cache backends an app's entry actually has to speak.
-*
-* The config answers this for a cache that named nowhere, and the *declaration*
-* answers it for one that named a database — `orders.cache('Sessions')` is a
-* statement about the application, so a deployment cannot move that cache and
-* the entry cannot register a driver for somewhere else.
-*
-* Reading only the config is how an entry ends up registering the Upstash
-* driver for a URL the target composed as `postgres://`, which fails at the
-* first request with `UnregisteredCacheScheme` and a stack that points at the
-* cache rather than at the config that disagreed.
-*/
-function cacheBackendsIn(manifest, configured) {
-	const caches = Object.values(manifest).filter((d) => d.kind === "cache");
-	return [...new Set(caches.map((c) => c.of ? "db" : configured))];
-}
-/**
-* The drivers an app's entry points should register.
-*
-* Keyed off the dependency rather than off a declared bucket, because the entry
-* is generated before discovery has run on the watcher's rebuild path — and an
-* app that installed `@geekmidas/storage` has already paid for the SDK it would
-* otherwise resolve lazily.
+* Get production config from GkmConfig
+* @internal
 */
-function storageDriversFor(appRoot) {
-	return dependsOnStorage(appRoot) ? S3 : NONE;
-}
-function dependsOnStorage(appRoot) {
-	const manifest = join(appRoot, "package.json");
-	if (!existsSync(manifest)) return false;
-	try {
-		const pkg = JSON.parse(readFileSync(manifest, "utf8"));
-		return Boolean(pkg.dependencies?.["@geekmidas/storage"] ?? pkg.devDependencies?.["@geekmidas/storage"]);
-	} catch {
-		return false;
-	}
+function getProductionConfigFromGkm(config) {
+	const serverConfig = config.providers?.server;
+	if (typeof serverConfig === "object") return serverConfig.production;
 }
-//#endregion
-//#region src/generators/FunctionGenerator.ts
-var FunctionGenerator = class extends ConstructGenerator {
-	isConstruct(value) {
-		return Function.isFunction(value);
-	}
-	async build(context, constructs, outputDir, options) {
-		const provider = options?.provider || "aws-lambda";
-		const logger = console;
-		const functionInfos = [];
-		if (constructs.length === 0 || provider !== "aws-lambda") return functionInfos;
-		const functionsDir = join(outputDir, "functions");
-		await mkdir(functionsDir, { recursive: true });
-		for (const { key, construct, path } of constructs) {
-			const handlerFile = await this.generateFunctionHandler(functionsDir, path.relative, key, context, construct.owner);
-			functionInfos.push({
-				name: key,
-				handler: relative(process.cwd(), handlerFile).replace(/\.ts$/, ".handler"),
-				timeout: construct.timeout,
-				memorySize: construct.memorySize,
-				environment: await construct.getEnvironment({ markOptional: context.markOptional }),
-				dependencies: construct.constructs
+async function devCommand(options) {
+	if (options.entry) return entryDevCommand(options);
+	const defaultEnv = loadEnvFiles(".env");
+	if (defaultEnv.loaded.length > 0) logger$11.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
+	const appName = getAppNameFromCwd();
+	let config;
+	let appRoot = process.cwd();
+	let secretsRoot = process.cwd();
+	let workspaceAppName;
+	let workspaceAppPort;
+	let workspace;
+	if (appName) try {
+		const appConfig = await loadAppConfig();
+		config = appConfig.gkmConfig;
+		appRoot = appConfig.appRoot;
+		secretsRoot = appConfig.workspaceRoot;
+		workspaceAppName = appConfig.appName;
+		workspaceAppPort = appConfig.app.port;
+		workspace = appConfig.workspace;
+		logger$11.log(`📦 Running app: ${appConfig.appName} on port ${workspaceAppPort}`);
+		if (appConfig.app.entry) {
+			logger$11.log(`📄 Using entry point: ${appConfig.app.entry}`);
+			return entryDevCommand({
+				...options,
+				entry: appConfig.app.entry,
+				port: workspaceAppPort,
+				portExplicit: true
 			});
-			logger.log(`Generated function handler: ${key}`);
 		}
-		return functionInfos;
+	} catch {
+		const loadedConfig = await loadWorkspaceConfig();
+		if (loadedConfig.type === "workspace") {
+			logger$11.log("📦 Detected workspace configuration");
+			return workspaceDevCommand(loadedConfig.workspace, options);
+		}
+		config = loadedConfig.raw;
 	}
-	async generateFunctionHandler(outputDir, sourceFile, exportName, context, owner) {
-		const handlerFileName = `${exportName}.ts`;
-		const handlerPath = join(outputDir, handlerFileName);
-		const importPath = relative(dirname(handlerPath), sourceFile).replace(/\.ts$/, ".js");
-		const runtime = runtimeFor(context, dirname(handlerPath), owner);
-		const content = `import { AWSLambdaFunction } from '@geekmidas/constructs/aws';
-import { ${exportName} } from '${importPath}';
-${runtime.imports}
-${runtime.bindings}
-
-const adapter = new AWSLambdaFunction(envParser, ${exportName});
-
-export const handler = adapter.handler;
-`;
-		await writeFile(handlerPath, content);
-		return handlerPath;
+	else {
+		const loadedConfig = await loadWorkspaceConfig();
+		if (loadedConfig.type === "workspace") {
+			logger$11.log("📦 Detected workspace configuration");
+			return workspaceDevCommand(loadedConfig.workspace, options);
+		}
+		config = loadedConfig.raw;
+		workspace = loadedConfig.workspace;
 	}
-};
-//#endregion
-//#region src/generators/QueueGenerator.ts
-/**
-* Generates the runtime for `q` queue workers.
-*
-* - **server** (`gkm dev`): a single `queues.ts` exposing `setupQueues()` that
-*   runs an in-process pg-boss poller alongside the Hono server — no SQS/Lambda.
-*   Each queue subscribes by its **name** on the shared event connection.
-* - **aws-lambda**: one handler file per queue wrapping `AWSLambdaQueue`, backed
-*   by an SQS event-source mapping.
-*/
-var QueueGenerator = class extends ConstructGenerator {
-	isConstruct(value) {
-		return Queue.isQueue(value);
+	if (config.env) {
+		const { loaded, missing } = loadEnvFiles(config.env, appRoot);
+		if (loaded.length > 0) logger$11.log(`📦 Loaded env: ${loaded.join(", ")}`);
+		if (missing.length > 0) logger$11.warn(`⚠️  Missing env files: ${missing.join(", ")}`);
 	}
-	async build(context, constructs, outputDir, options) {
-		const provider = options?.provider || "aws-lambda";
-		const logger = console;
-		const queueInfos = [];
-		if (provider === "server") {
-			await this.generateServerQueuesFile(outputDir, constructs);
-			logger.log(`Generated server queues file with ${constructs.length} queues (polling mode)`);
-			return queueInfos;
+	const resolved = resolveProviders(config, { provider: "server" });
+	logger$11.log("🚀 Starting development server...");
+	logger$11.log(`Loading constructs from: ${config.constructs}`);
+	const telescope = normalizeTelescopeConfig(config.telescope);
+	if (telescope) logger$11.log(`🔭 Telescope enabled at ${telescope.path}`);
+	const studio = normalizeStudioConfig(config.studio);
+	if (studio) logger$11.log(`🗄️  Studio enabled at ${studio.path}`);
+	const hooks = normalizeHooksConfig(config.hooks, appRoot);
+	if (hooks) logger$11.log(`🪝 Server hooks enabled from ${config.hooks?.server}`);
+	const enableOpenApi = resolveOpenApiConfig(config).enabled || resolved.enableOpenApi;
+	if (enableOpenApi) logger$11.log(`📄 OpenAPI output: ${OPENAPI_OUTPUT_PATH$1}`);
+	const build = (bustCache = false) => buildApp({
+		config,
+		workspaceRoot: workspace?.root ?? secretsRoot,
+		appRoot,
+		providers: ["server"],
+		enableOpenApi,
+		cacheBackend: cacheBackendFor(providerOf(workspace ?? config)),
+		telescope,
+		studio,
+		hooks,
+		skipBundle: true,
+		bustCache,
+		serveEmpty: true
+	});
+	const initial = await build();
+	const runtime = config.runtime ?? "node";
+	let secretsJsonPath;
+	const appSecrets = await loadSecretsForApp(secretsRoot, config.stages.local, workspaceAppName);
+	if (workspace && usesConstructs(workspace)) {
+		const reconciled = await reconcileWorkspace(workspace, { stage: workspace.stages.local });
+		if (reconciled.changed && reconciled.plan.containers.length > 0) {
+			logger$11.log(`🐳 Services: ${reconciled.plan.containers.join(", ")}`);
+			for (const [container, address] of Object.entries(reconciled.addresses)) logger$11.log(`   ${container}: ${address}`);
 		}
-		if (constructs.length === 0 || provider !== "aws-lambda") return queueInfos;
-		const queuesDir = join(outputDir, "queues");
-		await mkdir(queuesDir, { recursive: true });
-		for (const { key, construct, path } of constructs) {
-			const handlerFile = await this.generateQueueHandler(queuesDir, path.relative, key, context, construct.owner);
-			queueInfos.push({
-				name: construct.name,
-				handler: relative(process.cwd(), handlerFile).replace(/\.ts$/, ".handler"),
-				batchSize: construct.batchSize,
-				fifo: construct.fifo,
-				timeout: construct.timeout,
-				environment: await construct.getEnvironment({ markOptional: context.markOptional }),
-				dependencies: construct.constructs
-			});
-			logger.log(`Generated queue handler: ${key}`);
+		Object.assign(appSecrets, reconciled.env);
+	} else {
+		const resolvedPorts = await resolveServicePorts(secretsRoot);
+		if (Object.keys(resolvedPorts.ports).length > 0) {
+			const rewritten = rewriteUrlsWithPorts(appSecrets, resolvedPorts);
+			Object.assign(appSecrets, rewritten);
+			logger$11.log(`🔌 Applied ${Object.keys(resolvedPorts.ports).length} port mapping(s)`);
 		}
-		return queueInfos;
 	}
-	async generateQueueHandler(outputDir, sourceFile, exportName, context, owner) {
-		const handlerPath = join(outputDir, `${exportName}.ts`);
-		const importPath = relative(dirname(handlerPath), sourceFile).replace(/\.ts$/, ".js");
-		const runtime = runtimeFor(context, dirname(handlerPath), owner);
-		const content = `import { AWSLambdaQueue } from '@geekmidas/constructs/aws';
-import { ${exportName} } from '${importPath}';
-${runtime.imports}
-${runtime.bindings}
-
-const adapter = new AWSLambdaQueue(envParser, ${exportName});
-
-export const handler = adapter.handler;
-`;
-		await writeFile(handlerPath, content);
-		return handlerPath;
+	if (workspace && workspaceAppName) {
+		const depEnv = getDependencyEnvVars(workspace, workspaceAppName);
+		for (const [key, value] of Object.entries(depEnv)) appSecrets[key] ??= value;
 	}
-	async generateServerQueuesFile(outputDir, queues) {
-		await mkdir(outputDir, { recursive: true });
-		const queuesPath = join(outputDir, "queues.ts");
-		const importsByFile = /* @__PURE__ */ new Map();
-		for (const { path, key } of queues) {
-			const importPath = relative(dirname(queuesPath), path.relative).replace(/\.ts$/, ".js");
-			if (!importsByFile.has(importPath)) importsByFile.set(importPath, []);
-			importsByFile.get(importPath)?.push(key);
-		}
-		const content = `/**
- * Generated queue workers setup
- *
- * ⚠️  WARNING: This is for LOCAL DEVELOPMENT ONLY
- * This runs an in-process pg-boss poller alongside the HTTP server. Each queue
- * subscribes by its name on the shared event connection
- * (EVENT_SUBSCRIBER_CONNECTION_STRING), so producers using
- * <NAME>_PUBLISHER_CONNECTION_STRING (pgboss:// locally) reach it.
- *
- * For production, queues run as AWS Lambda with SQS event-source mappings.
- */
-import type { EnvironmentParser } from '@geekmidas/envkit';
-import type { Logger } from '@geekmidas/logger';
-import { EventConnectionFactory, Subscriber } from '@geekmidas/events';
-import type { EventConnection, EventSubscriber } from '@geekmidas/events';
-import { ServiceDiscovery } from '@geekmidas/services';
-${Array.from(importsByFile.entries()).map(([importPath, exports]) => `import { ${exports.join(", ")} } from '${importPath}';`).join("\n")}
-
-const queues = [
-  ${queues.map(({ key }) => key).join(",\n  ")}
-];
-
-const activeSubscribers: EventSubscriber<any>[] = [];
-
-export async function setupQueues(
-  envParser: EnvironmentParser<any>,
-  logger: Logger,
-): Promise<void> {
-  if (queues.length === 0) {
-    return;
-  }
-
-  logger.info('Setting up queue workers in polling mode (local development)');
-
-  const config = envParser.create((get) => ({
-    connectionString: get('EVENT_SUBSCRIBER_CONNECTION_STRING').string(),
-  })).parse();
-
-  const serviceDiscovery = ServiceDiscovery.getInstance(envParser);
-
-  let connection: EventConnection;
-  try {
-    connection = await EventConnectionFactory.fromConnectionString(config.connectionString);
-    const connectionType = new URL(config.connectionString).protocol.replace(':', '');
-    logger.info({ connectionType }, 'Created shared event connection for queues');
-  } catch (error) {
-    logger.error({ error }, 'Failed to create event connection for queues');
-    return;
-  }
-
-  for (const queue of queues) {
-    try {
-      const eventSubscriber = await Subscriber.fromConnection(connection);
-
-      const services = queue.services.length > 0
-        ? await serviceDiscovery.register(queue.services)
-        : {};
-
-      // A queue subscribes to a single "type" — its own name.
-      await eventSubscriber.subscribe([queue.name], async (message) => {
-        try {
-          const validation = await queue.messageSchema['~standard'].validate(message.payload);
-          if (validation.issues) {
-            logger.error({ issues: validation.issues, queue: queue.name }, 'Queue message failed validation');
-            return;
-          }
-
-          await queue.handler({
-            messages: [validation.value],
-            services: services,
-            logger: queue.logger,
-          });
-
-          logger.debug({ queue: queue.name }, 'Successfully processed queue message');
-        } catch (error) {
-          logger.error({ error, queue: queue.name }, 'Failed to process queue message');
-          // Message will become visible again for retry.
-        }
-      });
-
-      activeSubscribers.push(eventSubscriber);
-      logger.info({ queue: queue.name }, 'Queue worker started polling');
-    } catch (error) {
-      logger.error({ error, queue: queue.name }, 'Failed to setup queue worker');
-    }
-  }
-
-  const shutdown = () => {
-    logger.info('Stopping all queue workers');
-    for (const _ of activeSubscribers) {
-      connection.stop();
-    }
-  };
-
-  process.on('SIGTERM', shutdown);
-  process.on('SIGINT', shutdown);
+	if (Object.keys(appSecrets).length > 0) {
+		const secretsDir = join(secretsRoot, ".gkm");
+		await mkdir(secretsDir, { recursive: true });
+		const secretsFileName = workspaceAppName ? `dev-secrets-${workspaceAppName}.json` : "dev-secrets.json";
+		secretsJsonPath = join(secretsDir, secretsFileName);
+		await writeFile(secretsJsonPath, JSON.stringify(appSecrets, null, 2));
+		logger$11.log(`🔐 Loaded ${Object.keys(appSecrets).length} secret(s)`);
+	}
+	const devServer = new DevServer(resolved.providers[0], options.port ?? workspaceAppPort ?? 3e3, options.portExplicit ?? workspaceAppPort !== void 0, enableOpenApi, telescope, studio, runtime, appRoot, secretsJsonPath, initial.selfServing !== void 0);
+	await devServer.start();
+	const hooksFile = (config.hooks?.server?.split("#"))?.[0];
+	const normalizedPatterns = [config.constructs, ...hooksFile ? [hooksFile.endsWith(".ts") ? hooksFile : `${hooksFile}.ts`] : []].flat().filter((p) => typeof p === "string").map((p) => p.startsWith("./") ? p.slice(2) : p);
+	logger$11.log(`👀 Watching for changes in: ${normalizedPatterns.join(", ")}`);
+	const resolvedFiles = await fg(normalizedPatterns, {
+		cwd: appRoot,
+		absolute: false,
+		onlyFiles: true
+	});
+	const dirsToWatch = [...new Set(resolvedFiles.map((f) => {
+		return f.split("/").slice(0, -1).join("/");
+	}))];
+	logger$11.log(`📁 Found ${resolvedFiles.length} files in ${dirsToWatch.length} directories`);
+	const watcher = chokidar.watch([...resolvedFiles, ...dirsToWatch], {
+		ignored: /(^|[/\\])\../,
+		persistent: true,
+		ignoreInitial: true,
+		cwd: appRoot
+	});
+	watcher.on("ready", () => {
+		logger$11.log("🔍 File watcher ready");
+	});
+	watcher.on("error", (error) => {
+		logger$11.error("❌ Watcher error:", error);
+	});
+	let rebuildTimeout = null;
+	watcher.on("change", async (path) => {
+		logger$11.log(`📝 File changed: ${path}`);
+		if (rebuildTimeout) clearTimeout(rebuildTimeout);
+		rebuildTimeout = setTimeout(async () => {
+			try {
+				logger$11.log("🔄 Rebuilding...");
+				const rebuilt = await build(true);
+				logger$11.log("✅ Rebuild complete, restarting server...");
+				devServer.selfServing = rebuilt.selfServing !== void 0;
+				await devServer.restart();
+			} catch (error) {
+				const err = error;
+				logger$11.error(`❌ Rebuild failed: ${err.message}`);
+				if (err.stack) logger$11.error(err.stack);
+			}
+		}, 300);
+	});
+	let isShuttingDown = false;
+	const shutdown = () => {
+		if (isShuttingDown) return;
+		isShuttingDown = true;
+		logger$11.log("\n🛑 Shutting down...");
+		Promise.all([watcher.close(), devServer.stop()]).catch((err) => {
+			logger$11.error("Error during shutdown:", err);
+		}).finally(() => {
+			process.exit(0);
+		});
+	};
+	process.on("SIGINT", shutdown);
+	process.on("SIGTERM", shutdown);
 }
-`;
-		await writeFile(queuesPath, content);
-		return queuesPath;
+/**
+* Generate all dependency environment variables for all apps.
