@geekmidas/cli 10.0.0-alpha.4 → 10.0.0-alpha.6

package/dist/index.mjs

@@ -1,13 +1,13 @@
 #!/usr/bin/env -S npx tsx
 import { __require } from "./chunk-Duj1WY3L.mjs";
 import { ConstructGenerator, DEFAULT_CACHE, discover, isPartitionedRoutes } from "./discover-CAlFgYec.mjs";
-import { derivedApps, getAppNameFromCwd, loadAppConfig, loadConfig, loadWorkspaceConfig, parseModuleConfig, resolveAppSpec } from "./config-WRdsQYZK.mjs";
-import { allConstructGlobs, getAppBuildOrder, getDependencyEnvVars, getDeployTargetError, getPublicEnvPrefix, isDeployTargetSupported, stripPublicPrefix } from "./workspace-BFMrAKqI.mjs";
+import { derivedApps, getAppNameFromCwd, loadAppConfig, loadConfig, loadWorkspaceConfig, parseModuleConfig, resolveAppSpec } from "./config-CxP7P-qG.mjs";
+import { allConstructGlobs, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getDeployTargetError, getPublicEnvPrefix, isDeployTargetSupported, stripPublicPrefix } from "./workspace-DIuZx-cc.mjs";
 import { getCredentialsPath, getDokployCredentials, getDokployRegistryId, getDokployToken, removeDokployCredentials, storeDokployCredentials, storeDokployRegistryId, storeHostingerToken } from "./credentials-B5zRHdAl.mjs";
-import { applyPostgres, cacheBackendOf, constructGlobs, createCredentialsPreload, createEntryWrapper, derivedContainers, emailBackendOf, findAvailablePort, isPortAvailable, loadEnvFiles, loadSecretsForApp, prepareEntryCredentials, providerOf, reconcileWorkspace, resolveServicePorts, resourceName, rewriteUrlsWithPorts, startWorkspaceServices, storageBackendOf, usesConstructs } from "./credentials-BBIRJVp4.mjs";
+import { applyPostgres, cacheBackendOf, constructGlobs, createCredentialsPreload, createEntryWrapper, derivedContainers, emailBackendOf, findAvailablePort, isPortAvailable, loadEnvFiles, loadSecretsForApp, prepareEntryCredentials, providerOf, reconcileWorkspace, resolveServicePorts, resourceName, rewriteUrlsWithPorts, startWorkspaceServices, storageBackendOf, usesConstructs } from "./credentials-BK3Z93MX.mjs";
 import { createStageSecrets, rotateServicePassword } from "./generator-VE2JrFlY.mjs";
 import { getKeyPath, maskPassword, readStageSecrets, secretsExist, setCustomSecret, toEmbeddableSecrets, writeStageSecrets } from "./storage-Bi24WfoW.mjs";
-import { EndpointGenerator, OPENAPI_OUTPUT_PATH, generateOpenApi, normalizeRoutes, openapiCommand, resolveOpenApiConfig } from "./openapi-kkQbsRVj.mjs";
+import { EndpointGenerator, OPENAPI_OUTPUT_PATH, generateOpenApi, generateOpenApiFrom, normalizeRoutes, openapiCommand, resolveOpenApiConfig, runtimeFor } from "./openapi-Bw8DWFWz.mjs";
 import { withCompute, withRoutes } from "./emit-CiZS_5Ub.mjs";
 import { DokployApi } from "./dokploy-api-aTFPz7_4.mjs";
 import { encryptSecrets } from "./encryption-D-abyhZx.mjs";
@@ -15,7 +15,7 @@ import { CachedStateProvider } from "./CachedStateProvider-DTniehMP.mjs";
 import { generateDbPassword, generateDbUrl, generateFullstackCustomSecrets } from "./fullstack-secrets-D1o9-G5l.mjs";
 import { generateReactQueryCommand } from "./openapi-react-query-Byltvm_7.mjs";
 import "./sync-CmEuNZsB.mjs";
-import { setupCommand, trustCommand } from "./setup-DXvRLTZN.mjs";
+import { setupCommand, trustCommand } from "./setup-BWMhbW-p.mjs";
 import { createRequire } from "node:module";
 import { copyFileSync, existsSync, readFileSync, unlinkSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve } from "node:path";
@@ -43,7 +43,7 @@ import prompts from "prompts";
 
