@geekmidas/cli 10.0.0-alpha.39 → 10.0.0-alpha.40

package/dist/index.mjs

@@ -5,10 +5,10 @@ import { d as parseModuleConfig, f as appKey, l as loadWorkspaceConfig, n as Not
 import { D as assertDeployedStage, E as TEST_STAGE, O as deployedProblems, T as InvalidStages, a as getAppBuildOrder, b as getDeployTargetError, k as stageProblems, m as stripPublicPrefix, o as getAppGkmConfig, p as getPublicEnvPrefix, t as allConstructGlobs, x as isDeployTargetSupported } from "./workspace-DOmIhiau.mjs";
 import { a as withCustomSecret, i as toEmbeddableSecrets, n as maskPassword, t as initStageSecrets } from "./storage-BzaUxmqe.mjs";
 import { a as getKeyPath, i as FileSecretsStore, n as secretsStoreFor } from "./store-DeGATCS-.mjs";
-import { C as findAvailablePort, D as prepareEntryCredentials, E as loadSecretsForApp, S as createEntryWrapper, T as loadEnvFiles, _ as cacheBackendFor, a as reconcileWorkspace, b as storageBackendFor, c as LOCAL_CA_PATH, d as quoteIdentifier, f as pgClient, g as primaryPortKey, h as fakeKey, i as derivedContainers, l as forgetState, m as rootSite, n as backendsOf, p as resourceName, r as constructGlobs, s as COMPOSE_PATH, t as FAKE_ENV, u as applyPostgres, v as eventsBackendFor, w as isPortAvailable, x as createCredentialsPreload, y as providerOf } from "./workspace-CrFbItPz.mjs";
-import { n as EndpointGenerator, r as runtimeFor } from "./OpenApiTsGenerator-DQqOuSW8.mjs";
+import { C as findAvailablePort, D as prepareEntryCredentials, E as loadSecretsForApp, S as createEntryWrapper, T as loadEnvFiles, _ as cacheBackendFor, a as reconcileWorkspace, b as storageBackendFor, c as LOCAL_CA_PATH, d as quoteIdentifier, f as pgClient, g as primaryPortKey, h as fakeKey, i as derivedContainers, l as forgetState, m as rootSite, n as backendsOf, p as resourceName, r as constructGlobs, s as COMPOSE_PATH, t as FAKE_ENV, u as applyPostgres, v as eventsBackendFor, w as isPortAvailable, x as createCredentialsPreload, y as providerOf } from "./workspace-DwS1JK5u.mjs";
+import { n as EndpointGenerator, r as runtimeFor } from "./OpenApiTsGenerator-CEh3EKN3.mjs";
 import { generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi.mjs";
-import { a as writeTestHarness, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, o as cacheBackendsIn, s as driversFor, t as TEST_READY_ENV } from "./ready-BXmLS4VB.mjs";
+import { a as writeTestHarness, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, o as cacheBackendsIn, s as driversFor, t as TEST_READY_ENV } from "./ready-D8UXsP6q.mjs";
 import { i as withRoutes, r as withCompute } from "./emit-Bzq7JsMP.mjs";
 import { createRequire } from "node:module";
 import { Command } from "commander";
@@ -41,7 +41,7 @@ import { Subscriber } from "@geekmidas/constructs/subscribers";
 import { Topic } from "@geekmidas/constructs/topic";
 import { lookup } from "node:dns/promises";
 //#region package.json
-var version = "10.0.0-alpha.39";
+var version = "10.0.0-alpha.40";
 //#endregion
 //#region src/auth/credentials.ts
 /**
@@ -1208,7 +1208,10 @@ function getProductionConfigFromGkm(config) {
 	const serverConfig = config.providers?.server;
 	if (typeof serverConfig === "object") return serverConfig.production;
 }
+/** Read by the generated server: no subscriber is subscribed or polled. */
+const SUBSCRIBERS_ENV = "GKM_SUBSCRIBERS";
 async function devCommand(options) {
+	if (options.subscribers === false) process.env[SUBSCRIBERS_ENV] = "off";
 	if (options.entry) return entryDevCommand(options);
 	const defaultEnv = loadEnvFiles(".env");
 	if (defaultEnv.loaded.length > 0) logger$10.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
@@ -1563,9 +1566,9 @@ async function workspaceDevCommand(workspace, options) {
 	const fakes = options.fake ? await serveFakes(reconciled.fakes, reconciled.ports) : [];
 	for (const { id, port } of fakes) logger$10.log(`🎭 ${id} fake: http://localhost:${port}`);
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await import("./migrate-BJR912RE.mjs");
+		const { prepareDevDatabases } = await import("./migrate-BVI3yqcE.mjs");
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await import("./migrate-BJR912RE.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await import("./migrate-BVI3yqcE.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$10.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -2210,7 +2213,7 @@ export async function setupCrons(
   // runtime role, which can neither create a schema nor use the broker's.
   const { url } = envParser
     .create((get) => ({
-      url: get('EVENT_SUBSCRIBER_CONNECTION_STRING').string().optional(),
+      url: get('EVENT_PUBLISHER_CONNECTION_STRING').string().optional(),
     }))
     .parse();
 