+* Returns a flat object with all {APP_NAME}_URL variables.
+* @internal Exported for testing
+*/
+function generateAllDependencyEnvVars(workspace, urlPrefix = "http://localhost") {
+	const env = {};
+	for (const appName of Object.keys(workspace.apps)) {
+		const appEnv = getDependencyEnvVars(workspace, appName, urlPrefix);
+		Object.assign(env, appEnv);
 	}
-};
-//#endregion
-//#region src/generators/SubscriberGenerator.ts
-var SubscriberGenerator = class extends ConstructGenerator {
-	isConstruct(value) {
-		return Subscriber.isSubscriber(value);
+	return env;
+}
+/**
+* Check for port conflicts across all apps.
+* Returns list of conflicts if any ports are duplicated.
+* @internal Exported for testing
+*/
+function checkPortConflicts(workspace) {
+	const conflicts = [];
+	const portToApp = /* @__PURE__ */ new Map();
+	for (const [appName, app] of Object.entries(workspace.apps)) {
+		const existingApp = portToApp.get(app.port);
+		if (existingApp) conflicts.push({
+			app1: existingApp,
+			app2: appName,
+			port: app.port
+		});
+		else portToApp.set(app.port, appName);
 	}
-	async build(context, constructs, outputDir, options) {
-		const provider = options?.provider || "aws-lambda";
-		const logger = console;
-		const subscriberInfos = [];
-		if (provider === "server") {
-			await this.generateServerSubscribersFile(outputDir, constructs);
-			logger.log(`Generated server subscribers file with ${constructs.length} subscribers (polling mode)`);
-			return subscriberInfos;
-		}
-		if (constructs.length === 0) return subscriberInfos;
-		if (provider !== "aws-lambda") return subscriberInfos;
-		const subscribersDir = join(outputDir, "subscribers");
-		await mkdir(subscribersDir, { recursive: true });
-		for (const { key, construct, path } of constructs) {
-			const handlerFile = await this.generateSubscriberHandler(subscribersDir, path.relative, key, construct, context, construct.owner);
-			subscriberInfos.push({
-				name: key,
-				handler: relative(process.cwd(), handlerFile).replace(/\.ts$/, ".handler"),
-				subscribedEvents: construct.subscribedEvents || [],
-				...construct.topicName ? {
-					transport: "topic",
-					topic: construct.topicName
-				} : {},
-				timeout: construct.timeout,
-				memorySize: construct.memorySize,
-				environment: await construct.getEnvironment({ markOptional: context.markOptional }),
-				dependencies: construct.constructs
-			});
-			logger.log(`Generated subscriber handler: ${key}`);
-		}
-		return subscriberInfos;
+	return conflicts;
+}
+const FRONTEND_FRAMEWORKS = {
+	nextjs: {
+		displayName: "Next.js",
+		configFiles: [
+			"next.config.js",
+			"next.config.ts",
+			"next.config.mjs",
+			"next.config.cjs"
+		],
+		dependency: "next",
+		installCommand: "pnpm add next react react-dom"
+	},
+	remix: {
+		displayName: "Remix",
+		configFiles: [
+			"remix.config.js",
+			"remix.config.mjs",
+			"remix.config.ts",
+			"vite.config.js",
+			"vite.config.ts",
+			"vite.config.mjs",
+			"vite.config.cjs"
+		],
+		dependency: "@remix-run/dev",
+		installCommand: "pnpm add -D @remix-run/dev"
+	},
+	vite: {
+		displayName: "Vite",
+		configFiles: [
+			"vite.config.js",
+			"vite.config.ts",
+			"vite.config.mjs",
+			"vite.config.cjs"
+		],
+		dependency: "vite",
+		installCommand: "pnpm add -D vite"
+	},
+	"tanstack-start": {
+		displayName: "TanStack Start",
+		configFiles: [
+			"vite.config.js",
+			"vite.config.ts",
+			"vite.config.mjs",
+			"vite.config.cjs"
+		],
+		dependency: "@tanstack/react-start",
+		installCommand: "pnpm add @tanstack/react-start @tanstack/react-router"
+	},
+	expo: {
+		displayName: "Expo",
+		configFiles: [
+			"app.config.ts",
+			"app.config.js",
+			"app.json"
+		],
+		dependency: "expo",
+		installCommand: "pnpm add expo"
 	}
-	async generateSubscriberHandler(outputDir, sourceFile, exportName, _subscriber, context, owner) {
-		const handlerFileName = `${exportName}.ts`;
-		const handlerPath = join(outputDir, handlerFileName);
-		const importPath = relative(dirname(handlerPath), sourceFile).replace(/\.ts$/, ".js");
-		const runtime = runtimeFor(context, dirname(handlerPath), owner);
-		const content = `import { AWSLambdaSubscriber } from '@geekmidas/constructs/aws';
-import { ${exportName} } from '${importPath}';
-${runtime.imports}
-${runtime.bindings}
-
-const adapter = new AWSLambdaSubscriber(envParser, ${exportName});
-
-export const handler = adapter.handler;
-`;
-		await writeFile(handlerPath, content);
-		return handlerPath;
+};
+/** Whether a configured framework is one this table knows how to start. */
+function isClientFramework(framework) {
+	return framework !== void 0 && framework in FRONTEND_FRAMEWORKS;
+}
+/**
+* Auto-detect the frontend framework by scanning package.json deps and config
+* files. Dependency match wins over config file match because deps are more
+* distinctive (a Remix app has both vite.config.ts AND @remix-run/dev).
+*/
+function detectFrontendFramework(fullPath, deps) {
+	const order = [
+		"expo",
+		"tanstack-start",
+		"nextjs",
+		"remix",
+		"vite"
+	];
+	for (const name of order) if (deps[FRONTEND_FRAMEWORKS[name].dependency]) return name;
+	for (const name of order) if (FRONTEND_FRAMEWORKS[name].configFiles.some((file) => existsSync(join(fullPath, file)))) return name;
+}
+/**
+* Validate a frontend app configuration.
+*
+* If `framework` is provided, validates strictly against that framework's
+* expected config file and dependency. Otherwise auto-detects the framework
+* from package.json and config files. If no recognized framework is found, the
+* app is allowed through with a warning provided it has a `dev` script.
+*
+* @internal Exported for testing
+*/
+async function validateFrontendApp(appName, appPath, workspaceRoot, framework) {
+	const errors = [];
+	const warnings = [];
+	const fullPath = join(workspaceRoot, appPath);
+	const packageJsonPath = join(fullPath, "package.json");
+	if (!existsSync(packageJsonPath)) {
+		errors.push(`package.json not found at ${appPath}. Run: pnpm init in the app directory.`);
+		return {
+			appName,
+			valid: false,
+			errors,
+			warnings
+		};
 	}
-	async generateServerSubscribersFile(outputDir, subscribers) {
-		await mkdir(outputDir, { recursive: true });
-		const subscribersPath = join(outputDir, "subscribers.ts");
-		const importsByFile = /* @__PURE__ */ new Map();
-		for (const { path, key } of subscribers) {
-			const importPath = relative(dirname(subscribersPath), path.relative).replace(/\.ts$/, ".js");
-			if (!importsByFile.has(importPath)) importsByFile.set(importPath, []);
-			importsByFile.get(importPath)?.push(key);
-		}
-		const content = `/**
- * Generated subscribers setup
- *
- * ⚠️  WARNING: This is for LOCAL DEVELOPMENT ONLY
- * This uses event polling which is not suitable for production.
- *
- * For production, use AWS Lambda with SQS/SNS event source mappings.
- * Lambda automatically:
- * - Scales based on queue depth
- * - Handles batch processing and retries
- * - Manages dead letter queues
- * - Provides better cost optimization
- *
- * This polling implementation is useful for:
- * - Local development and testing
- * - Understanding event flow without Lambda deployment
- *
- * Supported connection strings:
- * - sqs://region/account-id/queue-name (SQS queue)
- * - sns://region/account-id/topic-name (SNS topic)
- * - rabbitmq://host:port/queue-name (RabbitMQ)
- * - pgboss://user:pass@host:port/database (pg-boss / PostgreSQL)
- * - basic://in-memory (In-memory for testing)
- */
-import type { EnvironmentParser } from '@geekmidas/envkit';
-import type { Logger } from '@geekmidas/logger';
-import { EventConnectionFactory, Subscriber } from '@geekmidas/events';
-import type { EventConnection, EventSubscriber } from '@geekmidas/events';
-import { ServiceDiscovery } from '@geekmidas/services';
-${Array.from(importsByFile.entries()).map(([importPath, exports]) => `import { ${exports.join(", ")} } from '${importPath}';`).join("\n")}
-
-const subscribers = [
-  ${subscribers.map(({ key }) => key).join(",\n  ")}
-];
-
-const activeSubscribers: EventSubscriber<any>[] = [];
-
-export async function setupSubscribers(
-  envParser: EnvironmentParser<any>,
-  logger: Logger,
-): Promise<void> {
-  if (subscribers.length === 0) {
-    return;
-  }
-
-  logger.info('Setting up subscribers in polling mode (local development)');
-
-  const config = envParser.create((get) => ({
-    connectionString: get('EVENT_SUBSCRIBER_CONNECTION_STRING').string(),
-  })).parse();
-
-  const serviceDiscovery = ServiceDiscovery.getInstance(envParser);
-
-  // Create connection once, outside the loop (more efficient)
-  // EventConnectionFactory automatically determines the right connection type
-  let connection: EventConnection;
-  try {
-    connection = await EventConnectionFactory.fromConnectionString(config.connectionString);
-
-    const connectionType = new URL(config.connectionString).protocol.replace(':', '');
-    logger.info({ connectionType }, 'Created shared event connection');
-  } catch (error) {
-    logger.error({ error }, 'Failed to create event connection');
-    return;
-  }
-
-  for (const subscriber of subscribers) {
-    try {
-      // Create subscriber from shared connection
-      const eventSubscriber = await Subscriber.fromConnection(connection);
-
-      // Register services
-      const services = subscriber.services.length > 0
-        ? await serviceDiscovery.register(subscriber.services)
-        : {};
-
-      // Subscribe to events
-      const subscribedEvents = subscriber.subscribedEvents || [];
-
-      if (subscribedEvents.length === 0) {
-        logger.warn({ subscriber: subscriber.constructor.name }, 'Subscriber has no subscribed events, skipping');
-        continue;
-      }
-
-      await eventSubscriber.subscribe(subscribedEvents, async (event) => {
-        try {
-          // Process single event (batch of 1)
-          await subscriber.handler({
-            events: [event],
-            services: services as any,
-            logger: subscriber.logger,
-          });
-
-          logger.debug({ eventType: event.type }, 'Successfully processed event');
-        } catch (error) {
-          logger.error({ error, event }, 'Failed to process event');
-          // Event will become visible again for retry
-        }
-      });
-
-      activeSubscribers.push(eventSubscriber);
-
-      logger.info(
-        {
-          events: subscribedEvents,
-        },
-        'Subscriber started polling'
-      );
-    } catch (error) {
-      logger.error({ error, subscriber: subscriber.constructor.name }, 'Failed to setup subscriber');
-    }
-  }
-
-  // Setup graceful shutdown
-  const shutdown = () => {
-    logger.info('Stopping all subscribers');
-    for (const eventSubscriber of activeSubscribers) {
-      connection.stop();
-    }
-  };
-
-  process.on('SIGTERM', shutdown);
-  process.on('SIGINT', shutdown);
-}
-`;
-		await writeFile(subscribersPath, content);
-		return subscribersPath;
+	let pkg;
+	try {
+		pkg = __require(packageJsonPath);
+	} catch {
+		errors.push(`Failed to read package.json at ${packageJsonPath}`);
+		return {
+			appName,
+			valid: false,
+			errors,
+			warnings
+		};
 	}
-};
-//#endregion
-//#region src/generators/TopicGenerator.ts
+	const deps = {
+		...pkg.dependencies,
+		...pkg.devDependencies
+	};
+	const resolvedFramework = framework ?? detectFrontendFramework(fullPath, deps);
+	if (resolvedFramework) {
+		const spec = FRONTEND_FRAMEWORKS[resolvedFramework];
+		if (!spec.configFiles.some((file) => existsSync(join(fullPath, file)))) errors.push(`${spec.displayName} config file not found. Expected one of: ${spec.configFiles.join(", ")}`);
+		if (!deps[spec.dependency]) errors.push(`${spec.displayName} not found in dependencies. Run: ${spec.installCommand}`);
+	} else warnings.push("No recognized frontend framework detected (Next.js, Vite, Remix). The app will run via its \"dev\" script. Set `framework` in your app config to enable strict validation.");
+	if (!pkg.scripts?.dev) {
+		if (resolvedFramework) warnings.push("No \"dev\" script found in package.json. Turbo expects a \"dev\" script to run.");
+		else errors.push("No \"dev\" script found in package.json. Without a recognized framework or a dev script, there is nothing to run.");
+	}
+	return {
+		appName,
+		valid: errors.length === 0,
+		errors,
+		warnings
+	};
+}
 /**
-* Discovers `t` topics into `manifest.topics`. A topic is a *resource*, not a
-* function — it has no handler to generate. Producers reach it via its derived
-* publisher (`topic.publisher`, whose connection string is sniffed onto the
-* producing construct) and subscribers bind via `s.topic(topic)`; this generator
-* only records the topic + its event contract so infra can provision the SNS
-* topic. Identical output for every provider (locally pg-boss routes by event
-* name, so there's nothing to run).
+* Validate all frontend apps in the workspace.
+* Returns validation results for each frontend app.
+* @internal Exported for testing
 */
-var TopicGenerator = class extends ConstructGenerator {
-	isConstruct(value) {
-		return Topic.isTopic(value);
-	}
-	async build(_context, constructs, _outputDir, _options) {
-		const logger = console;
-		const topicInfos = constructs.map(({ construct }) => ({
-			name: construct.name,
-			events: construct.eventTypes
-		}));
-		for (const topic of topicInfos) logger.log(`Discovered topic: ${topic.name}`);
-		return topicInfos;
+async function validateFrontendApps(workspace) {
+	const results = [];
+	for (const [appName, app] of Object.entries(workspace.apps)) if (app.type === "web") {
+		const result = await validateFrontendApp(appName, app.path, workspace.root, isClientFramework(app.framework) ? app.framework : void 0);
+		results.push(result);
 	}
-};
-//#endregion
-//#region src/workspace/client-generator.ts
+	return results;
+}
 /**
-* Normalize routes to an array of patterns.
-* Handles string, string[], and PartitionedRoutes (extracts paths).
-* @internal Exported for use in dev command
+* Load secrets for development stage.
+* Returns env vars to inject, or empty object if secrets not configured/found.
+* @internal Exported for testing
 */
-function normalizeRoutes(routes) {
-	if (!routes) return [];
-	if (isPartitionedRoutes(routes)) return Array.isArray(routes.paths) ? routes.paths : [routes.paths];
-	return Array.isArray(routes) ? routes : [routes];
-}
-//#endregion
-//#region src/exec/index.ts
-const logger$12 = console;
-/** `gkm exec` was given nothing to run. */
-var NoCommandSpecified = class extends Error {
-	constructor() {
-		super("No command specified. Usage: gkm exec -- <command>");
-		this.name = "NoCommandSpecified";
+async function loadDevSecrets(workspace) {
+	if (!workspace.secrets.enabled) return {};
+	const stage = workspace.stages.local;
+	if (secretsExist(stage, workspace.root)) {
+		const secrets = await readStageSecrets(stage, workspace.root);
+		if (secrets) {
+			logger$11.log(`🔐 Loading secrets from stage: ${stage}`);
+			return toEmbeddableSecrets(secrets);
+		}
 	}
-};
+	logger$11.warn(`⚠️  Secrets enabled but no "${stage}" secrets found. Run "gkm setup" to initialize the local stage`);
+	return {};
+}
 /**
-* Run a command with secrets injected into Credentials.
-* Uses Node's --import flag to preload a script that populates Credentials
-* before the command loads any modules that depend on them.
+* Workspace dev command - orchestrates multi-app development using Turbo.