 //#region package.json
 var name = "@geekmidas/cli";
-var version = "10.0.0-alpha.3";
+var version = "10.0.0-alpha.5";
 var description = "CLI tools for building Lambda handlers, server applications, and generating OpenAPI specs";
 var private$1 = false;
 var type = "module";
@@ -415,11 +415,16 @@ var CronGenerator = class extends ConstructGenerator {
 		const provider = options?.provider || "aws-lambda";
 		const logger$12 = console;
 		const cronInfos = [];
+		if (provider === "server") {
+			await this.generateServerCronsFile(outputDir, constructs);
+			logger$12.log(`Generated server crons file with ${constructs.length} crons`);
+			return cronInfos;
+		}
 		if (constructs.length === 0 || provider !== "aws-lambda") return cronInfos;
 		const cronsDir = join(outputDir, "crons");
 		await mkdir(cronsDir, { recursive: true });
 		for (const { key, construct, path } of constructs) {
-			const handlerFile = await this.generateCronHandler(cronsDir, path.relative, key, context);
+			const handlerFile = await this.generateCronHandler(cronsDir, path.relative, key, context, construct.owner);
 			cronInfos.push({
 				name: key,
 				handler: relative(process.cwd(), handlerFile).replace(/\.ts$/, ".handler"),
@@ -436,17 +441,173 @@ var CronGenerator = class extends ConstructGenerator {
 	isConstruct(value) {
 		return Cron.isCron(value);
 	}
-	async generateCronHandler(outputDir, sourceFile, exportName, context) {
+	/**
+	* The crons file a server entry imports.
+	*
+	* Shaped after `generateServerSubscribersFile`: one module, every cron, a
+	* `setupCrons` the generated entry calls beside `setupSubscribers`.
+	*
+	* It picks its scheduler from what the process can reach. With a Postgres it
+	* uses pg-boss, whose schedules live in the database — so a deployment
+	* running four replicas fires each job once, which is the thing a timer in
+	* every process gets wrong and does not report. With no database it falls
+	* back to timers and says plainly that it is doing so.
+	*/
+	async generateServerCronsFile(outputDir, crons) {
+		await mkdir(outputDir, { recursive: true });
+		const cronsPath = join(outputDir, "crons.ts");
+		const importsByFile = /* @__PURE__ */ new Map();
+		for (const { path, key } of crons) {
+			const relativePath = relative(dirname(cronsPath), path.relative);
+			const importPath = relativePath.replace(/\.ts$/, ".js");
+			if (!importsByFile.has(importPath)) importsByFile.set(importPath, []);
+			importsByFile.get(importPath)?.push(key);
+		}
+		const imports = Array.from(importsByFile.entries()).map(([importPath, exports$1]) => `import { ${exports$1.join(", ")} } from '${importPath}';`).join("\n");
+		const entries = crons.map(({ key }) => `  { name: '${key}', cron: ${key} }`).join(",\n");
+		const content = `/**
+ * Generated cron setup.
+ *
+ * Schedules every cron this app declares, in the process that serves it.
+ *
+ * The schedule lives in Postgres, through pg-boss, in the database the worker
+ * named with \`.database(db)\`. That is what makes running several replicas
+ * safe: each job fires once, where a timer in every process fires it once per
+ * replica and reports nothing.
+ *
+ * No connection string appears here. The construct that owns the database is
+ * the only thing that knows its key, and it is resolved through service
+ * discovery like any other dependency.
+ */
+import type { EnvironmentParser } from '@geekmidas/envkit';
+import type { Logger } from '@geekmidas/logger';
+import { toCronExpression } from '@geekmidas/constructs/crons';
+import { ServiceDiscovery } from '@geekmidas/services';
+${imports}
+
+const crons = [
+${entries}
+];
+
+type Stoppable = { stop: () => Promise<void> | void };
+const running: Stoppable[] = [];
+
+export async function setupCrons(
+  envParser: EnvironmentParser<any>,
+  logger: Logger,
+): Promise<void> {
+  if (crons.length === 0) {
+    return;
+  }
+
+  const serviceDiscovery = ServiceDiscovery.getInstance(envParser);
+
+  // Resolved once per cron rather than per firing: registering services on
+  // every tick would reconnect a database every minute.
+  const prepared = [];
+  for (const { name, cron } of crons) {
+    try {
+      const schedule = toCronExpression(cron.schedule);
+      const services = cron.services.length > 0