@@ -2219,7 +2222,7 @@ export async function setupCrons(
       { crons: prepared.map(({ name }) => name) },
       'These crons have nowhere to keep their schedule. On a server they are ' +
         'scheduled through the pg-boss events broker ' +
-        '(EVENT_SUBSCRIBER_CONNECTION_STRING), and ' +
+        '(EVENT_PUBLISHER_CONNECTION_STRING), and ' +
         (url ? 'the broker configured is not pg-boss.' : 'none is configured.'),
     );
     return;
@@ -2332,11 +2335,11 @@ export const handler = adapter.handler;
 //#endregion
 //#region src/generators/QueueGenerator.ts
 /**
-* Generates the runtime for `q` queue workers.
+* Generates the runtime for queue consumers (`worker.queue(…)`).
 *
 * - **server** (`gkm dev`): a single `queues.ts` exposing `setupQueues()` that
-*   runs an in-process pg-boss poller alongside the Hono server — no SQS/Lambda.
-*   Each queue subscribes by its **name** on the shared event connection.
+*   polls each queue in-process, alongside the Hono server, through the queue's
+*   own connection string — pg-boss by default, SQS on the AWS emulator.
 * - **aws-lambda**: one handler file per queue wrapping `AWSLambdaQueue`, backed
 *   by an SQS event-source mapping.
 */
@@ -2411,64 +2414,52 @@ export async function setupQueues(
 			importsByFile.get(importPath)?.push(key);
 		}
 		const content = `/**
- * Generated queue workers setup
+ * Generated queue consumers setup.
  *
- * ⚠️  WARNING: This is for LOCAL DEVELOPMENT ONLY
- * This runs an in-process pg-boss poller alongside the HTTP server. Each queue
- * subscribes by its name on the shared event connection
- * (EVENT_SUBSCRIBER_CONNECTION_STRING), so producers using
- * <NAME>_PUBLISHER_CONNECTION_STRING (pgboss:// locally) reach it.
+ * Each queue's one consumer polls its own queue, through the queue's own
+ * connection string — the one its producers publish on. SQS cannot push, so
+ * this is a poller on every transport: pg-boss locally by default, the SQS
+ * queue on the AWS emulator.
  *
- * For production, queues run as AWS Lambda with SQS event-source mappings.
+ * Deployed on Lambda, a queue's consumer is an SQS event source instead.
  */
 import type { EnvironmentParser } from '@geekmidas/envkit';
 import type { Logger } from '@geekmidas/logger';
 import { EventConnectionFactory, Subscriber } from '@geekmidas/events';
-import type { EventConnection, EventSubscriber } from '@geekmidas/events';
+import type { EventConnection } from '@geekmidas/events';
 import { ServiceDiscovery } from '@geekmidas/services';
 ${Array.from(importsByFile.entries()).map(([importPath, exports]) => `import { ${exports.join(", ")} } from '${importPath}';`).join("\n")}
 
 const queues = [
-  ${queues.map(({ key }) => key).join(",\n  ")}
+${queues.map(({ key, construct }) => `  { queue: ${key}, connectionKey: '${provideKey(construct.id, "publisherConnectionString")}' },`).join("\n")}
 ];
 