 *
-* @example
-* ```bash
-* gkm exec -- npx @better-auth/cli migrate
-* gkm exec -- npx prisma migrate dev
-* ```
+* Flow:
+* 1. Check for port conflicts
+* 2. Start docker-compose services (db, cache, mail)
+* 3. Generate dependency URLs ({APP_NAME}_URL)
+* 4. Spawn turbo run dev with injected env vars
 */
-async function execCommand(commandArgs, options = {}) {
-	const cwd = options.cwd ?? process.cwd();
-	if (!commandArgs[0]) throw new NoCommandSpecified();
-	const defaultEnv = loadEnvFiles(".env");
-	if (defaultEnv.loaded.length > 0) logger$12.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
-	const { credentials, secretsJsonPath, appName } = await prepareEntryCredentials({
-		cwd,
-		resolveDockerPorts: "readonly"
-	});
-	if (appName) logger$12.log(`📦 App: ${appName}`);
-	const secretCount = Object.keys(credentials).filter((k) => k !== "PORT").length;
-	if (secretCount > 0) logger$12.log(`🔐 Loaded ${secretCount} secret(s)`);
-	const preloadDir = join(cwd, ".gkm");
-	await mkdir(preloadDir, { recursive: true });
-	const preloadPath = join(preloadDir, "credentials-preload.mjs");
-	await createCredentialsPreload(preloadPath, secretsJsonPath);
-	const [cmd, ...args] = commandArgs;
-	logger$12.log(`🚀 Running: ${[cmd, ...args].join(" ")}`);
-	const nodeOptions = [(process.env.NODE_OPTIONS ?? "").replace(/--import[= ]\S+/g, "").trim(), `--import=${preloadPath}`].filter(Boolean).join(" ");
-	const child = spawn(cmd, args, {
-		cwd,
-		stdio: "inherit",
-		env: {
-			...process.env,
-			...credentials,
-			NODE_OPTIONS: nodeOptions
-		}
-	});
-	const exitCode = await new Promise((resolve) => {
-		child.on("close", (code) => resolve(code ?? 0));
-		child.on("error", (error) => {
-			logger$12.error(`Failed to run command: ${error.message}`);
-			resolve(1);
-		});
-	});
-	if (exitCode !== 0) process.exit(exitCode);
-}
-//#endregion
-//#region src/dev/index.ts
-const logger$11 = console;
-/**
-* Normalize telescope configuration
-* @internal Exported for testing
-*/
-function normalizeTelescopeConfig(config) {
-	if (config === false) return;
-	if (typeof config === "string") {
-		const { path: telescopePath, importPattern: telescopeImportPattern } = parseModuleConfig(config, "telescope");
-		return {
-			enabled: true,
-			telescopePath,
-			telescopeImportPattern,
-			path: "/__telescope",
-			ignore: [],
-			recordBody: true,
-			maxEntries: 1e3,
-			websocket: true
-		};
-	}
-	if (!(config === true || config === void 0 || config.enabled !== false)) return;
-	const telescopeConfig = typeof config === "object" ? config : {};
-	return {
-		enabled: true,
-		path: telescopeConfig.path ?? "/__telescope",
-		ignore: telescopeConfig.ignore ?? [],
-		recordBody: telescopeConfig.recordBody ?? true,
-		maxEntries: telescopeConfig.maxEntries ?? 1e3,
-		websocket: telescopeConfig.websocket ?? true
-	};
-}
-/**
-* Normalize studio configuration
-* @internal Exported for testing
-*/
-function normalizeStudioConfig(config) {
-	if (config === false) return;
-	if (typeof config === "string") {
-		const { path: studioPath, importPattern: studioImportPattern } = parseModuleConfig(config, "studio");
-		return {
-			enabled: true,
-			studioPath,
-			studioImportPattern,
-			path: "/__studio",
-			schema: "public"
-		};
-	}
-	if (!(config === true || config === void 0 || config.enabled !== false)) return;
-	const studioConfig = typeof config === "object" ? config : {};
-	return {
-		enabled: true,
-		path: studioConfig.path ?? "/__studio",
-		schema: studioConfig.schema ?? "public"
-	};
-}
-/**
-* Normalize hooks configuration
-* @internal Exported for testing
-*/
-function normalizeHooksConfig(config, cwd = process.cwd()) {
-	if (!config?.server) return;
-	const serverPath = config.server.endsWith(".ts") ? config.server : `${config.server}.ts`;
-	return { serverHooksPath: resolve(cwd, serverPath) };
-}
-/**
-* Normalize production configuration
-* @internal Exported for testing
-*/
-function normalizeProductionConfig(cliProduction, configProduction) {
-	if (!cliProduction) return;
-	const config = configProduction ?? {};
-	return {
-		enabled: true,
-		bundle: config.bundle ?? true,
-		minify: config.minify ?? true,
-		healthCheck: config.healthCheck ?? "/health",
-		gracefulShutdown: config.gracefulShutdown ?? true,
-		external: config.external ?? [],
-		subscribers: config.subscribers ?? "exclude",
-		openapi: config.openapi ?? false,
-		optimizedHandlers: config.optimizedHandlers ?? true
-	};
-}
-/**
-* Get production config from GkmConfig
-* @internal
-*/
-function getProductionConfigFromGkm(config) {
-	const serverConfig = config.providers?.server;
-	if (typeof serverConfig === "object") return serverConfig.production;
-}
-async function devCommand(options) {
-	if (options.entry) return entryDevCommand(options);
-	const defaultEnv = loadEnvFiles(".env");
-	if (defaultEnv.loaded.length > 0) logger$11.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
-	const appName = getAppNameFromCwd();
-	let config;
-	let appRoot = process.cwd();
-	let secretsRoot = process.cwd();
-	let workspaceAppName;
-	let workspaceAppPort;
-	let workspace;
-	if (appName) try {
-		const appConfig = await loadAppConfig();
-		config = appConfig.gkmConfig;
-		appRoot = appConfig.appRoot;
-		secretsRoot = appConfig.workspaceRoot;
-		workspaceAppName = appConfig.appName;
-		workspaceAppPort = appConfig.app.port;
-		workspace = appConfig.workspace;
-		logger$11.log(`📦 Running app: ${appConfig.appName} on port ${workspaceAppPort}`);
-		if (appConfig.app.entry) {
-			logger$11.log(`📄 Using entry point: ${appConfig.app.entry}`);
-			return entryDevCommand({
-				...options,
-				entry: appConfig.app.entry,
-				port: workspaceAppPort,
-				portExplicit: true
-			});
-		}
-	} catch {
-		const loadedConfig = await loadWorkspaceConfig();
-		if (loadedConfig.type === "workspace") {
-			logger$11.log("📦 Detected workspace configuration");
-			return workspaceDevCommand(loadedConfig.workspace, options);
-		}
-		config = loadedConfig.raw;
+async function workspaceDevCommand(workspace, options) {
+	const appCount = Object.keys(workspace.apps).length;
+	const backendApps = Object.entries(workspace.apps).filter(([_, app]) => app.type === "backend");
+	const frontendApps = Object.entries(workspace.apps).filter(([_, app]) => app.type === "web");
+	const mobileApps = Object.entries(workspace.apps).filter(([_, app]) => app.type === "mobile");
+	logger$11.log(`\n🚀 Starting workspace: ${workspace.name}`);
+	const counts = [`${backendApps.length} backend`, `${frontendApps.length} web`];
+	if (mobileApps.length > 0) counts.push(`${mobileApps.length} mobile`);
+	logger$11.log(`   ${counts.join(", ")} app(s)`);
+	const conflicts = checkPortConflicts(workspace);
+	if (conflicts.length > 0) {
+		for (const conflict of conflicts) logger$11.error(`❌ Port conflict: Apps "${conflict.app1}" and "${conflict.app2}" both use port ${conflict.port}`);
+		throw new Error("Port conflicts detected. Please assign unique ports to each app.");
 	}
-	else {
-		const loadedConfig = await loadWorkspaceConfig();
-		if (loadedConfig.type === "workspace") {
-			logger$11.log("📦 Detected workspace configuration");
-			return workspaceDevCommand(loadedConfig.workspace, options);
+	if (frontendApps.length > 0) {
+		logger$11.log("\n🔍 Validating frontend apps...");
+		const validationResults = await validateFrontendApps(workspace);
+		let hasErrors = false;
+		for (const result of validationResults) {
+			if (!result.valid) {
+				hasErrors = true;
+				logger$11.error(`\n❌ Frontend app "${result.appName}" validation failed:`);
+				for (const error of result.errors) logger$11.error(`   • ${error}`);
+			}
+			for (const warning of result.warnings) logger$11.warn(`   ⚠️  ${result.appName}: ${warning}`);
 		}
-		config = loadedConfig.raw;
-		workspace = loadedConfig.workspace;
-	}
-	if (config.env) {
-		const { loaded, missing } = loadEnvFiles(config.env, appRoot);
-		if (loaded.length > 0) logger$11.log(`📦 Loaded env: ${loaded.join(", ")}`);
-		if (missing.length > 0) logger$11.warn(`⚠️  Missing env files: ${missing.join(", ")}`);
+		if (hasErrors) throw new Error("Frontend app validation failed. Fix the issues above and try again.");
+		logger$11.log("✅ Frontend apps validated");
 	}
-	const resolved = resolveProviders(config, { provider: "server" });
-	logger$11.log("🚀 Starting development server...");
-	logger$11.log(`Loading constructs from: ${config.constructs}`);
-	const telescope = normalizeTelescopeConfig(config.telescope);
-	if (telescope) logger$11.log(`🔭 Telescope enabled at ${telescope.path}`);
-	const studio = normalizeStudioConfig(config.studio);
-	if (studio) logger$11.log(`🗄️  Studio enabled at ${studio.path}`);
-	const hooks = normalizeHooksConfig(config.hooks, appRoot);
-	if (hooks) logger$11.log(`🪝 Server hooks enabled from ${config.hooks?.server}`);
-	const enableOpenApi = resolveOpenApiConfig(config).enabled || resolved.enableOpenApi;
-	if (enableOpenApi) logger$11.log(`📄 OpenAPI output: ${OPENAPI_OUTPUT_PATH$1}`);
-	const workspaceRoot = workspace?.root ?? secretsRoot;
-	const buildContext = {
-		telescope,
-		studio,
-		hooks
-	};
-	await buildServer(config, buildContext, resolved.providers[0], enableOpenApi, appRoot, workspaceRoot);
-	if (enableOpenApi) await generateOpenApiFrom(config.constructs, { openapi: config.openapi });
-	const runtime = config.runtime ?? "node";
-	let secretsJsonPath;
-	const appSecrets = await loadSecretsForApp(secretsRoot, config.stages.local, workspaceAppName);
-	if (workspace && usesConstructs(workspace)) {
+	const rawSecrets = await loadDevSecrets(workspace);
+	let secretsEnv;
+	const appUrls = {};
+	if (usesConstructs(workspace)) {
 		const reconciled = await reconcileWorkspace(workspace, { stage: workspace.stages.local });
 		if (reconciled.changed && reconciled.plan.containers.length > 0) {
 			logger$11.log(`🐳 Services: ${reconciled.plan.containers.join(", ")}`);
 			for (const [container, address] of Object.entries(reconciled.addresses)) logger$11.log(`   ${container}: ${address}`);
 		}
-		Object.assign(appSecrets, reconciled.env);
-	} else {
-		const resolvedPorts = await resolveServicePorts(secretsRoot);
-		if (Object.keys(resolvedPorts.ports).length > 0) {
-			const rewritten = rewriteUrlsWithPorts(appSecrets, resolvedPorts);
-			Object.assign(appSecrets, rewritten);
-			logger$11.log(`🔌 Applied ${Object.keys(resolvedPorts.ports).length} port mapping(s)`);
+		secretsEnv = {
+			...rawSecrets,
+			...reconciled.env
+		};
+		for (const resource of reconciled.plan.resources) {
+			if (resource.kind !== "rest-api" && resource.kind !== "site") continue;
+			const address = reconciled.env[resource.envKey];
+			if (address) appUrls[resource.id] = address;
 		}
+	} else {
+		const resolvedPorts = await resolveServicePorts(workspace.root);
+		await startWorkspaceServices(workspace, resolvedPorts.dockerEnv, rawSecrets);
+		secretsEnv = rewriteUrlsWithPorts(rawSecrets, resolvedPorts);
 	}
-	if (workspace && workspaceAppName) {
-		const depEnv = getDependencyEnvVars(workspace, workspaceAppName);
-		Object.assign(appSecrets, depEnv);
+	if (Object.keys(secretsEnv).length > 0) logger$11.log(`   Loaded ${Object.keys(secretsEnv).length} secret(s)`);
+	if (Object.keys(appUrls).length > 0) {
+		logger$11.log("🔒 App URLs:");
+		for (const [id, address] of Object.entries(appUrls)) logger$11.log(`   ${id}: ${address}`);
 	}
-	if (Object.keys(appSecrets).length > 0) {
-		const secretsDir = join(secretsRoot, ".gkm");
-		await mkdir(secretsDir, { recursive: true });
-		const secretsFileName = workspaceAppName ? `dev-secrets-${workspaceAppName}.json` : "dev-secrets.json";
-		secretsJsonPath = join(secretsDir, secretsFileName);
-		await writeFile(secretsJsonPath, JSON.stringify(appSecrets, null, 2));
-		logger$11.log(`🔐 Loaded ${Object.keys(appSecrets).length} secret(s)`);
+	const dependencyEnv = Object.fromEntries(Object.entries(generateAllDependencyEnvVars(workspace)).filter(([key]) => secretsEnv[key] === void 0));
+	if (Object.keys(dependencyEnv).length > 0) {
+		logger$11.log("📡 Dependency URLs:");
+		for (const [key, value] of Object.entries(dependencyEnv)) logger$11.log(`   ${key}=${value}`);
 	}
-	const devServer = new DevServer(resolved.providers[0], options.port ?? workspaceAppPort ?? 3e3, options.portExplicit ?? false, enableOpenApi, telescope, studio, runtime, appRoot, secretsJsonPath);
-	await devServer.start();
-	const hooksFile = (config.hooks?.server?.split("#"))?.[0];
-	const normalizedPatterns = [config.constructs, ...hooksFile ? [hooksFile.endsWith(".ts") ? hooksFile : `${hooksFile}.ts`] : []].flat().filter((p) => typeof p === "string").map((p) => p.startsWith("./") ? p.slice(2) : p);
-	logger$11.log(`👀 Watching for changes in: ${normalizedPatterns.join(", ")}`);
-	const resolvedFiles = await fg(normalizedPatterns, {
-		cwd: appRoot,
-		absolute: false,
-		onlyFiles: true
-	});
-	const dirsToWatch = [...new Set(resolvedFiles.map((f) => {
-		return f.split("/").slice(0, -1).join("/");
-	}))];
-	logger$11.log(`📁 Found ${resolvedFiles.length} files in ${dirsToWatch.length} directories`);
-	const watcher = chokidar.watch([...resolvedFiles, ...dirsToWatch], {
-		ignored: /(^|[/\\])\../,
-		persistent: true,
-		ignoreInitial: true,
-		cwd: appRoot
-	});
-	watcher.on("ready", () => {
-		logger$11.log("🔍 File watcher ready");
-	});
-	watcher.on("error", (error) => {
-		logger$11.error("❌ Watcher error:", error);
+	let turboFilter = [];
+	if (options.app) {
+		if (!workspace.apps[options.app]) {
+			const appNames = Object.keys(workspace.apps).join(", ");
+			throw new Error(`App "${options.app}" not found. Available apps: ${appNames}`);
+		}
+		turboFilter = ["--filter", appPackageName(workspace, options.app) ?? options.app];
+		logger$11.log(`\n🎯 Running single app: ${options.app}`);
+	} else if (options.filter) {
+		turboFilter = ["--filter", options.filter];
+		logger$11.log(`\n🔍 Using filter: ${options.filter}`);
+	} else {
+		const { filters, unpackaged } = turboFilters(workspace);
+		turboFilter = filters.flatMap((name) => ["--filter", name]);
+		if (unpackaged.length > 0) logger$11.warn(`⚠️  No package.json with a name for: ${unpackaged.join(", ")} — turbo cannot run ${unpackaged.length === 1 ? "it" : "them"}.`);
+		logger$11.log(`\n🎯 Running all ${appCount} apps`);
+	}
+	const buildOrder = getAppBuildOrder(workspace);
+	logger$11.log("\n📋 Apps (in dependency order):");
+	for (const appName of buildOrder) {
+		const app = workspace.apps[appName];
+		if (!app) continue;
+		const deps = app.dependencies.length > 0 ? ` (depends on: ${app.dependencies.join(", ")})` : "";
+		const icon = app.type === "backend" ? "🔧" : app.type === "mobile" ? "📱" : "🌐";
+		logger$11.log(`   ${icon} ${appName} → http://localhost:${app.port}${deps}`);
+	}
+	const configFiles = [
+		"gkm.config.ts",
+		"gkm.config.js",
+		"gkm.config.json"
+	];
+	let configPath = "";
+	for (const file of configFiles) {
+		const fullPath = join(workspace.root, file);
+		if (existsSync(fullPath)) {
+			configPath = fullPath;
+			break;
+		}
+	}
+	const turboEnv = {
+		...process.env,
+		...secretsEnv,
+		...dependencyEnv,
+		NODE_ENV: "development",
+		...configPath ? { GKM_CONFIG_PATH: configPath } : {}
+	};
+	const scoped = options.app ? [options.app] : options.filter ? [] : Object.keys(workspace.apps);
+	const held = [];
+	for (const appName of scoped) {
+		const port = workspace.apps[appName]?.port;
+		if (port && !await isPortAvailable(port)) held.push({
+			app: appName,
+			port,
+			holder: listenerOn(port)
+		});
+	}
+	if (held.length > 0) throw new WorkspacePortsInUse(held);
+	logger$11.log("\n🏃 Starting turbo run dev...\n");
+	const turboProcess = spawn("pnpm", [
+		"turbo",
+		"run",
+		"dev",
+		...turboFilter
+	], {
+		cwd: workspace.root,
+		stdio: "inherit",
+		env: turboEnv,
+		detached: true
 	});
-	let rebuildTimeout = null;
-	watcher.on("change", async (path) => {
-		logger$11.log(`📝 File changed: ${path}`);
-		if (rebuildTimeout) clearTimeout(rebuildTimeout);
-		rebuildTimeout = setTimeout(async () => {
+	let isShuttingDown = false;
+	const shutdown = () => {
+		if (isShuttingDown) return;
+		isShuttingDown = true;
+		logger$11.log("\n🛑 Shutting down workspace...");
+		const pid = turboProcess.pid;
+		if (pid) try {
+			process.kill(-pid, "SIGTERM");
+		} catch {
 			try {
-				logger$11.log("🔄 Rebuilding...");
-				await buildServer(config, buildContext, resolved.providers[0], enableOpenApi, appRoot, workspaceRoot, true);
-				if (enableOpenApi) await generateOpenApiFrom(config.constructs, {
-					openapi: config.openapi,
-					silent: true,
-					bustCache: true
-				});
-				logger$11.log("✅ Rebuild complete, restarting server...");
-				await devServer.restart();
-			} catch (error) {
-				const err = error;
-				logger$11.error(`❌ Rebuild failed: ${err.message}`);
-				if (err.stack) logger$11.error(err.stack);
+				process.kill(pid, "SIGTERM");
+			} catch {}
+		}
+		setTimeout(() => {
+			if (pid) try {
+				process.kill(-pid, "SIGKILL");
+			} catch {
+				try {
+					process.kill(pid, "SIGKILL");
+				} catch {}
 			}
-		}, 300);
+			process.exit(0);
+		}, 3e3);
+	};
+	process.on("SIGINT", shutdown);
+	process.on("SIGTERM", shutdown);
+	return new Promise((resolve, reject) => {
+		turboProcess.on("error", (error) => {
+			logger$11.error("❌ Turbo error:", error);
+			reject(error);
+		});
+		turboProcess.on("exit", (code) => {
+			if (code !== null && code !== 0) reject(/* @__PURE__ */ new Error(`Turbo exited with code ${code}`));
+			else resolve();
+		});
 	});
+}
+/**
+* Run any TypeScript file with secret injection.