+        ? await serviceDiscovery.register(cron.services)
+        : {};
+
+      prepared.push({ name, cron, schedule, services });
+    } catch (error) {
+      // An unrepresentable schedule is a build-time mistake, and failing the
+      // process for it would take the HTTP server down with it.
+      logger.error({ error, cron: name }, 'Cron has no runnable schedule, skipping');
+    }
+  }
+
+  const run = async (entry: (typeof prepared)[number]) => {
+    try {
+      await entry.cron.handler({
+        input: undefined,
+        services: entry.services,
+        logger: entry.cron.logger,
+      });
+    } catch (error) {
+      logger.error({ error, cron: entry.name }, 'Cron failed');
+    }
+  };
+
+  // Declared once on the worker, carried onto every cron it built — so this
+  // reads it from any of them rather than from config or the environment.
+  const scheduleStore = prepared.find(({ cron }) => cron.scheduleStore)?.cron
+    .scheduleStore;
+
+  if (!scheduleStore) {
+    // Declared, not discovered. A worker says where its schedules live with
+    // \`.database(db)\`; inferring one from whatever database happened to be
+    // around would move the schedules the day an app declared a second.
+    logger.error(
+      { crons: prepared.map(({ name }) => name) },
+      'These crons have nowhere to keep their schedule. A server fires its own ' +
+        'crons, and a process scheduling in memory fires each job once per ' +
+        'replica — so the schedule lives in Postgres. Say where with ' +
+        '\`new Worker(…).database(db)\`.',
+    );
+    return;
+  }
+
+  const [store] = await serviceDiscovery
+    .register([scheduleStore])
+    .then((s) => Object.values(s));
+
+  const { PgBoss } = await import('pg-boss');
+  // The pool the construct already opened — no connection string is read here,
+  // and none is named anywhere outside the construct that owns it.
+  const boss = new PgBoss({ db: store as never });
+  await boss.start();
+
+  // What this app declares now. Anything else under the prefix belonged to a
+  // cron since renamed or deleted, and would keep firing at a handler that has
+  // gone.
+  //
+  // The prefix is \`cron.\` rather than \`cron:\`: pg-boss accepts
+  // alphanumerics, underscores, hyphens, periods and slashes in a queue name,
+  // and rejects a colon outright.
+  const declared = new Set(prepared.map(({ name }) => \`cron.\${name}\`));
+  for (const existing of await boss.getSchedules()) {
+    if (existing.name.startsWith('cron.') && !declared.has(existing.name)) {
+      await boss.unschedule(existing.name);
+      logger.info({ cron: existing.name }, 'Removed a schedule nothing declares');
+    }
+  }
+
+  for (const entry of prepared) {
+    const queue = \`cron.\${entry.name}\`;
+    await boss.createQueue(queue);
+    // UTC, so this agrees with the schedule a deploy target would have made.
+    await boss.schedule(queue, entry.schedule, undefined, { tz: 'UTC' });
+    await boss.work(queue, () => run(entry));
+
+    logger.info({ cron: entry.name, schedule: entry.schedule }, 'Cron scheduled');
+  }
+
+  running.push({ stop: () => boss.stop() });
+  logger.info({ count: prepared.length }, 'Crons scheduled');
+}
+
+export async function stopCrons(): Promise<void> {
+  await Promise.all(running.map((r) => r.stop()));
+  running.length = 0;
+}
+`;
+		await writeFile(cronsPath, content);
+		return cronsPath;
+	}
+	async generateCronHandler(outputDir, sourceFile, exportName, context, owner) {
 		const handlerFileName = `${exportName}.ts`;
 		const handlerPath = join(outputDir, handlerFileName);
 		const relativePath = relative(dirname(handlerPath), sourceFile);
 		const importPath = relativePath.replace(/\.ts$/, ".js");
-		const relativeEnvParserPath = relative(dirname(handlerPath), context.envParserPath);
-		const relativeLoggerPath = relative(dirname(handlerPath), context.loggerPath);
+		const runtime = runtimeFor(context, dirname(handlerPath), owner);
 		const content = `import { AWSScheduledFunction } from '@geekmidas/constructs/aws';
 import { ${exportName} } from '${importPath}';
-import ${context.envParserImportPattern} from '${relativeEnvParserPath}';
-import ${context.loggerImportPattern} from '${relativeLoggerPath}';
+${runtime.imports}
+${runtime.bindings}
 