-const activeSubscribers: EventSubscriber<any>[] = [];
-
 export async function setupQueues(
   envParser: EnvironmentParser<any>,
   logger: Logger,
 ): Promise<void> {
-  if (queues.length === 0) {
-    return;
-  }
-
-  logger.info('Setting up queue workers in polling mode (local development)');
-
-  const config = envParser.create((get) => ({
-    connectionString: get('EVENT_SUBSCRIBER_CONNECTION_STRING').string(),
-  })).parse();
-
   const serviceDiscovery = ServiceDiscovery.getInstance(envParser);
+  const connections = new Map<string, EventConnection>();
 
-  let connection: EventConnection;
-  try {
-    connection = await EventConnectionFactory.fromConnectionString(config.connectionString);
-    const connectionType = new URL(config.connectionString).protocol.replace(':', '');
-    logger.info({ connectionType }, 'Created shared event connection for queues');
-  } catch (error) {
-    logger.error({ error }, 'Failed to create event connection for queues');
-    return;
-  }
+  for (const { queue, connectionKey } of queues) {
+    const connectionString = process.env[connectionKey];
+    if (!connectionString) {
+      logger.error({ queue: queue.name, connectionKey }, 'No connection string for this queue');
+      continue;
+    }
 
-  for (const queue of queues) {
     try {
+      let connection = connections.get(connectionString);
+      if (!connection) {
+        connection = await EventConnectionFactory.fromConnectionString(connectionString);
+        connections.set(connectionString, connection);
+      }
       const eventSubscriber = await Subscriber.fromConnection(connection);
-
       const services = queue.services.length > 0
         ? await serviceDiscovery.register(queue.services)
         : {};
 
-      // A queue subscribes to a single "type" — its own name.
+      // A queue's messages carry one type — its own name.
       await eventSubscriber.subscribe([queue.name], async (message) => {
         try {
           const validation = await queue.messageSchema['~standard'].validate(message.payload);
@@ -2482,30 +2473,23 @@ export async function setupQueues(
             services: services,
             logger: queue.logger,
           });
-
-          logger.debug({ queue: queue.name }, 'Successfully processed queue message');
         } catch (error) {
           logger.error({ error, queue: queue.name }, 'Failed to process queue message');
-          // Message will become visible again for retry.
+          // Rethrown so the transport keeps the message for a retry.
+          throw error;
         }
       });
-
-      activeSubscribers.push(eventSubscriber);
-      logger.info({ queue: queue.name }, 'Queue worker started polling');
+      logger.info({ queue: queue.name }, 'Queue consumer started polling');
     } catch (error) {
-      logger.error({ error, queue: queue.name }, 'Failed to setup queue worker');
+      logger.error({ error, queue: queue.name }, 'Failed to set up queue consumer');
     }
   }
 
   const shutdown = () => {
-    logger.info('Stopping all queue workers');
-    for (const _ of activeSubscribers) {
-      connection.stop();
-    }
+    for (const connection of connections.values()) void connection.close();
   };
-
-  process.on('SIGTERM', shutdown);
-  process.on('SIGINT', shutdown);
+  process.once('SIGTERM', shutdown);
+  process.once('SIGINT', shutdown);
 }
 `;
 		await writeFile(queuesPath, content);
@@ -2578,141 +2562,194 @@ import type { EnvironmentParser } from '@geekmidas/envkit';
 import type { Logger } from '@geekmidas/logger';
 