+* Does not require gkm.config.ts.
+*/
+async function entryDevCommand(options) {
+	const { entry, watch = true } = options;
+	if (!entry) throw new Error("--entry requires a file path");
+	const entryPath = resolve(process.cwd(), entry);
+	if (!existsSync(entryPath)) throw new Error(`Entry file not found: ${entryPath}`);
+	const defaultEnv = loadEnvFiles(".env");
+	if (defaultEnv.loaded.length > 0) logger$11.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
+	const { credentials, resolvedPort, secretsJsonPath, appName } = await prepareEntryCredentials({ explicitPort: options.portExplicit ? options.port : void 0 });
+	if (appName) logger$11.log(`📦 App: ${appName} (port ${resolvedPort})`);
+	logger$11.log(`🚀 Starting entry file: ${entry} on port ${resolvedPort}`);
+	if (Object.keys(credentials).length > 1) logger$11.log(`🔐 Loaded ${Object.keys(credentials).length - 1} secret(s) + PORT`);
+	const wrapperDir = join(process.cwd(), ".gkm");
+	await mkdir(wrapperDir, { recursive: true });
+	const wrapperPath = join(wrapperDir, "entry-wrapper.ts");
+	await createEntryWrapper(wrapperPath, entryPath, secretsJsonPath);
+	const runner = new EntryRunner(wrapperPath, entryPath, watch, resolvedPort);
+	await runner.start();
 	let isShuttingDown = false;
 	const shutdown = () => {
 		if (isShuttingDown) return;
 		isShuttingDown = true;
 		logger$11.log("\n🛑 Shutting down...");
-		Promise.all([watcher.close(), devServer.stop()]).catch((err) => {
-			logger$11.error("Error during shutdown:", err);
-		}).finally(() => {
-			process.exit(0);
-		});
+		runner.stop();
+		process.exit(0);
 	};
 	process.on("SIGINT", shutdown);
 	process.on("SIGTERM", shutdown);
+	await new Promise(() => {});
 }
 /**
-* Generate all dependency environment variables for all apps.
-* Returns a flat object with all {APP_NAME}_URL variables.
-* @internal Exported for testing
+* Runs and watches a TypeScript entry file using tsx.
 */
-function generateAllDependencyEnvVars(workspace, urlPrefix = "http://localhost") {
-	const env = {};
-	for (const appName of Object.keys(workspace.apps)) {
-		const appEnv = getDependencyEnvVars(workspace, appName, urlPrefix);
-		Object.assign(env, appEnv);
+var EntryRunner = class {
+	wrapperPath;
+	entryPath;
+	watch;
+	port;
+	childProcess = null;
+	watcher = null;
+	isRunning = false;
+	constructor(wrapperPath, entryPath, watch, port) {
+		this.wrapperPath = wrapperPath;
+		this.entryPath = entryPath;
+		this.watch = watch;
+		this.port = port;
 	}
-	return env;
-}
+	async start() {
+		await this.runProcess();
+		if (this.watch) {
+			const watchDir = dirname(this.entryPath);
+			this.watcher = chokidar.watch(watchDir, {
+				ignored: /(^|[/\\])\../,
+				persistent: true,
+				ignoreInitial: true
+			});
+			let restartTimeout = null;
+			this.watcher.on("change", (path) => {
+				logger$11.log(`📝 File changed: ${path}`);
+				if (restartTimeout) clearTimeout(restartTimeout);
+				restartTimeout = setTimeout(async () => {
+					logger$11.log("🔄 Restarting...");
+					await this.restart();
+				}, 300);
+			});
+			logger$11.log(`👀 Watching for changes in: ${watchDir}`);
+		}
+	}
+	async runProcess() {
+		const env = {
+			...process.env,
+			PORT: String(this.port)
+		};
+		this.childProcess = spawn("npx", ["tsx", this.wrapperPath], {
+			stdio: "inherit",
+			env,
+			detached: true
+		});
+		this.isRunning = true;
+		this.childProcess.on("error", (error) => {
+			logger$11.error("❌ Process error:", error);
+		});
+		this.childProcess.on("exit", (code) => {
+			if (code !== null && code !== 0 && code !== 143) logger$11.error(`❌ Process exited with code ${code}`);
+			this.isRunning = false;
+		});
+		await new Promise((resolve) => setTimeout(resolve, 500));
+		if (this.isRunning) {
+			logger$11.log("");
+			logger$11.log(`  \x1b[32m✓ Ready\x1b[0m at \x1b[36mhttp://localhost:${this.port}\x1b[0m`);
+			logger$11.log("");
+		}
+	}
+	async restart() {
+		this.stopProcess();
+		await new Promise((resolve) => setTimeout(resolve, 500));
+		await this.runProcess();
+	}
+	stop() {
+		this.watcher?.close();
+		this.stopProcess();
+	}
+	stopProcess() {
+		if (this.childProcess && this.isRunning) {
+			const pid = this.childProcess.pid;
+			if (pid) try {
+				process.kill(-pid, "SIGTERM");
+			} catch {
+				try {
+					process.kill(pid, "SIGTERM");
+				} catch {}
+			}
+			this.childProcess = null;
+			this.isRunning = false;
+		}
+	}
+};
 /**
-* Check for port conflicts across all apps.
-* Returns list of conflicts if any ports are duplicated.
+* Generate the content of the dev server entry file (server.ts).
+* Uses dynamic import for createApp so Credentials are populated
+* before any app modules evaluate.
 * @internal Exported for testing
 */
-function checkPortConflicts(workspace) {
-	const conflicts = [];
-	const portToApp = /* @__PURE__ */ new Map();
-	for (const [appName, app] of Object.entries(workspace.apps)) {
-		const existingApp = portToApp.get(app.port);
-		if (existingApp) conflicts.push({
-			app1: existingApp,
-			app2: appName,
-			port: app.port
-		});
-		else portToApp.set(app.port, appName);
-	}
-	return conflicts;
+function generateServerEntryContent(options) {
+	const { secretsJsonPath, runtime = "node", enableOpenApi = false, appImportPath = "./app.js", selfServing = false } = options;
+	const parentWatch = `// Exit when the gkm dev that started this server is gone.
+const __gkmDevPid = Number(process.env.GKM_DEV_PID);
+if (__gkmDevPid) {
+  setInterval(() => {
+    try {
+      process.kill(__gkmDevPid, 0);
+    } catch {
+      process.exit(0);
+    }
+  }, 1000).unref();
 }
-const FRONTEND_FRAMEWORKS = {
-	nextjs: {
-		displayName: "Next.js",
-		configFiles: [
-			"next.config.js",
-			"next.config.ts",
-			"next.config.mjs",
-			"next.config.cjs"
-		],
-		dependency: "next",
-		installCommand: "pnpm add next react react-dom"
-	},
-	remix: {
-		displayName: "Remix",
-		configFiles: [
-			"remix.config.js",
-			"remix.config.mjs",
-			"remix.config.ts",
-			"vite.config.js",
-			"vite.config.ts",
-			"vite.config.mjs",
-			"vite.config.cjs"
-		],
-		dependency: "@remix-run/dev",
-		installCommand: "pnpm add -D @remix-run/dev"
-	},
-	vite: {
-		displayName: "Vite",
-		configFiles: [
-			"vite.config.js",
-			"vite.config.ts",
-			"vite.config.mjs",
-			"vite.config.cjs"
-		],
-		dependency: "vite",
-		installCommand: "pnpm add -D vite"
-	},
-	"tanstack-start": {
-		displayName: "TanStack Start",
-		configFiles: [
-			"vite.config.js",
-			"vite.config.ts",
-			"vite.config.mjs",
-			"vite.config.cjs"
-		],
-		dependency: "@tanstack/react-start",
-		installCommand: "pnpm add @tanstack/react-start @tanstack/react-router"
-	},
-	expo: {
-		displayName: "Expo",
-		configFiles: [
-			"app.config.ts",
-			"app.config.js",
-			"app.json"
-		],
-		dependency: "expo",
-		installCommand: "pnpm add expo"
-	}
-};
-/** Whether a configured framework is one this table knows how to start. */
-function isClientFramework(framework) {
-	return framework !== void 0 && framework in FRONTEND_FRAMEWORKS;
+
+`;
+	const credentialsInjection = secretsJsonPath ? `import { existsSync, readFileSync } from 'node:fs';
+
+// Inject dev secrets via globalThis (must happen before app import)
+const secretsPath = '${secretsJsonPath}';
+if (existsSync(secretsPath)) {
+  const __secrets = JSON.parse(readFileSync(secretsPath, 'utf-8'));
+  globalThis.__gkm_credentials__ = __secrets;
+  Object.assign(process.env, __secrets);
 }
+
+` : "";
+	const serveCode = runtime === "bun" ? `Bun.serve({
+      port,
+      fetch: app.fetch,
+    });` : `const { serve } = await import('@hono/node-server');
+    const server = serve({
+      fetch: app.fetch,
+      port,
+    });
+    // Inject WebSocket support if available
+    const injectWs = (app as any).__injectWebSocket;
+    if (injectWs) {
+      injectWs(server);
+      console.log('🔌 Telescope real-time updates enabled');
+    }`;
+	if (selfServing) return `#!/usr/bin/env node
 /**
-* Auto-detect the frontend framework by scanning package.json deps and config
-* files. Dependency match wins over config file match because deps are more
-* distinctive (a Remix app has both vite.config.ts AND @remix-run/dev).
-*/
-function detectFrontendFramework(fullPath, deps) {
-	const order = [
-		"expo",
-		"tanstack-start",
-		"nextjs",
-		"remix",
-		"vite"
-	];
-	for (const name of order) if (deps[FRONTEND_FRAMEWORKS[name].dependency]) return name;
-	for (const name of order) if (FRONTEND_FRAMEWORKS[name].configFiles.some((file) => existsSync(join(fullPath, file)))) return name;
-}
+ * Development server entry point for a surface that serves itself
+ * This file is auto-generated by 'gkm dev'
+ */
+${credentialsInjection}${parentWatch}const port = process.argv.includes('--port')
+  ? Number.parseInt(process.argv[process.argv.indexOf('--port') + 1])
+  : 3000;
+
+// Dynamic import so Credentials are populated before the surface evaluates
+const { app } = await import('${appImportPath}');
+
+${serveCode.replace(/^ {4}/gm, "")}
+console.log(\`Server started on port \${port}\`);
+`;
+	return `#!/usr/bin/env node
 /**
-* Validate a frontend app configuration.
-*
-* If `framework` is provided, validates strictly against that framework's
-* expected config file and dependency. Otherwise auto-detects the framework
-* from package.json and config files. If no recognized framework is found, the
-* app is allowed through with a warning provided it has a `dev` script.
-*
-* @internal Exported for testing
-*/
-async function validateFrontendApp(appName, appPath, workspaceRoot, framework) {
-	const errors = [];
-	const warnings = [];
-	const fullPath = join(workspaceRoot, appPath);
-	const packageJsonPath = join(fullPath, "package.json");
-	if (!existsSync(packageJsonPath)) {
-		errors.push(`package.json not found at ${appPath}. Run: pnpm init in the app directory.`);
-		return {
-			appName,
-			valid: false,
-			errors,
-			warnings
-		};
+ * Development server entry point
+ * This file is auto-generated by 'gkm dev'
+ */
+${credentialsInjection}${parentWatch}const port = process.argv.includes('--port')
+  ? Number.parseInt(process.argv[process.argv.indexOf('--port') + 1])
+  : 3000;
+
+// Dynamic import so Credentials are populated before env.ts evaluates
+const { createApp } = await import('${appImportPath}');
+
+// createApp is async to support optional WebSocket setup
+const { app, start } = await createApp(undefined, ${enableOpenApi});
+
+// Start the server
+start({
+  port,
+  serve: async (app, port) => {
+    ${serveCode}
+  },
+}).catch((error) => {
+  console.error('Failed to start server:', error);
+  process.exit(1);
+});
+`;
+}
+/** A port this app must serve on is held by something else. */
+var DevPortInUse = class extends Error {
+	port;
+	holder;
+	constructor(port, holder) {
+		super(`Port ${port} is already in use${holder ? ` by ${holder}` : ""}. It is the port this app is provisioned on — the one every other app and its CORS origins point at — so dev will not move off it. Stop what is holding it (often a dev server a previous run left behind), or pass -p/--port to run this app somewhere else.`);
+		this.port = port;
+		this.holder = holder;
+		this.name = "DevPortInUse";
 	}
-	let pkg;
+};
+/** Apps whose provisioned ports are held before the workspace starts. */
+var WorkspacePortsInUse = class extends Error {
+	held;
+	constructor(held) {
+		super(`Ports this workspace's apps are provisioned on are already in use:\n${held.map(({ app, port, holder }) => `   ${app}: ${port}${holder ? ` — held by ${holder}` : ""}`).join("\n")}\nStop what is holding them (often dev servers a previous run left behind) and start again. Nothing was started.`);
+		this.held = held;
+		this.name = "WorkspacePortsInUse";
+	}
+};
+/** What is listening on a port, as `command (pid N)`, if `lsof` can tell. */
+function listenerOn(port) {
 	try {
-		pkg = __require(packageJsonPath);
+		const out = execSync(`lsof -nP -iTCP:${port} -sTCP:LISTEN -Fpc`, {
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		});
+		const pid = out.match(/^p(\d+)/m)?.[1];
+		const command = out.match(/^c(.+)$/m)?.[1];
+		return pid ? `${command ?? "a process"} (pid ${pid})` : void 0;
 	} catch {
-		errors.push(`Failed to read package.json at ${packageJsonPath}`);
-		return {
-			appName,
-			valid: false,
-			errors,
-			warnings
-		};
-	}
-	const deps = {
-		...pkg.dependencies,
-		...pkg.devDependencies
-	};
-	const resolvedFramework = framework ?? detectFrontendFramework(fullPath, deps);
-	if (resolvedFramework) {
-		const spec = FRONTEND_FRAMEWORKS[resolvedFramework];
-		if (!spec.configFiles.some((file) => existsSync(join(fullPath, file)))) errors.push(`${spec.displayName} config file not found. Expected one of: ${spec.configFiles.join(", ")}`);
-		if (!deps[spec.dependency]) errors.push(`${spec.displayName} not found in dependencies. Run: ${spec.installCommand}`);
-	} else warnings.push("No recognized frontend framework detected (Next.js, Vite, Remix). The app will run via its \"dev\" script. Set `framework` in your app config to enable strict validation.");
-	if (!pkg.scripts?.dev) {
-		if (resolvedFramework) warnings.push("No \"dev\" script found in package.json. Turbo expects a \"dev\" script to run.");
-		else errors.push("No \"dev\" script found in package.json. Without a recognized framework or a dev script, there is nothing to run.");
+		return;
 	}
-	return {
-		appName,
-		valid: errors.length === 0,
-		errors,
-		warnings
-	};
 }
-/**
-* Validate all frontend apps in the workspace.
-* Returns validation results for each frontend app.
-* @internal Exported for testing
-*/
-async function validateFrontendApps(workspace) {
-	const results = [];
-	for (const [appName, app] of Object.entries(workspace.apps)) if (app.type === "web") {
-		const result = await validateFrontendApp(appName, app.path, workspace.root, isClientFramework(app.framework) ? app.framework : void 0);
-		results.push(result);
+var DevServer = class {
+	provider;
+	requestedPort;
+	portExplicit;
+	enableOpenApi;
+	telescope;
+	studio;
+	runtime;
+	appRoot;
+	secretsJsonPath;
+	selfServing;
+	serverProcess = null;
+	isRunning = false;
+	actualPort;
+	startTime = Date.now();
+	constructor(provider, requestedPort, portExplicit, enableOpenApi, telescope, studio, runtime = "node", appRoot = process.cwd(), secretsJsonPath, selfServing = false) {
+		this.provider = provider;
+		this.requestedPort = requestedPort;
+		this.portExplicit = portExplicit;
+		this.enableOpenApi = enableOpenApi;
+		this.telescope = telescope;
+		this.studio = studio;
+		this.runtime = runtime;
+		this.appRoot = appRoot;
+		this.secretsJsonPath = secretsJsonPath;
+		this.selfServing = selfServing;
+		this.actualPort = requestedPort;
 	}
-	return results;
-}
-/**
-* Load secrets for development stage.
-* Returns env vars to inject, or empty object if secrets not configured/found.
-* @internal Exported for testing
-*/
-async function loadDevSecrets(workspace) {
-	if (!workspace.secrets.enabled) return {};
-	const stage = workspace.stages.local;
-	if (secretsExist(stage, workspace.root)) {
-		const secrets = await readStageSecrets(stage, workspace.root);
-		if (secrets) {
-			logger$11.log(`🔐 Loading secrets from stage: ${stage}`);
-			return toEmbeddableSecrets(secrets);
+	async start() {
+		this.startTime = Date.now();
+		if (this.isRunning) await this.stop();
+		if (this.portExplicit) {
+			if (!await isPortAvailable(this.requestedPort)) throw new DevPortInUse(this.requestedPort, listenerOn(this.requestedPort));
+			this.actualPort = this.requestedPort;
+		} else {
+			this.actualPort = await findAvailablePort(this.requestedPort);
+			if (this.actualPort !== this.requestedPort) logger$11.log(`ℹ️  Port ${this.requestedPort} was in use, using port ${this.actualPort} instead`);
+		}
+		const serverEntryPath = join(this.appRoot, ".gkm", this.provider, "server.ts");
+		await this.createServerEntry();
+		logger$11.log(`\n⏳ Starting server...`);
+		this.serverProcess = spawn("npx", [
+			"tsx",
+			serverEntryPath,
+			"--port",
+			this.actualPort.toString()
+		], {
+			stdio: "inherit",
+			env: {
+				...process.env,
+				NODE_ENV: "development",
+				GKM_DEV_PID: String(process.pid)
+			},
+			detached: true
+		});
+		this.isRunning = true;
+		this.serverProcess.on("error", (error) => {
+			logger$11.error("❌ Server error:", error);
+		});
+		this.serverProcess.on("exit", (code, signal) => {
+			if (code !== null && code !== 0 && signal !== "SIGTERM") logger$11.error(`❌ Server exited with code ${code}`);
+			this.isRunning = false;
+		});
+		await new Promise((resolve) => setTimeout(resolve, 1e3));
+		if (this.isRunning) {
+			const base = `http://localhost:${this.actualPort}`;
+			const lines = [`  Local:     ${base}`];
+			if (this.enableOpenApi) lines.push(`  API Docs:  ${base}/__docs`);
+			if (this.telescope) lines.push(`  Telescope: ${base}${this.telescope.path}`);
+			if (this.studio) lines.push(`  Studio:    ${base}${this.studio.path}`);
+			const maxLen = Math.max(...lines.map((l) => l.length));
+			const pad = (s) => s.padEnd(maxLen);
+			const border = "─".repeat(maxLen + 2);
+			logger$11.log("");
+			logger$11.log(`  \x1b[32m✓ Ready\x1b[0m in ${((Date.now() - this.startTime) / 1e3).toFixed(1)}s`);
+			logger$11.log("");
+			logger$11.log(`  ┌${border}┐`);
+			for (const line of lines) logger$11.log(`  │ ${pad(line)} │`);
+			logger$11.log(`  └${border}┘`);
+			logger$11.log("");
 		}
 	}
-	logger$11.warn(`⚠️  Secrets enabled but no "${stage}" secrets found. Run "gkm setup" to initialize the local stage`);
-	return {};
-}
-/**
-* Workspace dev command - orchestrates multi-app development using Turbo.