 const adapter = new AWSScheduledFunction(envParser, ${exportName});
 
@@ -562,7 +723,7 @@ var FunctionGenerator = class extends ConstructGenerator {
 		const functionsDir = join(outputDir, "functions");
 		await mkdir(functionsDir, { recursive: true });
 		for (const { key, construct, path } of constructs) {
-			const handlerFile = await this.generateFunctionHandler(functionsDir, path.relative, key, context);
+			const handlerFile = await this.generateFunctionHandler(functionsDir, path.relative, key, context, construct.owner);
 			functionInfos.push({
 				name: key,
 				handler: relative(process.cwd(), handlerFile).replace(/\.ts$/, ".handler"),
@@ -575,17 +736,16 @@ var FunctionGenerator = class extends ConstructGenerator {
 		}
 		return functionInfos;
 	}
-	async generateFunctionHandler(outputDir, sourceFile, exportName, context) {
+	async generateFunctionHandler(outputDir, sourceFile, exportName, context, owner) {
 		const handlerFileName = `${exportName}.ts`;
 		const handlerPath = join(outputDir, handlerFileName);
 		const relativePath = relative(dirname(handlerPath), sourceFile);
 		const importPath = relativePath.replace(/\.ts$/, ".js");
-		const relativeEnvParserPath = relative(dirname(handlerPath), context.envParserPath);
-		const relativeLoggerPath = relative(dirname(handlerPath), context.loggerPath);
+		const runtime = runtimeFor(context, dirname(handlerPath), owner);
 		const content = `import { AWSLambdaFunction } from '@geekmidas/constructs/aws';
 import { ${exportName} } from '${importPath}';
-import ${context.envParserImportPattern} from '${relativeEnvParserPath}';
-import ${context.loggerImportPattern} from '${relativeLoggerPath}';
+${runtime.imports}
+${runtime.bindings}
 
 const adapter = new AWSLambdaFunction(envParser, ${exportName});
 
@@ -624,7 +784,7 @@ var QueueGenerator = class extends ConstructGenerator {
 		const queuesDir = join(outputDir, "queues");
 		await mkdir(queuesDir, { recursive: true });
 		for (const { key, construct, path } of constructs) {
-			const handlerFile = await this.generateQueueHandler(queuesDir, path.relative, key, context);
+			const handlerFile = await this.generateQueueHandler(queuesDir, path.relative, key, context, construct.owner);
 			queueInfos.push({
 				name: construct.name,
 				handler: relative(process.cwd(), handlerFile).replace(/\.ts$/, ".handler"),
@@ -638,13 +798,14 @@ var QueueGenerator = class extends ConstructGenerator {
 		}
 		return queueInfos;
 	}
-	async generateQueueHandler(outputDir, sourceFile, exportName, context) {
+	async generateQueueHandler(outputDir, sourceFile, exportName, context, owner) {
 		const handlerPath = join(outputDir, `${exportName}.ts`);
 		const importPath = relative(dirname(handlerPath), sourceFile).replace(/\.ts$/, ".js");
-		const relativeEnvParserPath = relative(dirname(handlerPath), context.envParserPath);
+		const runtime = runtimeFor(context, dirname(handlerPath), owner);
 		const content = `import { AWSLambdaQueue } from '@geekmidas/constructs/aws';
 import { ${exportName} } from '${importPath}';
-import ${context.envParserImportPattern} from '${relativeEnvParserPath}';
+${runtime.imports}
+${runtime.bindings}
 
 const adapter = new AWSLambdaQueue(envParser, ${exportName});
 