 export async function setupSubscribers(
+  _app: unknown,
   _envParser: EnvironmentParser<any>,
   _logger: Logger,
-): Promise<void> {}
+): Promise<(port: number) => Promise<void>> {
+  return async () => {};
+}
 `);
 			return subscribersPath;
 		}
 		const importsByFile = /* @__PURE__ */ new Map();
 		for (const { path, key } of subscribers) {
 			const importPath = relative(dirname(subscribersPath), path.relative).replace(/\.ts$/, ".js");
-			if (!importsByFile.has(importPath)) importsByFile.set(importPath, []);
-			importsByFile.get(importPath)?.push(key);
+			importsByFile.set(importPath, [...importsByFile.get(importPath) ?? [], key]);
 		}
 		const content = `/**
- * Generated subscribers setup
+ * Generated subscribers setup.
  *
- * ⚠️  WARNING: This is for LOCAL DEVELOPMENT ONLY
- * This uses event polling which is not suitable for production.
+ * Each subscriber is run against the topic it is bound to, through that
+ * topic's own connection string:
  *
- * For production, use AWS Lambda with SQS/SNS event source mappings.
- * Lambda automatically:
- * - Scales based on queue depth
- * - Handles batch processing and retries
- * - Manages dead letter queues
- * - Provides better cost optimization
+ * - **sns://** — pushed, not polled. The subscriber gets an HTTP route on this
+ *   server, and the route is subscribed to the topic with a filter policy of
+ *   the events it named, so SNS fans out to each subscriber. The route runs the
+ *   subscriber through the same adaptor a Lambda subscription does.
+ * - **anything else** (pgboss://, rabbitmq://, sqs://) — polled. On pg-boss
+ *   each subscriber drains a queue of its own, \`<topic>/<subscriber>\`, so
+ *   every subscriber sees every event; replicas of one subscriber share it.
  *
- * This polling implementation is useful for:
- * - Local development and testing
- * - Understanding event flow without Lambda deployment
- *
- * Supported connection strings:
- * - sqs://region/account-id/queue-name (SQS queue)
- * - sns://region/account-id/topic-name (SNS topic)
- * - rabbitmq://host:port/queue-name (RabbitMQ)
- * - pgboss://user:pass@host:port/database (pg-boss / PostgreSQL)
- * - basic://in-memory (In-memory for testing)
+ * GKM_SUBSCRIBERS=off (\`gkm dev --no-subscribers\`) runs none of them.
+ * GKM_SUBSCRIBER_PUSH_URL is the address SNS pushes to; against the local
+ * emulator it defaults to this server through host.docker.internal.
  */
+import { connect } from 'node:net';
 import type { EnvironmentParser } from '@geekmidas/envkit';
 import type { Logger } from '@geekmidas/logger';
 import { EventConnectionFactory, Subscriber } from '@geekmidas/events';
-import type { EventConnection, EventSubscriber } from '@geekmidas/events';
+import type { EventConnection } from '@geekmidas/events';
 import { ServiceDiscovery } from '@geekmidas/services';
 ${Array.from(importsByFile.entries()).map(([importPath, exports]) => `import { ${exports.join(", ")} } from '${importPath}';`).join("\n")}
 
 const subscribers = [
-  ${subscribers.map(({ key }) => key).join(",\n  ")}
+${subscribers.map(({ key, construct }) => {
+			const connectionKey = construct.topicName ? provideKey(canonicalId(construct.topicName), "publisherConnectionString") : void 0;
+			return `  { id: '${key}', subscriber: ${key}, topic: ${construct.topicName ? `'${construct.topicName}'` : "undefined"}, connectionKey: ${connectionKey ? `'${connectionKey}'` : "undefined"} },`;
+		}).join("\n")}
 ];
 
-const activeSubscribers: EventSubscriber<any>[] = [];
+/** The route a subscriber's pushes arrive on. */
+export const SUBSCRIBER_ROUTE = (id: string) => \`/__gkm/subscribers/\${id}\`;
 
+/** Resolves once something is accepting connections on the port. */
+async function listening(port: number): Promise<void> {
+  for (let attempt = 0; attempt < 100; attempt++) {
+    const open = await new Promise<boolean>((resolve) => {
+      const socket = connect(port, '127.0.0.1');
+      socket.once('connect', () => { socket.end(); resolve(true); });
+      socket.once('error', () => resolve(false));
+    });
+    if (open) return;
+    await new Promise((resolve) => setTimeout(resolve, 50));
+  }
+}
+
+/**
+ * Mount each pushed subscriber's route and start each polled one. Returns what
+ * to run once the server is listening: subscribing a route makes SNS send its
+ * confirmation at once, so the route has to be reachable first.
+ */
 export async function setupSubscribers(
+  app: { post: (path: string, handler: (c: any) => unknown) => unknown },
   envParser: EnvironmentParser<any>,
   logger: Logger,
-): Promise<void> {
-  if (subscribers.length === 0) {
-    return;
+): Promise<(port: number) => Promise<void>> {
+  if (process.env.GKM_SUBSCRIBERS === 'off') {
+    logger.info('Subscribers are off (--no-subscribers)');
+    return async () => {};
   }
 