-*
-* Flow:
-* 1. Check for port conflicts
-* 2. Start docker-compose services (db, cache, mail)
-* 3. Generate dependency URLs ({APP_NAME}_URL)
-* 4. Spawn turbo run dev with injected env vars
-*/
-async function workspaceDevCommand(workspace, options) {
-	const appCount = Object.keys(workspace.apps).length;
-	const backendApps = Object.entries(workspace.apps).filter(([_, app]) => app.type === "backend");
-	const frontendApps = Object.entries(workspace.apps).filter(([_, app]) => app.type === "web");
-	const mobileApps = Object.entries(workspace.apps).filter(([_, app]) => app.type === "mobile");
-	logger$11.log(`\n🚀 Starting workspace: ${workspace.name}`);
-	const counts = [`${backendApps.length} backend`, `${frontendApps.length} web`];
-	if (mobileApps.length > 0) counts.push(`${mobileApps.length} mobile`);
-	logger$11.log(`   ${counts.join(", ")} app(s)`);
-	const conflicts = checkPortConflicts(workspace);
-	if (conflicts.length > 0) {
-		for (const conflict of conflicts) logger$11.error(`❌ Port conflict: Apps "${conflict.app1}" and "${conflict.app2}" both use port ${conflict.port}`);
-		throw new Error("Port conflicts detected. Please assign unique ports to each app.");
-	}
-	if (frontendApps.length > 0) {
-		logger$11.log("\n🔍 Validating frontend apps...");
-		const validationResults = await validateFrontendApps(workspace);
-		let hasErrors = false;
-		for (const result of validationResults) {
-			if (!result.valid) {
-				hasErrors = true;
-				logger$11.error(`\n❌ Frontend app "${result.appName}" validation failed:`);
-				for (const error of result.errors) logger$11.error(`   • ${error}`);
+	async stop() {
+		const port = this.actualPort;
+		if (this.serverProcess && this.isRunning) {
+			const pid = this.serverProcess.pid;
+			if (pid) try {
+				process.kill(-pid, "SIGKILL");
+			} catch {
+				try {
+					process.kill(pid, "SIGKILL");
+				} catch {}
 			}
-			for (const warning of result.warnings) logger$11.warn(`   ⚠️  ${result.appName}: ${warning}`);
+			this.serverProcess = null;
+			this.isRunning = false;
 		}
-		if (hasErrors) throw new Error("Frontend app validation failed. Fix the issues above and try again.");
-		logger$11.log("✅ Frontend apps validated");
+		this.killProcessesOnPort(port);
 	}
-	const rawSecrets = await loadDevSecrets(workspace);
-	let secretsEnv;
-	if (usesConstructs(workspace)) {
-		const reconciled = await reconcileWorkspace(workspace, { stage: workspace.stages.local });
-		if (reconciled.changed && reconciled.plan.containers.length > 0) {
-			logger$11.log(`🐳 Services: ${reconciled.plan.containers.join(", ")}`);
-			for (const [container, address] of Object.entries(reconciled.addresses)) logger$11.log(`   ${container}: ${address}`);
+	killProcessesOnPort(port) {
+		try {
+			execSync(`lsof -ti tcp:${port} -sTCP:LISTEN | xargs kill -9 2>/dev/null || true`, { stdio: "ignore" });
+		} catch {}
+	}
+	async restart() {
+		const portToReuse = this.actualPort;
+		await this.stop();
+		let attempts = 0;
+		while (attempts < 30) {
+			if (await isPortAvailable(portToReuse)) break;
+			await new Promise((resolve) => setTimeout(resolve, 100));
+			attempts++;
 		}
-		secretsEnv = {
-			...rawSecrets,
-			...reconciled.env
-		};
-	} else {
-		const resolvedPorts = await resolveServicePorts(workspace.root);
-		await startWorkspaceServices(workspace, resolvedPorts.dockerEnv, rawSecrets);
-		secretsEnv = rewriteUrlsWithPorts(rawSecrets, resolvedPorts);
+		this.requestedPort = portToReuse;
+		await this.start();
 	}
-	if (Object.keys(secretsEnv).length > 0) logger$11.log(`   Loaded ${Object.keys(secretsEnv).length} secret(s)`);
-	const dependencyEnv = generateAllDependencyEnvVars(workspace);
-	if (Object.keys(dependencyEnv).length > 0) {
-		logger$11.log("📡 Dependency URLs:");
-		for (const [key, value] of Object.entries(dependencyEnv)) logger$11.log(`   ${key}=${value}`);
+	async createServerEntry() {
+		const { writeFile: fsWriteFile } = await import("node:fs/promises");
+		await fsWriteFile(join(this.appRoot, ".gkm", this.provider, "server.ts"), generateServerEntryContent({
+			secretsJsonPath: this.secretsJsonPath,
+			runtime: this.runtime,
+			enableOpenApi: this.enableOpenApi,
+			selfServing: this.selfServing
+		}));
 	}
-	let turboFilter = [];
-	if (options.app) {
-		if (!workspace.apps[options.app]) {
-			const appNames = Object.keys(workspace.apps).join(", ");
-			throw new Error(`App "${options.app}" not found. Available apps: ${appNames}`);
+};
+//#endregion
+//#region src/generators/CronGenerator.ts
+var CronGenerator = class extends ConstructGenerator {
+	async build(context, constructs, outputDir, options) {
+		const provider = options?.provider || "aws-lambda";
+		const logger = console;
+		const cronInfos = [];
+		if (provider === "server") {
+			await this.generateServerCronsFile(outputDir, constructs);
+			logger.log(`Generated server crons file with ${constructs.length} crons`);
+			return cronInfos;
 		}
-		turboFilter = ["--filter", options.app];
-		logger$11.log(`\n🎯 Running single app: ${options.app}`);
-	} else if (options.filter) {
-		turboFilter = ["--filter", options.filter];
-		logger$11.log(`\n🔍 Using filter: ${options.filter}`);
-	} else logger$11.log(`\n🎯 Running all ${appCount} apps`);
-	const buildOrder = getAppBuildOrder(workspace);
-	logger$11.log("\n📋 Apps (in dependency order):");
-	for (const appName of buildOrder) {
-		const app = workspace.apps[appName];
-		if (!app) continue;
-		const deps = app.dependencies.length > 0 ? ` (depends on: ${app.dependencies.join(", ")})` : "";
-		const icon = app.type === "backend" ? "🔧" : app.type === "mobile" ? "📱" : "🌐";
-		logger$11.log(`   ${icon} ${appName} → http://localhost:${app.port}${deps}`);
-	}
-	const configFiles = [
-		"gkm.config.ts",
-		"gkm.config.js",
-		"gkm.config.json"
-	];
-	let configPath = "";
-	for (const file of configFiles) {
-		const fullPath = join(workspace.root, file);
-		if (existsSync(fullPath)) {
-			configPath = fullPath;
-			break;
+		if (constructs.length === 0 || provider !== "aws-lambda") return cronInfos;
+		const cronsDir = join(outputDir, "crons");
+		await mkdir(cronsDir, { recursive: true });
+		for (const { key, construct, path } of constructs) {
+			const handlerFile = await this.generateCronHandler(cronsDir, path.relative, key, context, construct.owner);
+			cronInfos.push({
+				name: key,
+				handler: relative(process.cwd(), handlerFile).replace(/\.ts$/, ".handler"),
+				schedule: construct.schedule || "rate(1 hour)",
+				timeout: construct.timeout,
+				memorySize: construct.memorySize,
+				environment: await construct.getEnvironment({ markOptional: context.markOptional }),
+				dependencies: construct.constructs
+			});
+			logger.log(`Generated cron handler: ${key}`);
 		}
+		return cronInfos;
 	}
-	const turboEnv = {
-		...process.env,
-		...secretsEnv,
-		...dependencyEnv,
-		NODE_ENV: "development",
-		...configPath ? { GKM_CONFIG_PATH: configPath } : {}
-	};
-	logger$11.log("\n🏃 Starting turbo run dev...\n");
-	const turboProcess = spawn("pnpm", [
-		"turbo",
-		"run",
-		"dev",
-		...turboFilter
-	], {
-		cwd: workspace.root,
-		stdio: "inherit",
-		env: turboEnv,
-		detached: true
-	});
-	let isShuttingDown = false;
-	const shutdown = () => {
-		if (isShuttingDown) return;
-		isShuttingDown = true;
-		logger$11.log("\n🛑 Shutting down workspace...");
-		const pid = turboProcess.pid;
-		if (pid) try {
-			process.kill(-pid, "SIGTERM");
-		} catch {
-			try {
-				process.kill(pid, "SIGTERM");
-			} catch {}
-		}
-		setTimeout(() => {
-			if (pid) try {
-				process.kill(-pid, "SIGKILL");
-			} catch {
-				try {
-					process.kill(pid, "SIGKILL");
-				} catch {}
-			}
-			process.exit(0);
-		}, 3e3);
-	};
-	process.on("SIGINT", shutdown);
-	process.on("SIGTERM", shutdown);
-	return new Promise((resolve, reject) => {
-		turboProcess.on("error", (error) => {
-			logger$11.error("❌ Turbo error:", error);
-			reject(error);
-		});
-		turboProcess.on("exit", (code) => {
-			if (code !== null && code !== 0) reject(/* @__PURE__ */ new Error(`Turbo exited with code ${code}`));
-			else resolve();
-		});
-	});
-}
-/**
-* What the app declares, or nothing when it declares in the old way.
-*
-* Discovery imports the application's construct modules, which is why this is
-* guarded rather than unconditional: a project with no `constructs` glob has
-* not adopted the model, and there is nothing to import.
-*/
-async function declaredConstructs(config, appRoot, sources) {
-	const patterns = typeof config?.constructs === "string" || Array.isArray(config?.constructs) ? config.constructs : void 0;
-	if (!patterns) return {};
-	try {
-		return await discover({
-			patterns: (Array.isArray(patterns) ? patterns : [patterns]).map((p) => isAbsolute(p) ? p : join(appRoot, p)),
-			cwd: appRoot,
-			sources
-		});
-	} catch {
-		return {};
+	isConstruct(value) {
+		return Cron.isCron(value);
 	}
+	/**
+	* The crons file a server entry imports.
+	*
+	* Shaped after `generateServerSubscribersFile`: one module, every cron, a
+	* `setupCrons` the generated entry calls beside `setupSubscribers`.
+	*
+	* It picks its scheduler from what the process can reach. With a Postgres it
+	* uses pg-boss, whose schedules live in the database — so a deployment
+	* running four replicas fires each job once, which is the thing a timer in
+	* every process gets wrong and does not report. With no database it falls
+	* back to timers and says plainly that it is doing so.
+	*/
+	async generateServerCronsFile(outputDir, crons) {
+		await mkdir(outputDir, { recursive: true });
+		const cronsPath = join(outputDir, "crons.ts");
+		const importsByFile = /* @__PURE__ */ new Map();
+		for (const { path, key } of crons) {
+			const importPath = relative(dirname(cronsPath), path.relative).replace(/\.ts$/, ".js");
+			if (!importsByFile.has(importPath)) importsByFile.set(importPath, []);
+			importsByFile.get(importPath)?.push(key);
+		}
+		const content = `/**
+ * Generated cron setup.
+ *
+ * Schedules every cron this app declares, in the process that serves it.
+ *
+ * The schedule lives in Postgres, through pg-boss, in the database the worker
+ * named with \`.database(db)\`. That is what makes running several replicas
+ * safe: each job fires once, where a timer in every process fires it once per
+ * replica and reports nothing.
+ *
+ * No connection string appears here. The construct that owns the database is
+ * the only thing that knows its key, and it is resolved through service
+ * discovery like any other dependency.
+ */
+import type { EnvironmentParser } from '@geekmidas/envkit';
+import type { Logger } from '@geekmidas/logger';
+import { toCronExpression } from '@geekmidas/constructs/crons';
+import { ServiceDiscovery } from '@geekmidas/services';
+${Array.from(importsByFile.entries()).map(([importPath, exports]) => `import { ${exports.join(", ")} } from '${importPath}';`).join("\n")}
+
+const crons = [
+${crons.map(({ key }) => `  { name: '${key}', cron: ${key} }`).join(",\n")}
+];
+
+type Stoppable = { stop: () => Promise<void> | void };
+const running: Stoppable[] = [];
+
+export async function setupCrons(
+  envParser: EnvironmentParser<any>,
+  logger: Logger,
+): Promise<void> {
+  if (crons.length === 0) {
+    return;
+  }
+
+  const serviceDiscovery = ServiceDiscovery.getInstance(envParser);
+
+  // Resolved once per cron rather than per firing: registering services on
+  // every tick would reconnect a database every minute.
+  const prepared = [];
+  for (const { name, cron } of crons) {
+    try {
+      const schedule = toCronExpression(cron.schedule);
+      const services = cron.services.length > 0
+        ? await serviceDiscovery.register(cron.services)
+        : {};
+
+      prepared.push({ name, cron, schedule, services });
+    } catch (error) {
+      // An unrepresentable schedule is a build-time mistake, and failing the
+      // process for it would take the HTTP server down with it.
+      logger.error({ error, cron: name }, 'Cron has no runnable schedule, skipping');
+    }
+  }
+
+  const run = async (entry: (typeof prepared)[number]) => {
+    try {
+      await entry.cron.handler({
+        input: undefined,
+        services: entry.services,
+        logger: entry.cron.logger,
+      });
+    } catch (error) {
+      logger.error({ error, cron: entry.name }, 'Cron failed');
+    }
+  };
+
+  // The app's one pg-boss: the events broker's, as the broker's role, in the
+  // broker's schema. A server fires its own crons, and a process scheduling in
+  // memory fires each job once per replica — so the schedule lives in
+  // Postgres. It used to be a second pg-boss on the worker's database, as the
+  // runtime role, which can neither create a schema nor use the broker's.
+  const { url } = envParser
+    .create((get) => ({
+      url: get('EVENT_SUBSCRIBER_CONNECTION_STRING').string().optional(),
+    }))
+    .parse();
+
+  if (!url?.startsWith('pgboss://')) {
+    logger.error(
+      { crons: prepared.map(({ name }) => name) },
+      'These crons have nowhere to keep their schedule. On a server they are ' +
+        'scheduled through the pg-boss events broker ' +
+        '(EVENT_SUBSCRIBER_CONNECTION_STRING), and ' +
+        (url ? 'the broker configured is not pg-boss.' : 'none is configured.'),
+    );
+    return;
+  }
+
+  const { PgBossConnection } = await import('@geekmidas/events/pgboss');
+  const connection = await PgBossConnection.fromConnectionString(url);
+  const boss = connection.instance!;
+
+  // What this app declares now. Anything else under the prefix belonged to a
+  // cron since renamed or deleted, and would keep firing at a handler that has
+  // gone.
+  //
+  // The prefix is \`cron.\` rather than \`cron:\`: pg-boss accepts
+  // alphanumerics, underscores, hyphens, periods and slashes in a queue name,
+  // and rejects a colon outright.
+  const declared = new Set(prepared.map(({ name }) => \`cron.\${name}\`));
+  for (const existing of await boss.getSchedules()) {
+    if (existing.name.startsWith('cron.') && !declared.has(existing.name)) {
+      await boss.unschedule(existing.name);
+      logger.info({ cron: existing.name }, 'Removed a schedule nothing declares');
+    }
+  }
+
+  for (const entry of prepared) {
+    const queue = \`cron.\${entry.name}\`;
+    await boss.createQueue(queue);
+    // UTC, so this agrees with the schedule a deploy target would have made.