@@ -787,7 +948,7 @@ var SubscriberGenerator = class extends ConstructGenerator {
 		const subscribersDir = join(outputDir, "subscribers");
 		await mkdir(subscribersDir, { recursive: true });
 		for (const { key, construct, path } of constructs) {
-			const handlerFile = await this.generateSubscriberHandler(subscribersDir, path.relative, key, construct, context);
+			const handlerFile = await this.generateSubscriberHandler(subscribersDir, path.relative, key, construct, context, construct.owner);
 			subscriberInfos.push({
 				name: key,
 				handler: relative(process.cwd(), handlerFile).replace(/\.ts$/, ".handler"),
@@ -805,15 +966,16 @@ var SubscriberGenerator = class extends ConstructGenerator {
 		}
 		return subscriberInfos;
 	}
-	async generateSubscriberHandler(outputDir, sourceFile, exportName, _subscriber, context) {
+	async generateSubscriberHandler(outputDir, sourceFile, exportName, _subscriber, context, owner) {
 		const handlerFileName = `${exportName}.ts`;
 		const handlerPath = join(outputDir, handlerFileName);
 		const relativePath = relative(dirname(handlerPath), sourceFile);
 		const importPath = relativePath.replace(/\.ts$/, ".js");
-		const relativeEnvParserPath = relative(dirname(handlerPath), context.envParserPath);
+		const runtime = runtimeFor(context, dirname(handlerPath), owner);
 		const content = `import { AWSLambdaSubscriber } from '@geekmidas/constructs/aws';
 import { ${exportName} } from '${importPath}';
-import ${context.envParserImportPattern} from '${relativeEnvParserPath}';
+${runtime.imports}
+${runtime.bindings}
 
 const adapter = new AWSLambdaSubscriber(envParser, ${exportName});
 