-  logger.info('Setting up subscribers in polling mode (local development)');
-
-  const config = envParser.create((get) => ({
-    connectionString: get('EVENT_SUBSCRIBER_CONNECTION_STRING').string(),
-  })).parse();
-
   const serviceDiscovery = ServiceDiscovery.getInstance(envParser);
+  const connections = new Map<string, EventConnection>();
+  const afterListening: ((port: number) => Promise<void>)[] = [];
+
+  for (const { id, subscriber, topic, connectionKey } of subscribers) {
+    const events = subscriber.subscribedEvents || [];
+    if (events.length === 0) {
+      logger.warn({ subscriber: id }, 'Subscriber has no subscribed events, skipping');
+      continue;
+    }
+    const connectionString = connectionKey ? process.env[connectionKey] : undefined;
+    if (!connectionString) {
+      logger.error(
+        { subscriber: id, connectionKey },
+        'No connection string for the topic this subscriber is bound to',
+      );
+      continue;
+    }
 
-  // Create connection once, outside the loop (more efficient)
-  // EventConnectionFactory automatically determines the right connection type
-  let connection: EventConnection;
-  try {
-    connection = await EventConnectionFactory.fromConnectionString(config.connectionString);
-
-    const connectionType = new URL(config.connectionString).protocol.replace(':', '');
-    logger.info({ connectionType }, 'Created shared event connection');
-  } catch (error) {
-    logger.error({ error }, 'Failed to create event connection');
-    return;
-  }
-
-  for (const subscriber of subscribers) {
     try {
-      // Create subscriber from shared connection
-      const eventSubscriber = await Subscriber.fromConnection(connection);
+      if (connectionString.startsWith('sns:')) {
+        const { SNSConnection, snsUrl, subscribeHttpEndpoint } = await import('@geekmidas/events/sns');
+        const { SnsPushSubscriberAdaptor } = await import('@geekmidas/constructs/aws');
+        const address = snsUrl.parse(connectionString);
+        const route = SUBSCRIBER_ROUTE(id);
+        const adaptor = new SnsPushSubscriberAdaptor(envParser, subscriber, {
+          topicArn: address.topicArn,
+          // An emulator signs nothing. Decided by the address this server was
+          // configured with, never by anything a request says about itself.
+          verify: !address.endpoint,
+          ...(address.endpoint ? { emulatorEndpoint: address.endpoint } : {}),
+        });
+
+        app.post(route, async (c: any) => {
+          const body = JSON.parse(await c.req.text());
+          const response = await adaptor.handle(body);
+          return c.json(response.body, response.status);
+        });
+
+        afterListening.push(async (port) => {
+          const base =
+            process.env.GKM_SUBSCRIBER_PUSH_URL ??
+            (address.endpoint ? \`http://host.docker.internal:\${port}\` : undefined);
+          if (!base) {
+            logger.error(
+              { subscriber: id },
+              'Set GKM_SUBSCRIBER_PUSH_URL to the public URL of this worker, which SNS pushes to',
+            );
+            return;
+          }
+          const connection = await SNSConnection.fromConnectionString(connectionString);
+          await subscribeHttpEndpoint(connection, {
+            endpoint: new URL(route, base).toString(),
+            events,
+          });
+          logger.info({ subscriber: id, events }, 'Subscriber subscribed for push');
+        });
+        continue;
+      }
 
-      // Register services
+      let connection = connections.get(connectionString);
+      if (!connection) {
+        connection = await EventConnectionFactory.fromConnectionString(connectionString);
+        connections.set(connectionString, connection);
+      }
+      // Named, so a broker with one address for everything (pg-boss) gives
+      // this subscriber a queue of its own: fan-out, not competition.
+      const eventSubscriber = await Subscriber.fromConnection(connection, {
+        topic,
+        subscription: id,
+      });
       const services = subscriber.services.length > 0
         ? await serviceDiscovery.register(subscriber.services)
         : {};
 