+    await boss.schedule(queue, entry.schedule, undefined, { tz: 'UTC' });
+    await boss.work(queue, () => run(entry));
+
+    logger.info({ cron: entry.name, schedule: entry.schedule }, 'Cron scheduled');
+  }
+
+  running.push({ stop: () => connection.close() });
+  logger.info({ count: prepared.length }, 'Crons scheduled');
+}
+
+export async function stopCrons(): Promise<void> {
+  await Promise.all(running.map((r) => r.stop()));
+  running.length = 0;
 }
-async function buildServer(config, context, provider, enableOpenApi, appRoot, workspaceRoot, bustCache = false) {
-	const sources = {};
-	const declared = await declaredConstructs(config, appRoot, sources);
-	context = {
-		...context,
-		...ownersContext({
-			declared,
-			sources,
-			workspaceRoot,
-			appRoot,
-			studio: context.studio
-		}),
-		storageDrivers: driversFor({
-			appRoot,
-			cache: cacheBackendsIn(declared, cacheBackendFor(providerOf(config ?? {})))
-		})
-	};
-	const endpointGenerator = new EndpointGenerator();
-	const functionGenerator = new FunctionGenerator();
-	const cronGenerator = new CronGenerator();
-	const subscriberGenerator = new SubscriberGenerator();
-	const queueGenerator = new QueueGenerator();
-	const topicGenerator = new TopicGenerator();
-	const [loadedEndpoints, allFunctions, allCrons, allSubscribers, allQueues, allTopics] = await Promise.all([
-		endpointGenerator.load(config.constructs, appRoot, bustCache),
-		config.functions ? functionGenerator.load(config.functions, appRoot, bustCache) : [],
-		config.crons ? cronGenerator.load(config.crons, appRoot, bustCache) : [],
-		config.subscribers ? subscriberGenerator.load(config.subscribers, appRoot, bustCache) : [],
-		config.queues ? queueGenerator.load(config.queues, appRoot, bustCache) : [],
-		config.topics ? topicGenerator.load(config.topics, appRoot, bustCache) : []
-	]);
-	const allEndpoints = servedBy(loadedEndpoints, context.surface);
-	const outputDir = join(appRoot, ".gkm", provider);
-	await mkdir(outputDir, { recursive: true });
-	await Promise.all([
-		endpointGenerator.build(context, allEndpoints, outputDir, {
-			provider,
-			enableOpenApi
-		}),
-		functionGenerator.build(context, allFunctions, outputDir, { provider }),
-		cronGenerator.build(context, allCrons, outputDir, { provider }),
-		subscriberGenerator.build(context, allSubscribers, outputDir, { provider }),
-		queueGenerator.build(context, allQueues, outputDir, { provider }),
-		topicGenerator.build(context, allTopics, outputDir, { provider })
-	]);
-}
+`;
+		await writeFile(cronsPath, content);
+		return cronsPath;
+	}
+	async generateCronHandler(outputDir, sourceFile, exportName, context, owner) {
+		const handlerFileName = `${exportName}.ts`;
+		const handlerPath = join(outputDir, handlerFileName);
+		const importPath = relative(dirname(handlerPath), sourceFile).replace(/\.ts$/, ".js");
+		const runtime = runtimeFor(context, dirname(handlerPath), owner);
+		const content = `import { AWSScheduledFunction } from '@geekmidas/constructs/aws';
+import { ${exportName} } from '${importPath}';
+${runtime.imports}
+${runtime.bindings}
+
+const adapter = new AWSScheduledFunction(envParser, ${exportName});
+
+export const handler = adapter.handler;
+`;
+		await writeFile(handlerPath, content);
+		return handlerPath;
+	}
+};
+//#endregion
+//#region src/generators/drivers.ts
 /**
-* Run any TypeScript file with secret injection.
-* Does not require gkm.config.ts.
+* Driver registration for generated entry points.
+*
+* A construct declares that it needs object storage and is handed one URL; the
+* scheme in that URL picks the driver that builds the client. Which drivers
+* exist is therefore the *entry point's* decision, not the construct's and not
+* the application's — an app that never talks to S3 should never resolve the AWS
+* SDK, and application code that registers a driver has named a provider in the
+* one layer this design keeps provider-free.
+*
+* So the generated entries register: `gkm dev`'s server for local development,
+* and each Lambda handler for its own target. Registration is an explicit call
+* rather than an import side effect, because a side-effecting module is exactly
+* what a bundler is entitled to drop.
 */
-async function entryDevCommand(options) {
-	const { entry, watch = true } = options;
-	if (!entry) throw new Error("--entry requires a file path");
-	const entryPath = resolve(process.cwd(), entry);
-	if (!existsSync(entryPath)) throw new Error(`Entry file not found: ${entryPath}`);
-	const defaultEnv = loadEnvFiles(".env");
-	if (defaultEnv.loaded.length > 0) logger$11.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
-	const { credentials, resolvedPort, secretsJsonPath, appName } = await prepareEntryCredentials({ explicitPort: options.portExplicit ? options.port : void 0 });
-	if (appName) logger$11.log(`📦 App: ${appName} (port ${resolvedPort})`);
-	logger$11.log(`🚀 Starting entry file: ${entry} on port ${resolvedPort}`);
-	if (Object.keys(credentials).length > 1) logger$11.log(`🔐 Loaded ${Object.keys(credentials).length - 1} secret(s) + PORT`);
-	const wrapperDir = join(process.cwd(), ".gkm");
-	await mkdir(wrapperDir, { recursive: true });
-	const wrapperPath = join(wrapperDir, "entry-wrapper.ts");
-	await createEntryWrapper(wrapperPath, entryPath, secretsJsonPath);
-	const runner = new EntryRunner(wrapperPath, entryPath, watch, resolvedPort);
-	await runner.start();
-	let isShuttingDown = false;
-	const shutdown = () => {
-		if (isShuttingDown) return;
-		isShuttingDown = true;
-		logger$11.log("\n🛑 Shutting down...");
-		runner.stop();
-		process.exit(0);
-	};
-	process.on("SIGINT", shutdown);
-	process.on("SIGTERM", shutdown);
-	await new Promise(() => {});
-}
+/** The `s3://` driver, which serves MinIO locally and S3 deployed. */
+const S3 = {
+	imports: `import { registerStorageDriver } from '@geekmidas/storage';\nimport { s3Driver } from '@geekmidas/storage/aws';`,
+	setup: "registerStorageDriver(s3Driver);"
+};
+const NONE = {
+	imports: "",
+	setup: ""
+};
 /**
-* Runs and watches a TypeScript entry file using tsx.
+* The cache driver for a backend — exactly one, never all three.
+*
+* Keyed off the *backend* rather than off a dependency, because unlike storage
+* the backend already says which driver is right: a project caching in Postgres
+* resolves `pg` and never `ioredis`, and one caching in Upstash resolves
+* neither. That is the whole reason the drivers live behind separate subpaths.
+*
+* Both HTTP schemes are registered for Upstash, because the local proxy speaks
+* `http://` and Upstash speaks `https://`, and an entry that registered one
+* would work in exactly one of the two places.
 */
-var EntryRunner = class {
-	wrapperPath;
-	entryPath;
-	watch;
-	port;
-	childProcess = null;
-	watcher = null;
-	isRunning = false;
-	constructor(wrapperPath, entryPath, watch, port) {
-		this.wrapperPath = wrapperPath;
-		this.entryPath = entryPath;
-		this.watch = watch;
-		this.port = port;
+const CACHE_DRIVERS = {
+	upstash: {
+		imports: `import { registerCacheDriver } from '@geekmidas/cache';\nimport { upstashCacheDriver, upstashInsecureCacheDriver } from '@geekmidas/cache/upstash';`,
+		setup: "registerCacheDriver(upstashCacheDriver);\nregisterCacheDriver(upstashInsecureCacheDriver);"
+	},
+	elasticache: {
+		imports: `import { registerCacheDriver } from '@geekmidas/cache';\nimport { redisCacheDriver, redissCacheDriver } from '@geekmidas/cache/redis';`,
+		setup: "registerCacheDriver(redisCacheDriver);\nregisterCacheDriver(redissCacheDriver);"
+	},
+	db: {
+		imports: `import { registerCacheDriver } from '@geekmidas/cache';\nimport { postgresCacheDriver } from '@geekmidas/cache/postgres';`,
+		setup: "registerCacheDriver(postgresCacheDriver);"
 	}
-	async start() {
-		await this.runProcess();
-		if (this.watch) {
-			const watchDir = dirname(this.entryPath);
-			this.watcher = chokidar.watch(watchDir, {
-				ignored: /(^|[/\\])\../,
-				persistent: true,
-				ignoreInitial: true
+};
+/**
+* Everything a generated entry should register: object storage, and the cache.
+*
+* Merged here rather than threaded separately, because a generated file has one
+* import block and one setup block whatever fills them.
+*/
+function driversFor(options) {
+	const backends = options.cache === false || options.cache === void 0 ? [] : typeof options.cache === "string" ? [options.cache] : options.cache;
+	const parts = [storageDriversFor(options.appRoot), ...[...new Set(backends)].map((backend) => CACHE_DRIVERS[backend] ?? CACHE_DRIVERS[DEFAULT_CACHE.aws])].filter((part) => part.imports || part.setup);
+	if (parts.length === 0) return NONE;
+	return {
+		imports: parts.map((part) => part.imports).join("\n"),
+		setup: parts.map((part) => part.setup).join("\n")
+	};
+}
+/**
+* Which cache backends an app's entry actually has to speak.
+*
+* The config answers this for a cache that named nowhere, and the *declaration*
+* answers it for one that named a database — `orders.cache('Sessions')` is a
+* statement about the application, so a deployment cannot move that cache and
+* the entry cannot register a driver for somewhere else.
+*
+* Reading only the config is how an entry ends up registering the Upstash
+* driver for a URL the target composed as `postgres://`, which fails at the
+* first request with `UnregisteredCacheScheme` and a stack that points at the
+* cache rather than at the config that disagreed.
+*/
+function cacheBackendsIn(manifest, configured) {
+	const caches = Object.values(manifest).filter((d) => d.kind === "cache");
+	return [...new Set(caches.map((c) => c.of ? "db" : configured))];
+}
+/**
+* The drivers an app's entry points should register.
+*
+* Keyed off the dependency rather than off a declared bucket, because the entry
+* is generated before discovery has run on the watcher's rebuild path — and an
+* app that installed `@geekmidas/storage` has already paid for the SDK it would
+* otherwise resolve lazily.
+*/
+function storageDriversFor(appRoot) {
+	return dependsOnStorage(appRoot) ? S3 : NONE;
+}
+function dependsOnStorage(appRoot) {
+	const manifest = join(appRoot, "package.json");
+	if (!existsSync(manifest)) return false;
+	try {
+		const pkg = JSON.parse(readFileSync(manifest, "utf8"));
+		return Boolean(pkg.dependencies?.["@geekmidas/storage"] ?? pkg.devDependencies?.["@geekmidas/storage"]);
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/generators/FunctionGenerator.ts
+var FunctionGenerator = class extends ConstructGenerator {
+	isConstruct(value) {
+		return Function.isFunction(value);
+	}
+	async build(context, constructs, outputDir, options) {
+		const provider = options?.provider || "aws-lambda";
+		const logger = console;
+		const functionInfos = [];
+		if (constructs.length === 0 || provider !== "aws-lambda") return functionInfos;
+		const functionsDir = join(outputDir, "functions");
+		await mkdir(functionsDir, { recursive: true });
+		for (const { key, construct, path } of constructs) {
+			const handlerFile = await this.generateFunctionHandler(functionsDir, path.relative, key, context, construct.owner);
+			functionInfos.push({
+				name: key,
+				handler: relative(process.cwd(), handlerFile).replace(/\.ts$/, ".handler"),
+				timeout: construct.timeout,
+				memorySize: construct.memorySize,
+				environment: await construct.getEnvironment({ markOptional: context.markOptional }),
+				dependencies: construct.constructs
 			});
-			let restartTimeout = null;
-			this.watcher.on("change", (path) => {
-				logger$11.log(`📝 File changed: ${path}`);
-				if (restartTimeout) clearTimeout(restartTimeout);
-				restartTimeout = setTimeout(async () => {
-					logger$11.log("🔄 Restarting...");
-					await this.restart();
-				}, 300);
+			logger.log(`Generated function handler: ${key}`);
+		}
+		return functionInfos;
+	}
+	async generateFunctionHandler(outputDir, sourceFile, exportName, context, owner) {
+		const handlerFileName = `${exportName}.ts`;
+		const handlerPath = join(outputDir, handlerFileName);
+		const importPath = relative(dirname(handlerPath), sourceFile).replace(/\.ts$/, ".js");
+		const runtime = runtimeFor(context, dirname(handlerPath), owner);
+		const content = `import { AWSLambdaFunction } from '@geekmidas/constructs/aws';
+import { ${exportName} } from '${importPath}';
+${runtime.imports}
+${runtime.bindings}
+
+const adapter = new AWSLambdaFunction(envParser, ${exportName});
+
+export const handler = adapter.handler;
+`;
+		await writeFile(handlerPath, content);
+		return handlerPath;
+	}
+};
+//#endregion
+//#region src/generators/QueueGenerator.ts
+/**
+* Generates the runtime for `q` queue workers.
+*
+* - **server** (`gkm dev`): a single `queues.ts` exposing `setupQueues()` that
+*   runs an in-process pg-boss poller alongside the Hono server — no SQS/Lambda.
+*   Each queue subscribes by its **name** on the shared event connection.
+* - **aws-lambda**: one handler file per queue wrapping `AWSLambdaQueue`, backed
+*   by an SQS event-source mapping.
+*/
+var QueueGenerator = class extends ConstructGenerator {
+	isConstruct(value) {
+		return Queue.isQueue(value);
+	}
+	async build(context, constructs, outputDir, options) {
+		const provider = options?.provider || "aws-lambda";
+		const logger = console;
+		const queueInfos = [];
+		if (provider === "server") {
+			await this.generateServerQueuesFile(outputDir, constructs);
+			logger.log(`Generated server queues file with ${constructs.length} queues (polling mode)`);
+			return queueInfos;
+		}
+		if (constructs.length === 0 || provider !== "aws-lambda") return queueInfos;
+		const queuesDir = join(outputDir, "queues");
+		await mkdir(queuesDir, { recursive: true });
+		for (const { key, construct, path } of constructs) {
+			const handlerFile = await this.generateQueueHandler(queuesDir, path.relative, key, context, construct.owner);
+			queueInfos.push({
+				name: construct.name,
+				handler: relative(process.cwd(), handlerFile).replace(/\.ts$/, ".handler"),
+				batchSize: construct.batchSize,
+				fifo: construct.fifo,
+				timeout: construct.timeout,
+				environment: await construct.getEnvironment({ markOptional: context.markOptional }),
+				dependencies: construct.constructs
 			});
-			logger$11.log(`👀 Watching for changes in: ${watchDir}`);
+			logger.log(`Generated queue handler: ${key}`);
+		}
+		return queueInfos;
+	}
+	async generateQueueHandler(outputDir, sourceFile, exportName, context, owner) {
+		const handlerPath = join(outputDir, `${exportName}.ts`);
+		const importPath = relative(dirname(handlerPath), sourceFile).replace(/\.ts$/, ".js");
+		const runtime = runtimeFor(context, dirname(handlerPath), owner);
+		const content = `import { AWSLambdaQueue } from '@geekmidas/constructs/aws';
+import { ${exportName} } from '${importPath}';
+${runtime.imports}
+${runtime.bindings}
+
+const adapter = new AWSLambdaQueue(envParser, ${exportName});
+
+export const handler = adapter.handler;
+`;
+		await writeFile(handlerPath, content);
+		return handlerPath;
+	}
+	async generateServerQueuesFile(outputDir, queues) {
+		await mkdir(outputDir, { recursive: true });
+		const queuesPath = join(outputDir, "queues.ts");
+		if (queues.length === 0) {
+			await writeFile(queuesPath, `/**
+ * Generated queues setup — this app declares none.
+ */
+import type { EnvironmentParser } from '@geekmidas/envkit';
+import type { Logger } from '@geekmidas/logger';
+
+export async function setupQueues(
+  _envParser: EnvironmentParser<any>,
+  _logger: Logger,
+): Promise<void> {}
+`);
+			return queuesPath;
+		}
+		const importsByFile = /* @__PURE__ */ new Map();
+		for (const { path, key } of queues) {
+			const importPath = relative(dirname(queuesPath), path.relative).replace(/\.ts$/, ".js");
+			if (!importsByFile.has(importPath)) importsByFile.set(importPath, []);
+			importsByFile.get(importPath)?.push(key);
+		}
+		const content = `/**
+ * Generated queue workers setup
+ *
+ * ⚠️  WARNING: This is for LOCAL DEVELOPMENT ONLY
+ * This runs an in-process pg-boss poller alongside the HTTP server. Each queue
+ * subscribes by its name on the shared event connection
+ * (EVENT_SUBSCRIBER_CONNECTION_STRING), so producers using
+ * <NAME>_PUBLISHER_CONNECTION_STRING (pgboss:// locally) reach it.
+ *
+ * For production, queues run as AWS Lambda with SQS event-source mappings.
+ */
+import type { EnvironmentParser } from '@geekmidas/envkit';
+import type { Logger } from '@geekmidas/logger';
+import { EventConnectionFactory, Subscriber } from '@geekmidas/events';
+import type { EventConnection, EventSubscriber } from '@geekmidas/events';
+import { ServiceDiscovery } from '@geekmidas/services';
+${Array.from(importsByFile.entries()).map(([importPath, exports]) => `import { ${exports.join(", ")} } from '${importPath}';`).join("\n")}
+
+const queues = [
+  ${queues.map(({ key }) => key).join(",\n  ")}
+];
+
+const activeSubscribers: EventSubscriber<any>[] = [];
+
+export async function setupQueues(
+  envParser: EnvironmentParser<any>,
+  logger: Logger,
+): Promise<void> {
+  if (queues.length === 0) {
+    return;
+  }
+
+  logger.info('Setting up queue workers in polling mode (local development)');
+
+  const config = envParser.create((get) => ({
+    connectionString: get('EVENT_SUBSCRIBER_CONNECTION_STRING').string(),
+  })).parse();
+
+  const serviceDiscovery = ServiceDiscovery.getInstance(envParser);
+
+  let connection: EventConnection;
+  try {
+    connection = await EventConnectionFactory.fromConnectionString(config.connectionString);
+    const connectionType = new URL(config.connectionString).protocol.replace(':', '');
+    logger.info({ connectionType }, 'Created shared event connection for queues');
+  } catch (error) {
+    logger.error({ error }, 'Failed to create event connection for queues');
+    return;
+  }
+
+  for (const queue of queues) {
+    try {
+      const eventSubscriber = await Subscriber.fromConnection(connection);
+
+      const services = queue.services.length > 0
+        ? await serviceDiscovery.register(queue.services)
+        : {};
+
+      // A queue subscribes to a single "type" — its own name.
+      await eventSubscriber.subscribe([queue.name], async (message) => {
+        try {
+          const validation = await queue.messageSchema['~standard'].validate(message.payload);
+          if (validation.issues) {
+            logger.error({ issues: validation.issues, queue: queue.name }, 'Queue message failed validation');
+            return;
+          }
+
+          await queue.handler({
+            messages: [validation.value],
+            services: services,
+            logger: queue.logger,
+          });
+
+          logger.debug({ queue: queue.name }, 'Successfully processed queue message');
+        } catch (error) {
+          logger.error({ error, queue: queue.name }, 'Failed to process queue message');
+          // Message will become visible again for retry.
+        }
+      });
+
+      activeSubscribers.push(eventSubscriber);
+      logger.info({ queue: queue.name }, 'Queue worker started polling');
+    } catch (error) {
+      logger.error({ error, queue: queue.name }, 'Failed to setup queue worker');
+    }
+  }
+
+  const shutdown = () => {
+    logger.info('Stopping all queue workers');
+    for (const _ of activeSubscribers) {
+      connection.stop();
+    }
+  };
+
+  process.on('SIGTERM', shutdown);
+  process.on('SIGINT', shutdown);
+}
+`;
+		await writeFile(queuesPath, content);
+		return queuesPath;
+	}
+};
+//#endregion
+//#region src/generators/SubscriberGenerator.ts
+var SubscriberGenerator = class extends ConstructGenerator {
+	isConstruct(value) {
+		return Subscriber.isSubscriber(value);
+	}
+	async build(context, constructs, outputDir, options) {
+		const provider = options?.provider || "aws-lambda";
+		const logger = console;
+		const subscriberInfos = [];
+		if (provider === "server") {
+			await this.generateServerSubscribersFile(outputDir, constructs);
+			logger.log(`Generated server subscribers file with ${constructs.length} subscribers (polling mode)`);
+			return subscriberInfos;
 		}
-	}
-	async runProcess() {
-		const env = {
-			...process.env,
-			PORT: String(this.port)
-		};
-		this.childProcess = spawn("npx", ["tsx", this.wrapperPath], {
-			stdio: "inherit",
-			env,
-			detached: true
-		});
-		this.isRunning = true;
-		this.childProcess.on("error", (error) => {
-			logger$11.error("❌ Process error:", error);
-		});
-		this.childProcess.on("exit", (code) => {
-			if (code !== null && code !== 0 && code !== 143) logger$11.error(`❌ Process exited with code ${code}`);
-			this.isRunning = false;
-		});
-		await new Promise((resolve) => setTimeout(resolve, 500));
-		if (this.isRunning) {
-			logger$11.log("");
-			logger$11.log(`  \x1b[32m✓ Ready\x1b[0m at \x1b[36mhttp://localhost:${this.port}\x1b[0m`);
-			logger$11.log("");
+		if (constructs.length === 0) return subscriberInfos;
+		if (provider !== "aws-lambda") return subscriberInfos;
+		const subscribersDir = join(outputDir, "subscribers");
+		await mkdir(subscribersDir, { recursive: true });
+		for (const { key, construct, path } of constructs) {
+			const handlerFile = await this.generateSubscriberHandler(subscribersDir, path.relative, key, construct, context, construct.owner);
+			subscriberInfos.push({
+				name: key,
+				handler: relative(process.cwd(), handlerFile).replace(/\.ts$/, ".handler"),
+				subscribedEvents: construct.subscribedEvents || [],
+				...construct.topicName ? {
+					transport: "topic",
+					topic: construct.topicName
+				} : {},
+				timeout: construct.timeout,
+				memorySize: construct.memorySize,
+				environment: await construct.getEnvironment({ markOptional: context.markOptional }),
+				dependencies: construct.constructs
+			});
+			logger.log(`Generated subscriber handler: ${key}`);
 		}
+		return subscriberInfos;
 	}
-	async restart() {
-		this.stopProcess();
-		await new Promise((resolve) => setTimeout(resolve, 500));
-		await this.runProcess();
-	}
-	stop() {
-		this.watcher?.close();
-		this.stopProcess();
+	async generateSubscriberHandler(outputDir, sourceFile, exportName, _subscriber, context, owner) {
+		const handlerFileName = `${exportName}.ts`;
+		const handlerPath = join(outputDir, handlerFileName);
+		const importPath = relative(dirname(handlerPath), sourceFile).replace(/\.ts$/, ".js");
+		const runtime = runtimeFor(context, dirname(handlerPath), owner);
+		const content = `import { AWSLambdaSubscriber } from '@geekmidas/constructs/aws';
+import { ${exportName} } from '${importPath}';
+${runtime.imports}
+${runtime.bindings}
+
+const adapter = new AWSLambdaSubscriber(envParser, ${exportName});
+
+export const handler = adapter.handler;
+`;
+		await writeFile(handlerPath, content);
+		return handlerPath;
 	}
-	stopProcess() {
-		if (this.childProcess && this.isRunning) {
-			const pid = this.childProcess.pid;
-			if (pid) try {
-				process.kill(-pid, "SIGTERM");
-			} catch {
-				try {
-					process.kill(pid, "SIGTERM");
-				} catch {}
-			}
-			this.childProcess = null;
-			this.isRunning = false;
+	async generateServerSubscribersFile(outputDir, subscribers) {
+		await mkdir(outputDir, { recursive: true });
+		const subscribersPath = join(outputDir, "subscribers.ts");
+		if (subscribers.length === 0) {
+			await writeFile(subscribersPath, `/**
+ * Generated subscribers setup — this app declares none.
+ */
+import type { EnvironmentParser } from '@geekmidas/envkit';
+import type { Logger } from '@geekmidas/logger';
+
+export async function setupSubscribers(
+  _envParser: EnvironmentParser<any>,
+  _logger: Logger,
+): Promise<void> {}
+`);
+			return subscribersPath;
 		}
-	}
-};
-/**
-* Generate the content of the dev server entry file (server.ts).
-* Uses dynamic import for createApp so Credentials are populated
-* before any app modules evaluate.
-* @internal Exported for testing
-*/
-function generateServerEntryContent(options) {
-	const { secretsJsonPath, runtime = "node", enableOpenApi = false, appImportPath = "./app.js" } = options;
-	return `#!/usr/bin/env node
-/**
- * Development server entry point
- * This file is auto-generated by 'gkm dev'
+		const importsByFile = /* @__PURE__ */ new Map();
+		for (const { path, key } of subscribers) {
+			const importPath = relative(dirname(subscribersPath), path.relative).replace(/\.ts$/, ".js");
+			if (!importsByFile.has(importPath)) importsByFile.set(importPath, []);
+			importsByFile.get(importPath)?.push(key);
+		}
+		const content = `/**
+ * Generated subscribers setup
+ *
+ * ⚠️  WARNING: This is for LOCAL DEVELOPMENT ONLY
+ * This uses event polling which is not suitable for production.
+ *
+ * For production, use AWS Lambda with SQS/SNS event source mappings.
+ * Lambda automatically:
+ * - Scales based on queue depth
+ * - Handles batch processing and retries
+ * - Manages dead letter queues
+ * - Provides better cost optimization
+ *
+ * This polling implementation is useful for:
+ * - Local development and testing
+ * - Understanding event flow without Lambda deployment
+ *
+ * Supported connection strings:
+ * - sqs://region/account-id/queue-name (SQS queue)
+ * - sns://region/account-id/topic-name (SNS topic)
+ * - rabbitmq://host:port/queue-name (RabbitMQ)
+ * - pgboss://user:pass@host:port/database (pg-boss / PostgreSQL)
+ * - basic://in-memory (In-memory for testing)
  */
-${secretsJsonPath ? `import { existsSync, readFileSync } from 'node:fs';
+import type { EnvironmentParser } from '@geekmidas/envkit';
+import type { Logger } from '@geekmidas/logger';
+import { EventConnectionFactory, Subscriber } from '@geekmidas/events';
+import type { EventConnection, EventSubscriber } from '@geekmidas/events';
+import { ServiceDiscovery } from '@geekmidas/services';
+${Array.from(importsByFile.entries()).map(([importPath, exports]) => `import { ${exports.join(", ")} } from '${importPath}';`).join("\n")}
 
-// Inject dev secrets via globalThis (must happen before app import)
-const secretsPath = '${secretsJsonPath}';
-if (existsSync(secretsPath)) {
-  const __secrets = JSON.parse(readFileSync(secretsPath, 'utf-8'));
-  globalThis.__gkm_credentials__ = __secrets;
-  Object.assign(process.env, __secrets);
-}
+const subscribers = [
+  ${subscribers.map(({ key }) => key).join(",\n  ")}
+];
 
-` : ""}
-const port = process.argv.includes('--port')
-  ? Number.parseInt(process.argv[process.argv.indexOf('--port') + 1])
-  : 3000;
+const activeSubscribers: EventSubscriber<any>[] = [];
 
-// Dynamic import so Credentials are populated before env.ts evaluates
-const { createApp } = await import('${appImportPath}');
+export async function setupSubscribers(
+  envParser: EnvironmentParser<any>,
+  logger: Logger,
+): Promise<void> {
+  if (subscribers.length === 0) {
+    return;
+  }
 
-// createApp is async to support optional WebSocket setup
-const { app, start } = await createApp(undefined, ${enableOpenApi});
+  logger.info('Setting up subscribers in polling mode (local development)');
 
-// Start the server
-start({
-  port,
-  serve: async (app, port) => {
-    ${runtime === "bun" ? `Bun.serve({
-      port,
-      fetch: app.fetch,
-    });` : `const { serve } = await import('@hono/node-server');
-    const server = serve({
-      fetch: app.fetch,
-      port,
-    });
-    // Inject WebSocket support if available
-    const injectWs = (app as any).__injectWebSocket;
-    if (injectWs) {
-      injectWs(server);
-      console.log('🔌 Telescope real-time updates enabled');
-    }`}
-  },
-}).catch((error) => {
-  console.error('Failed to start server:', error);
-  process.exit(1);
-});
-`;
+  const config = envParser.create((get) => ({
+    connectionString: get('EVENT_SUBSCRIBER_CONNECTION_STRING').string(),
+  })).parse();
+
+  const serviceDiscovery = ServiceDiscovery.getInstance(envParser);
+
+  // Create connection once, outside the loop (more efficient)
+  // EventConnectionFactory automatically determines the right connection type
+  let connection: EventConnection;
+  try {
+    connection = await EventConnectionFactory.fromConnectionString(config.connectionString);
+
+    const connectionType = new URL(config.connectionString).protocol.replace(':', '');
+    logger.info({ connectionType }, 'Created shared event connection');
+  } catch (error) {
+    logger.error({ error }, 'Failed to create event connection');
+    return;
+  }
+
+  for (const subscriber of subscribers) {
+    try {
+      // Create subscriber from shared connection
+      const eventSubscriber = await Subscriber.fromConnection(connection);
+
+      // Register services
+      const services = subscriber.services.length > 0
+        ? await serviceDiscovery.register(subscriber.services)
+        : {};
+
+      // Subscribe to events
+      const subscribedEvents = subscriber.subscribedEvents || [];
+
+      if (subscribedEvents.length === 0) {
+        logger.warn({ subscriber: subscriber.constructor.name }, 'Subscriber has no subscribed events, skipping');
+        continue;
+      }
+
+      await eventSubscriber.subscribe(subscribedEvents, async (event) => {
+        try {
+          // Process single event (batch of 1)
+          await subscriber.handler({
+            events: [event],
+            services: services as any,
+            logger: subscriber.logger,
+          });
+
+          logger.debug({ eventType: event.type }, 'Successfully processed event');
+        } catch (error) {
+          logger.error({ error, event }, 'Failed to process event');
+          // Event will become visible again for retry
+        }
+      });
+
+      activeSubscribers.push(eventSubscriber);
+
+      logger.info(
+        {
+          events: subscribedEvents,
+        },
+        'Subscriber started polling'
+      );
+    } catch (error) {
+      logger.error({ error, subscriber: subscriber.constructor.name }, 'Failed to setup subscriber');
+    }
+  }
+
+  // Setup graceful shutdown
+  const shutdown = () => {
+    logger.info('Stopping all subscribers');
+    for (const eventSubscriber of activeSubscribers) {
+      connection.stop();
+    }
+  };
+
+  process.on('SIGTERM', shutdown);
+  process.on('SIGINT', shutdown);
 }
-var DevServer = class {
-	provider;
-	requestedPort;
-	portExplicit;
-	enableOpenApi;
-	telescope;
-	studio;
-	runtime;
-	appRoot;
-	secretsJsonPath;
-	serverProcess = null;
-	isRunning = false;
-	actualPort;
-	startTime = Date.now();
-	constructor(provider, requestedPort, portExplicit, enableOpenApi, telescope, studio, runtime = "node", appRoot = process.cwd(), secretsJsonPath) {
-		this.provider = provider;
-		this.requestedPort = requestedPort;
-		this.portExplicit = portExplicit;
-		this.enableOpenApi = enableOpenApi;
-		this.telescope = telescope;
-		this.studio = studio;
-		this.runtime = runtime;
-		this.appRoot = appRoot;
-		this.secretsJsonPath = secretsJsonPath;
-		this.actualPort = requestedPort;
-	}
-	async start() {
-		this.startTime = Date.now();
-		if (this.isRunning) await this.stop();
-		if (this.portExplicit) {
-			if (!await isPortAvailable(this.requestedPort)) throw new Error(`Port ${this.requestedPort} is already in use. Either stop the process using that port or omit -p/--port to auto-select an available port.`);
-			this.actualPort = this.requestedPort;
-		} else {
-			this.actualPort = await findAvailablePort(this.requestedPort);
-			if (this.actualPort !== this.requestedPort) logger$11.log(`ℹ️  Port ${this.requestedPort} was in use, using port ${this.actualPort} instead`);
-		}
-		const serverEntryPath = join(this.appRoot, ".gkm", this.provider, "server.ts");
-		await this.createServerEntry();
-		logger$11.log(`\n⏳ Starting server...`);
-		this.serverProcess = spawn("npx", [
-			"tsx",
-			serverEntryPath,
-			"--port",
-			this.actualPort.toString()
-		], {
-			stdio: "inherit",
-			env: {
-				...process.env,
-				NODE_ENV: "development"
-			},
-			detached: true
-		});
-		this.isRunning = true;
-		this.serverProcess.on("error", (error) => {
-			logger$11.error("❌ Server error:", error);
-		});
-		this.serverProcess.on("exit", (code, signal) => {
-			if (code !== null && code !== 0 && signal !== "SIGTERM") logger$11.error(`❌ Server exited with code ${code}`);
-			this.isRunning = false;
-		});
-		await new Promise((resolve) => setTimeout(resolve, 1e3));
-		if (this.isRunning) {
-			const base = `http://localhost:${this.actualPort}`;
-			const lines = [`  Local:     ${base}`];
-			if (this.enableOpenApi) lines.push(`  API Docs:  ${base}/__docs`);
-			if (this.telescope) lines.push(`  Telescope: ${base}${this.telescope.path}`);
-			if (this.studio) lines.push(`  Studio:    ${base}${this.studio.path}`);
-			const maxLen = Math.max(...lines.map((l) => l.length));
-			const pad = (s) => s.padEnd(maxLen);
-			const border = "─".repeat(maxLen + 2);
-			logger$11.log("");
-			logger$11.log(`  \x1b[32m✓ Ready\x1b[0m in ${((Date.now() - this.startTime) / 1e3).toFixed(1)}s`);
-			logger$11.log("");
-			logger$11.log(`  ┌${border}┐`);
-			for (const line of lines) logger$11.log(`  │ ${pad(line)} │`);
-			logger$11.log(`  └${border}┘`);
-			logger$11.log("");
-		}
-	}
-	async stop() {
-		const port = this.actualPort;
-		if (this.serverProcess && this.isRunning) {
-			const pid = this.serverProcess.pid;
-			if (pid) try {
-				process.kill(-pid, "SIGKILL");
-			} catch {
-				try {
-					process.kill(pid, "SIGKILL");
-				} catch {}
-			}
-			this.serverProcess = null;
-			this.isRunning = false;
-		}
-		this.killProcessesOnPort(port);
-	}
-	killProcessesOnPort(port) {
-		try {
-			execSync(`lsof -ti tcp:${port} | xargs kill -9 2>/dev/null || true`, { stdio: "ignore" });
-		} catch {}
+`;
+		await writeFile(subscribersPath, content);
+		return subscribersPath;
 	}
-	async restart() {
-		const portToReuse = this.actualPort;
-		await this.stop();
-		let attempts = 0;
-		while (attempts < 30) {
-			if (await isPortAvailable(portToReuse)) break;
-			await new Promise((resolve) => setTimeout(resolve, 100));
-			attempts++;
-		}
-		this.requestedPort = portToReuse;
-		await this.start();
+};
+//#endregion
+//#region src/generators/TopicGenerator.ts
+/**
+* Discovers `t` topics into `manifest.topics`. A topic is a *resource*, not a
+* function — it has no handler to generate. Producers reach it via its derived
+* publisher (`topic.publisher`, whose connection string is sniffed onto the
+* producing construct) and subscribers bind via `s.topic(topic)`; this generator
+* only records the topic + its event contract so infra can provision the SNS
+* topic. Identical output for every provider (locally pg-boss routes by event
+* name, so there's nothing to run).
+*/
+var TopicGenerator = class extends ConstructGenerator {
+	isConstruct(value) {
+		return Topic.isTopic(value);
 	}
-	async createServerEntry() {
-		const { writeFile: fsWriteFile } = await import("node:fs/promises");
-		await fsWriteFile(join(this.appRoot, ".gkm", this.provider, "server.ts"), generateServerEntryContent({
-			secretsJsonPath: this.secretsJsonPath,
-			runtime: this.runtime,
-			enableOpenApi: this.enableOpenApi
+	async build(_context, constructs, _outputDir, _options) {
+		const logger = console;
+		const topicInfos = constructs.map(({ construct }) => ({
+			name: construct.name,
+			events: construct.eventTypes
 		}));
+		for (const topic of topicInfos) logger.log(`Discovered topic: ${topic.name}`);
+		return topicInfos;
 	}
 };
 //#endregion
@@ -2457,6 +2446,76 @@ function mapTopicMetadata(topics) {
 	for (const [partition, partitionTopics] of Object.entries(topics)) result[partition] = partitionTopics.map(mapFn);
 	return result;
 }
+//#endregion
+//#region src/build/owners.ts
+/**
+* What a generated entry imports its runtime from, read off the discovered
+* constructs: the surface it serves, every construct a runnable can be built
+* from, and the database Studio browses.