-      // Subscribe to events
-      const subscribedEvents = subscriber.subscribedEvents || [];
-
-      if (subscribedEvents.length === 0) {
-        logger.warn({ subscriber: subscriber.constructor.name }, 'Subscriber has no subscribed events, skipping');
-        continue;
-      }
-
-      await eventSubscriber.subscribe(subscribedEvents, async (event) => {
+      await eventSubscriber.subscribe(events, async (event) => {
         try {
-          // Process single event (batch of 1)
           await subscriber.handler({
             events: [event],
             services: services as any,
             logger: subscriber.logger,
           });
-
-          logger.debug({ eventType: event.type }, 'Successfully processed event');
         } catch (error) {
-          logger.error({ error, event }, 'Failed to process event');
-          // Event will become visible again for retry
+          logger.error({ error, event, subscriber: id }, 'Failed to process event');
+          // Rethrown so the transport keeps the event for a retry — as a queue
+          // consumer's failure does, and as a pushed subscriber's 500 does.
+          throw error;
         }
       });
-
-      activeSubscribers.push(eventSubscriber);
-
-      logger.info(
-        {
-          events: subscribedEvents,
-        },
-        'Subscriber started polling'
-      );
+      logger.info({ subscriber: id, events }, 'Subscriber started polling');
     } catch (error) {
-      logger.error({ error, subscriber: subscriber.constructor.name }, 'Failed to setup subscriber');
+      logger.error({ error, subscriber: id }, 'Failed to set up subscriber');
     }
   }
 