+*
+* `gkm build` and `gkm dev` both write entries that import the surface for its
+* logger and environment parser, so both ask here. A dev server that skipped it
+* had nothing to import them from.
+*/
+function ownersContext(options) {
+	const { declared, sources, workspaceRoot, appRoot, studio } = options;
+	const surfaces = restApis(declared);
+	const primary = servedSurface(declared, workspaceRoot, appRoot) ?? surfaces.find((d) => d.endpoints.length === 0) ?? surfaces[0];
+	const browsable = Object.entries(declared).find(([, d]) => d.kind === "database");
+	const browsableSource = browsable ? sources[browsable[0]] : void 0;
+	const owners = {};
+	for (const [id, declaration] of Object.entries(declared)) {
+		if (declaration.kind !== "rest-api" && declaration.kind !== "worker") continue;
+		const source = sources[id];
+		if (!source) continue;
+		owners[id] = {
+			specifier: source.file,
+			exportName: source.exportName
+		};
+	}
+	const primarySource = primary ? sources[primary.id] : void 0;
+	return {
+		owners,
+		...primary ? { surface: {
+			id: primary.id,
+			trustedOriginsKey: provideKey(primary.id, "trustedOrigins"),
+			...primary.cors ? { cors: primary.cors } : {},
+			...primarySource ? { module: {
+				specifier: primarySource.file,
+				exportName: primarySource.exportName
+			} } : {}
+		} } : {},
+		studio: studio && browsableSource ? {
+			...studio,
+			database: {
+				specifier: browsableSource.file,
+				exportName: browsableSource.exportName
+			}
+		} : studio
+	};
+}
+/**
+* The endpoints one surface serves.
+*
+* One glob finds every surface's endpoints, wherever their files live. A build
+* keeps the ones built from the surface it serves; one built from no surface at
+* all has nowhere else to go.
+*/
+function servedBy(endpoints, surface) {
+	if (!surface) return endpoints;
+	return endpoints.filter(({ construct }) => !construct.surface || construct.surface.id === surface.id);
+}
+function restApis(declared) {
+	return Object.values(declared).filter((d) => d.kind === "rest-api");
+}
+/**
+* The surface whose declared `path` is the directory being built — asked of
+* every surface, because a workspace has several and each app's build serves
+* exactly one.
+*/
+function servedSurface(declared, workspaceRoot, appRoot) {
+	return restApis(declared).find((d) => resolve(workspaceRoot, d.path) === resolve(appRoot));
+}
 /**
 * Check if any construct across the given arrays has a non-undefined partition.
 * When true, the manifest should use the partitioned shape for that construct type.
@@ -2479,7 +2538,29 @@ function groupInfosByPartition(infos, constructs) {
 	return groups;
 }
 //#endregion
-//#region src/build/index.ts
+//#region src/build/surfaceEntry.ts
+/** Whether a construct serves itself, asked of the construct. */
+function servesItself(construct) {
+	return typeof construct?.server === "function";
+}
+/**
+* The surface this app serves, when that surface serves itself.
+*
+* An auth server's routes are a wildcard the construct mounts, so a glob finds
+* nothing and the entry only has to start it. That used to be inferred —
+* "nothing found, and the surface declares routes" — which is a guess about
+* the construct from the outside. The construct can simply be asked.
+*/
+function selfServingSurface(options) {
+	const { declared, sources, workspaceRoot, appRoot } = options;
+	const served = servedSurface(declared, workspaceRoot, appRoot);
+	const source = served ? sources[served.id] : void 0;
+	if (!served || !source || !servesItself(source.construct)) return void 0;
+	return {
+		id: served.id,
+		source
+	};
+}
 /**
 * The entry for a surface that serves itself.
 *
@@ -2513,6 +2594,8 @@ export const { app } = await surface.server({ envParser, context: snifferContext
 export default app;
 `);
 }
+//#endregion
+//#region src/build/index.ts
 const logger$9 = console;
 /**
 * What a build run at the workspace root reads.
@@ -2556,18 +2639,56 @@ async function buildCommand(options) {
 	if (studio) logger$9.log(`🗄️  Studio enabled at ${studio.path}`);
 	const hooks = normalizeHooksConfig(config.hooks);
 	if (hooks) logger$9.log(`🪝 Server hooks enabled`);
+	return buildApp({
+		config,
+		workspaceRoot: loadedConfig.workspace.root,
+		appRoot: process.cwd(),
+		providers: resolved.providers,
+		enableOpenApi: resolved.enableOpenApi,
+		cacheBackend,
+		production,
+		telescope,
+		studio,
+		hooks,
+		markOptional: options.markOptional ?? false,
+		skipBundle: options.skipBundle ?? false,
+		stage: options.stage
+	});
+}
+/**
+* Turn one app's constructs into its generated entry.
+*
+* `gkm build` and `gkm dev` both run this. They used to be two copies of it,
+* and every time the build learned something about constructs — that the
+* entry takes its logger from the surface, that an auth server serves itself —
+* dev did not, and failed on exactly the apps the build had learned to handle.
+*/
+async function buildApp(input) {
+	const { config, workspaceRoot, appRoot, providers, enableOpenApi, cacheBackend, production, telescope, studio, hooks, bustCache = false } = input;
 	const constructGlobs = typeof config.constructs === "string" || Array.isArray(config.constructs) ? config.constructs : void 0;
 	const constructSources = {};
 	const declared = constructGlobs ? await discover({
 		patterns: constructGlobs,
-		cwd: process.cwd(),
+		cwd: appRoot,
+		bustCache,
 		sources: constructSources
 	}) : {};
+	const selfServing = selfServingSurface({
+		declared,
+		sources: constructSources,
+		workspaceRoot,
+		appRoot
+	});
+	if (selfServing) {
+		await writeSurfaceEntry(join(appRoot, ".gkm", "server"), selfServing.source);
+		logger$9.log(`Generated a server for ${selfServing.id} from its own declaration`);
+		return { selfServing: selfServing.id };
+	}
 	const derived = ownersContext({
 		declared,
 		sources: constructSources,
-		workspaceRoot: loadedConfig.workspace.root,
-		appRoot: process.cwd(),
+		workspaceRoot,
+		appRoot,
 		studio
 	});
 	const buildContext = {
@@ -2579,10 +2700,10 @@ async function buildCommand(options) {
 		cacheBackend,
 		emailBackend: "ses",
 		storageDrivers: driversFor({
-			appRoot: process.cwd(),
+			appRoot,
 			cache: cacheBackendsIn(declared, cacheBackend)
 		}),
-		markOptional: options.markOptional ?? false
+		markOptional: input.markOptional ?? false
 	};
 	const endpointGenerator = new EndpointGenerator();
 	const functionGenerator = new FunctionGenerator();
@@ -2592,12 +2713,12 @@ async function buildCommand(options) {
 	const topicGenerator = new TopicGenerator();
 	const code = constructGlobs;
 	const [loadedEndpoints, allFunctions, allCrons, allSubscribers, allQueues, allTopics] = await Promise.all([
-		endpointGenerator.load(code),
-		functionGenerator.load(code),
-		cronGenerator.load(code),
-		subscriberGenerator.load(code),
-		queueGenerator.load(code),
-		topicGenerator.load(code)
+		endpointGenerator.load(code, appRoot, bustCache),
+		functionGenerator.load(code, appRoot, bustCache),
+		cronGenerator.load(code, appRoot, bustCache),
+		subscriberGenerator.load(code, appRoot, bustCache),
+		queueGenerator.load(code, appRoot, bustCache),
+		topicGenerator.load(code, appRoot, bustCache)
 	]);
 	const allEndpoints = servedBy(loadedEndpoints, derived.surface);
 	logger$9.log(`Found ${allEndpoints.length} endpoints`);
@@ -2606,30 +2727,23 @@ async function buildCommand(options) {
 	logger$9.log(`Found ${allSubscribers.length} subscribers`);
 	logger$9.log(`Found ${allQueues.length} queues`);
 	logger$9.log(`Found ${allTopics.length} topics`);
-	if (allEndpoints.length === 0 && allFunctions.length === 0 && allCrons.length === 0 && allSubscribers.length === 0 && allQueues.length === 0 && allTopics.length === 0) {
-		const served = servedSurface(declared, loadedConfig.workspace.root, process.cwd());
-		const selfServing = served && served.endpoints.length > 0 && constructSources[served.id] !== void 0 ? [served.id, served] : void 0;
-		if (selfServing) {
-			const [id] = selfServing;
-			await writeSurfaceEntry(join(process.cwd(), ".gkm", "server"), constructSources[id]);
-			logger$9.log(`Generated a server for ${id} from its own declaration`);
-			return {};
-		}
+	if (!input.serveEmpty && allEndpoints.length === 0 && allFunctions.length === 0 && allCrons.length === 0 && allSubscribers.length === 0 && allQueues.length === 0 && allTopics.length === 0) {
 		logger$9.log("No endpoints, functions, crons, subscribers, queues, or topics found to process");
 		return {};
 	}
-	const rootOutputDir = join(process.cwd(), ".gkm");
+	const rootOutputDir = join(appRoot, ".gkm");
 	await mkdir(rootOutputDir, { recursive: true });
 	let result = {};
-	for (const provider of resolved.providers) {
-		const providerResult = await buildForProvider(provider, buildContext, rootOutputDir, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, queueGenerator, topicGenerator, allEndpoints, allFunctions, allCrons, allSubscribers, allQueues, allTopics, resolved.enableOpenApi, options.skipBundle ?? false, options.stage);
+	for (const provider of providers) {
+		const providerResult = await buildForProvider(provider, buildContext, appRoot, declared, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, queueGenerator, topicGenerator, allEndpoints, allFunctions, allCrons, allSubscribers, allQueues, allTopics, enableOpenApi, input.skipBundle ?? false, input.stage);
 		if (providerResult.masterKey) result = providerResult;
 	}
 	await generateOpenApi(allEndpoints.map(({ construct }) => construct), { openapi: config.openapi });
 	return result;
 }
-async function buildForProvider(provider, context, rootOutputDir, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, queueGenerator, topicGenerator, endpoints, functions, crons, subscribers, queues, topics, enableOpenApi, skipBundle, stage) {
-	const outputDir = join(process.cwd(), ".gkm", provider);
+async function buildForProvider(provider, context, appRoot, discovered, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, queueGenerator, topicGenerator, endpoints, functions, crons, subscribers, queues, topics, enableOpenApi, skipBundle, stage) {
+	const rootOutputDir = join(appRoot, ".gkm");
+	const outputDir = join(rootOutputDir, provider);
 	await mkdir(outputDir, { recursive: true });
 	logger$9.log(`\nGenerating handlers for provider: ${provider}`);
 	const [routes, functionInfos, cronInfos, subscriberInfos, queueInfos, topicInfos] = await Promise.all([
@@ -2645,10 +2759,6 @@ async function buildForProvider(provider, context, rootOutputDir, endpointGenera
 	]);
 	logger$9.log(`Generated ${routes.length} routes, ${functionInfos.length} functions, ${cronInfos.length} crons, ${subscriberInfos.length} subscribers, ${queueInfos.length} queues, ${topicInfos.length} topics for ${provider}`);
 	const manifestRoutes = assembleManifestField(routes, endpoints);
-	const discovered = context.constructGlobs ? await discover({
-		patterns: context.constructGlobs,
-		cwd: process.cwd()
-	}) : {};
 	const manifestFunctions = assembleManifestField(functionInfos, functions);
 	const manifestCrons = assembleManifestField(cronInfos, crons);
 	const manifestQueues = assembleManifestField(queueInfos, queues);
@@ -2662,8 +2772,8 @@ async function buildForProvider(provider, context, rootOutputDir, endpointGenera
 			authorizer: construct.authorizer?.name ?? "none"
 		}))), endpoints);
 		await generateServerManifest(rootOutputDir, {
-			handler: relative(process.cwd(), join(outputDir, "app.ts")),
-			endpoints: relative(process.cwd(), join(outputDir, "endpoints.ts"))
+			handler: relative(appRoot, join(outputDir, "app.ts")),
+			endpoints: relative(appRoot, join(outputDir, "endpoints.ts"))
 		}, serverRouteField, manifestSubscribers, manifestQueues, manifestTopics);
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
@@ -2742,14 +2852,9 @@ function getTurboCommand(pm, filters = []) {
 function turboFilters(workspace) {
 	const filters = [];
 	const unpackaged = [];
-	for (const [appName, app] of Object.entries(workspace.apps)) {
-		const pkgPath = join(workspace.root, app.path, "package.json");
-		if (!existsSync(pkgPath)) {
-			unpackaged.push(appName);
-			continue;
-		}
-		const name = JSON.parse(readFileSync(pkgPath, "utf8")).name;
-		if (typeof name === "string" && name.length > 0) filters.push(name);
+	for (const appName of Object.keys(workspace.apps)) {
+		const name = appPackageName(workspace, appName);
+		if (name) filters.push(name);
 		else unpackaged.push(appName);
 	}
 	return {
@@ -2758,6 +2863,20 @@ function turboFilters(workspace) {
 	};
 }
 /**
+* The package name turbo knows an app by, from its own `package.json`.
+*
+* Not the app's key: `api` in the workspace is `@shop/api` to turbo, and a
+* filter naming the key matches nothing.
+*/
+function appPackageName(workspace, appName) {
+	const app = workspace.apps[appName];
+	if (!app) return void 0;
+	const pkgPath = join(workspace.root, app.path, "package.json");
+	if (!existsSync(pkgPath)) return void 0;
+	const name = JSON.parse(readFileSync(pkgPath, "utf8")).name;
+	return typeof name === "string" && name.length > 0 ? name : void 0;
+}
+/**
 * Build all apps in a workspace using Turbo for dependency-ordered parallel builds.
 * @internal Exported for testing
 */
@@ -8467,26 +8586,26 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.24",
-	"@geekmidas/auth": "~10.0.0-alpha.24",
-	"@geekmidas/cache": "~10.0.0-alpha.24",
-	"@geekmidas/client": "~10.0.0-alpha.24",
-	"@geekmidas/cloud": "~10.0.0-alpha.24",
-	"@geekmidas/constructs": "~10.0.0-alpha.24",
-	"@geekmidas/db": "~10.0.0-alpha.24",
-	"@geekmidas/emailkit": "~10.0.0-alpha.24",
-	"@geekmidas/envkit": "~10.0.0-alpha.24",
-	"@geekmidas/errors": "~10.0.0-alpha.24",
-	"@geekmidas/events": "~10.0.0-alpha.24",
-	"@geekmidas/logger": "~10.0.0-alpha.24",
-	"@geekmidas/manifest": "~10.0.0-alpha.24",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.24",
-	"@geekmidas/schema": "~10.0.0-alpha.24",
-	"@geekmidas/services": "~10.0.0-alpha.24",
-	"@geekmidas/storage": "~10.0.0-alpha.24",
-	"@geekmidas/studio": "~10.0.0-alpha.24",
-	"@geekmidas/telescope": "~10.0.0-alpha.24",
-	"@geekmidas/testkit": "~10.0.0-alpha.24",
+	"@geekmidas/audit": "~10.0.0-alpha.26",
+	"@geekmidas/auth": "~10.0.0-alpha.26",
+	"@geekmidas/cache": "~10.0.0-alpha.26",
+	"@geekmidas/client": "~10.0.0-alpha.26",
+	"@geekmidas/cloud": "~10.0.0-alpha.26",
+	"@geekmidas/constructs": "~10.0.0-alpha.26",
+	"@geekmidas/db": "~10.0.0-alpha.26",
+	"@geekmidas/emailkit": "~10.0.0-alpha.26",
+	"@geekmidas/envkit": "~10.0.0-alpha.26",
+	"@geekmidas/errors": "~10.0.0-alpha.26",
+	"@geekmidas/events": "~10.0.0-alpha.26",
+	"@geekmidas/logger": "~10.0.0-alpha.26",
+	"@geekmidas/manifest": "~10.0.0-alpha.26",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.26",
+	"@geekmidas/schema": "~10.0.0-alpha.26",
+	"@geekmidas/services": "~10.0.0-alpha.26",
+	"@geekmidas/storage": "~10.0.0-alpha.26",
+	"@geekmidas/studio": "~10.0.0-alpha.26",
+	"@geekmidas/telescope": "~10.0.0-alpha.26",
+	"@geekmidas/testkit": "~10.0.0-alpha.26",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -15907,7 +16026,7 @@ program.command("dev").description("Reconcile constructs and start the dev serve
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		await devCommand({
-			port: options.port ? Number.parseInt(options.port, 10) : 3e3,
+			port: options.port ? Number.parseInt(options.port, 10) : void 0,
 			portExplicit: !!options.port,
 			enableOpenApi: options.enableOpenapi ?? true,
 			entry: options.entry,
@@ -16060,7 +16179,7 @@ program.command("secrets:push").description("Send a deployed stage's secrets to
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
-		const { pushStageSecrets } = await import("./transfer-Bk5YlRyB.mjs").then((n) => n.i);
+		const { pushStageSecrets } = await import("./transfer-CAJs_vhu.mjs").then((n) => n.i);
 		const { workspace } = await loadWorkspaceConfig();
 		const { addedKeys } = await pushStageSecrets(workspace, options.stage, { profile: options.profile });
 		for (const key of addedKeys) console.log(`  + ${key} (reconciled)`);
@@ -16075,7 +16194,7 @@ program.command("secrets:pull").description("Bring a deployed stage's secrets fr
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
-		const { pullStageSecrets } = await import("./transfer-Bk5YlRyB.mjs").then((n) => n.i);
+		const { pullStageSecrets } = await import("./transfer-CAJs_vhu.mjs").then((n) => n.i);
 		const { workspace } = await loadWorkspaceConfig();
 		const { addedKeys } = await pullStageSecrets(workspace, options.stage, { profile: options.profile });
 		for (const key of addedKeys) console.log(`  + ${key} (reconciled)`);
@@ -16099,7 +16218,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./credentials-D9TKJJZc.mjs").then((n) => n.g);
+		const { derivedContainers } = await import("./credentials-DI9kJcaP.mjs").then((n) => n.g);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -16158,7 +16277,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await import("./github-B4OQQZBV.mjs");
+		const { deployGithubCommand } = await import("./github-D5SBlOx5.mjs");
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));