-  // Setup graceful shutdown
   const shutdown = () => {
-    logger.info('Stopping all subscribers');
-    for (const eventSubscriber of activeSubscribers) {
-      connection.stop();
+    for (const connection of connections.values()) void connection.close();
+  };
+  process.once('SIGTERM', shutdown);
+  process.once('SIGINT', shutdown);
+
+  return async (port) => {
+    if (afterListening.length === 0) return;
+    await listening(port);
+    for (const subscribe of afterListening) {
+      await subscribe(port).catch((error) => {
+        logger.error({ error }, 'Failed to subscribe for push');
+      });
     }
   };
-
-  process.on('SIGTERM', shutdown);
-  process.on('SIGINT', shutdown);
 }
 `;
 		await writeFile(subscribersPath, content);
@@ -8642,11 +8679,7 @@ function generateConnectionUrls(services) {
 	if (services.postgres) urls.DATABASE_URL = generatePostgresUrl(services.postgres);
 	if (services.redis) urls.REDIS_URL = generateRedisUrl(services.redis);
 	if (services.minio) urls.STORAGE_ENDPOINT = generateMinioEndpoint(services.minio);
-	if (services.pgboss) {
-		const pgbossUrl = generatePgBossUrl(services.pgboss);
-		urls.EVENT_PUBLISHER_CONNECTION_STRING = pgbossUrl;
-		urls.EVENT_SUBSCRIBER_CONNECTION_STRING = pgbossUrl;
-	}
+	if (services.pgboss) urls.EVENT_PUBLISHER_CONNECTION_STRING = generatePgBossUrl(services.pgboss);
 	if (services.mailpit) {
 		urls.SMTP_HOST = services.mailpit.host;
 		urls.SMTP_PORT = String(services.mailpit.port);
@@ -9543,26 +9576,26 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.39",
-	"@geekmidas/auth": "~10.0.0-alpha.39",
-	"@geekmidas/cache": "~10.0.0-alpha.39",
-	"@geekmidas/client": "~10.0.0-alpha.39",
-	"@geekmidas/cloud": "~10.0.0-alpha.39",
-	"@geekmidas/constructs": "~10.0.0-alpha.39",
-	"@geekmidas/db": "~10.0.0-alpha.39",
-	"@geekmidas/emailkit": "~10.0.0-alpha.39",
-	"@geekmidas/envkit": "~10.0.0-alpha.39",
-	"@geekmidas/errors": "~10.0.0-alpha.39",
-	"@geekmidas/events": "~10.0.0-alpha.39",
-	"@geekmidas/logger": "~10.0.0-alpha.39",
-	"@geekmidas/manifest": "~10.0.0-alpha.39",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.39",
-	"@geekmidas/schema": "~10.0.0-alpha.39",
-	"@geekmidas/services": "~10.0.0-alpha.39",
-	"@geekmidas/storage": "~10.0.0-alpha.39",
-	"@geekmidas/studio": "~10.0.0-alpha.39",
-	"@geekmidas/telescope": "~10.0.0-alpha.39",
-	"@geekmidas/testkit": "~10.0.0-alpha.39",
+	"@geekmidas/audit": "~10.0.0-alpha.40",
+	"@geekmidas/auth": "~10.0.0-alpha.40",
+	"@geekmidas/cache": "~10.0.0-alpha.40",
+	"@geekmidas/client": "~10.0.0-alpha.40",
+	"@geekmidas/cloud": "~10.0.0-alpha.40",
+	"@geekmidas/constructs": "~10.0.0-alpha.40",
+	"@geekmidas/db": "~10.0.0-alpha.40",
+	"@geekmidas/emailkit": "~10.0.0-alpha.40",
+	"@geekmidas/envkit": "~10.0.0-alpha.40",
+	"@geekmidas/errors": "~10.0.0-alpha.40",
+	"@geekmidas/events": "~10.0.0-alpha.40",
+	"@geekmidas/logger": "~10.0.0-alpha.40",
+	"@geekmidas/manifest": "~10.0.0-alpha.40",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.40",
+	"@geekmidas/schema": "~10.0.0-alpha.40",
+	"@geekmidas/services": "~10.0.0-alpha.40",
+	"@geekmidas/storage": "~10.0.0-alpha.40",
+	"@geekmidas/studio": "~10.0.0-alpha.40",
+	"@geekmidas/telescope": "~10.0.0-alpha.40",
+	"@geekmidas/testkit": "~10.0.0-alpha.40",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -16311,7 +16344,7 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await import("./migrate-BJR912RE.mjs");
+	const { migrateAndSeed } = await import("./migrate-BVI3yqcE.mjs");
 	const { discover } = await import("./discover-BLhf7V_J.mjs").then((n) => n.n);
 	const sources = {};
 	const manifest = await discover({
@@ -16711,7 +16744,7 @@ program.command("build").description("Build handlers and the manifest from decla
 		process.exit(1);
 	}
 });
-program.command("dev").description("Reconcile constructs and start the dev server with automatic reload").option("-p, --port <port>", "Port to run the development server on").option("--entry <file>", "Entry file to run (bypasses gkm config)").option("--watch", "Watch for file changes (default: true with --entry)").option("--no-watch", "Disable file watching").option("--enable-openapi", "Enable OpenAPI documentation for development server", true).option("--migrate", "Apply pending migrations before the apps start").option("--seed", "Migrate, then run the seeds, before the apps start").option("--fake", "Call each external API’s fake (test/fakes/<id>.ts) instead of the provider").action(async (options) => {
+program.command("dev").description("Reconcile constructs and start the dev server with automatic reload").option("-p, --port <port>", "Port to run the development server on").option("--entry <file>", "Entry file to run (bypasses gkm config)").option("--watch", "Watch for file changes (default: true with --entry)").option("--no-watch", "Disable file watching").option("--enable-openapi", "Enable OpenAPI documentation for development server", true).option("--migrate", "Apply pending migrations before the apps start").option("--seed", "Migrate, then run the seeds, before the apps start").option("--fake", "Call each external API’s fake (test/fakes/<id>.ts) instead of the provider").option("--no-subscribers", "Run no topic subscribers: nothing is subscribed, polled or pushed to").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -16723,7 +16756,8 @@ program.command("dev").description("Reconcile constructs and start the dev serve
 			watch: options.watch,
 			migrate: options.migrate,
 			seed: options.seed,
-			fake: options.fake
+			fake: options.fake,
+			subscribers: options.subscribers
 		});
 	} catch (error) {
 		console.error(formatError(error));
@@ -16757,7 +16791,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await import("./migrate-BJR912RE.mjs");
+		const { migrateCommand } = await import("./migrate-BVI3yqcE.mjs");
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16771,7 +16805,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await import("./migrate-BJR912RE.mjs");
+		const { seedCommand } = await import("./migrate-BVI3yqcE.mjs");
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16785,7 +16819,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await import("./migrate-BJR912RE.mjs");
+		const { migrationCommand } = await import("./migrate-BVI3yqcE.mjs");
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -16924,7 +16958,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./workspace-CrFbItPz.mjs").then((n) => n.o);
+		const { derivedContainers } = await import("./workspace-DwS1JK5u.mjs").then((n) => n.o);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);