@@ -1196,13 +1358,7 @@ async function devCommand(options) {
 	}
 	const resolved = resolveProviders(config, { provider: "server" });
 	logger$9.log("🚀 Starting development server...");
-	logger$9.log(`Loading routes from: ${config.routes}`);
-	if (config.functions) logger$9.log(`Loading functions from: ${config.functions}`);
-	if (config.crons) logger$9.log(`Loading crons from: ${config.crons}`);
-	if (config.subscribers) logger$9.log(`Loading subscribers from: ${config.subscribers}`);
-	logger$9.log(`Using envParser: ${config.envParser}`);
-	const { path: envParserPath, importPattern: envParserImportPattern } = parseModuleConfig(config.envParser, "envParser");
-	const { path: loggerPath, importPattern: loggerImportPattern } = parseModuleConfig(config.logger, "logger");
+	logger$9.log(`Loading constructs from: ${config.constructs}`);
 	const telescope = normalizeTelescopeConfig(config.telescope);
 	if (telescope) logger$9.log(`🔭 Telescope enabled at ${telescope.path}`);
 	const studio = normalizeStudioConfig(config.studio);
@@ -1213,16 +1369,12 @@ async function devCommand(options) {
 	const enableOpenApi = openApiConfig.enabled || resolved.enableOpenApi;
 	if (enableOpenApi) logger$9.log(`📄 OpenAPI output: ${OPENAPI_OUTPUT_PATH}`);
 	const buildContext = {
-		envParserPath,
-		envParserImportPattern,
-		loggerPath,
-		loggerImportPattern,
 		telescope,
 		studio,
 		hooks
 	};
 	await buildServer(config, buildContext, resolved.providers[0], enableOpenApi, appRoot);
-	if (enableOpenApi) await generateOpenApi(config);
+	if (enableOpenApi) await generateOpenApiFrom(config.constructs, { openapi: config.openapi });
 	const runtime = config.runtime ?? "node";
 	let secretsJsonPath;
 	const appSecrets = await loadSecretsForApp(secretsRoot, workspaceAppName);
@@ -1255,19 +1407,9 @@ async function devCommand(options) {
 	}
 	const devServer = new DevServer(resolved.providers[0], options.port ?? workspaceAppPort ?? 3e3, options.portExplicit ?? false, enableOpenApi, telescope, studio, runtime, appRoot, secretsJsonPath);
 	await devServer.start();
-	const envParserFile = config.envParser.split("#")[0] ?? config.envParser;
-	const loggerFile = config.logger.split("#")[0] ?? config.logger;
 	const hooksFileParts = config.hooks?.server?.split("#");
 	const hooksFile = hooksFileParts?.[0];
-	const watchPatterns = [
-		config.routes,
-		...config.functions ? [config.functions] : [],
-		...config.crons ? [config.crons] : [],
-		...config.subscribers ? [config.subscribers] : [],
-		envParserFile.endsWith(".ts") ? envParserFile : `${envParserFile}.ts`,
-		loggerFile.endsWith(".ts") ? loggerFile : `${loggerFile}.ts`,
-		...hooksFile ? [hooksFile.endsWith(".ts") ? hooksFile : `${hooksFile}.ts`] : []
-	].flat().filter((p) => typeof p === "string");
+	const watchPatterns = [config.constructs, ...hooksFile ? [hooksFile.endsWith(".ts") ? hooksFile : `${hooksFile}.ts`] : []].flat().filter((p) => typeof p === "string");
 	const normalizedPatterns = watchPatterns.map((p) => p.startsWith("./") ? p.slice(2) : p);
 	logger$9.log(`👀 Watching for changes in: ${normalizedPatterns.join(", ")}`);
 	const resolvedFiles = await fg(normalizedPatterns, {
@@ -1300,7 +1442,8 @@ async function devCommand(options) {
 			try {
 				logger$9.log("🔄 Rebuilding...");
 				await buildServer(config, buildContext, resolved.providers[0], enableOpenApi, appRoot, true);
-				if (enableOpenApi) await generateOpenApi(config, {
+				if (enableOpenApi) await generateOpenApiFrom(config.constructs, {
+					openapi: config.openapi,
 					silent: true,
 					bustCache: true
 				});
@@ -1714,7 +1857,7 @@ async function buildServer(config, context, provider, enableOpenApi, appRoot = p
 	const queueGenerator = new QueueGenerator();
 	const topicGenerator = new TopicGenerator();
 	const [allEndpoints, allFunctions, allCrons, allSubscribers, allQueues, allTopics] = await Promise.all([
-		endpointGenerator.load(config.routes, appRoot, bustCache),
+		endpointGenerator.load(config.constructs, appRoot, bustCache),
 		config.functions ? functionGenerator.load(config.functions, appRoot, bustCache) : [],
 		config.crons ? cronGenerator.load(config.crons, appRoot, bustCache) : [],
 		config.subscribers ? subscriberGenerator.load(config.subscribers, appRoot, bustCache) : [],
@@ -2302,18 +2445,35 @@ export default app;
 `);
 }
 const logger$7 = console;
+/**
+* What a build run at the workspace root reads.
+*
+* One backend app there, and it is that app's config, so its own `openapi`
+* and `telescope` settings still apply. Otherwise it is the workspace's: every
+* construct glob, and the backends they resolve to.
+*/
+function rootGkmConfig(workspace) {
+	const backends = Object.entries(workspace.apps).filter(([, app]) => app.type === "backend");
+	const only = backends.length === 1 ? backends[0] : void 0;
+	const own = only ? getAppGkmConfig(workspace, only[0]) : void 0;
+	return own ?? {
+		services: workspace.services,
+		constructs: allConstructGlobs(workspace)
+	};
+}
 async function buildCommand(options) {
 	const loadedConfig = await loadWorkspaceConfig();
 	if (loadedConfig.type === "workspace") {
 		const cwd = resolve(process.cwd());
 		const workspaceRoot = resolve(loadedConfig.workspace.root);
 		const isAtWorkspaceRoot = cwd === workspaceRoot;
-		if (isAtWorkspaceRoot) {
+		const someAppIsElsewhere = Object.values(loadedConfig.workspace.apps).some((app) => resolve(workspaceRoot, app.path) !== workspaceRoot);
+		if (isAtWorkspaceRoot && someAppIsElsewhere) {
 			logger$7.log("📦 Detected workspace configuration");
 			return workspaceBuildCommand(loadedConfig.workspace, options);
 		}
 	}
-	const config = loadedConfig.type === "workspace" ? (await loadAppConfig()).gkmConfig : await loadConfig();
+	const config = loadedConfig.type !== "workspace" ? await loadConfig() : resolve(process.cwd()) === resolve(loadedConfig.workspace.root) ? rootGkmConfig(loadedConfig.workspace) : (await loadAppConfig()).gkmConfig;
 	const resolved = resolveProviders(config, options);
 	const backendConfig = config.services ?? loadedConfig.workspace?.services;
 	const cacheBackend = cacheBackendOf(backendConfig?.cache);
@@ -2321,13 +2481,7 @@ async function buildCommand(options) {
 	const production = normalizeProductionConfig(options.production ?? false, productionConfigFromGkm);
 	if (production) logger$7.log(`🏭 Building for PRODUCTION`);
 	logger$7.log(`Building with providers: ${resolved.providers.join(", ")}`);
-	logger$7.log(`Loading routes from: ${formatRoutes(config.routes)}`);
-	if (config.functions) logger$7.log(`Loading functions from: ${formatRoutes(config.functions)}`);
-	if (config.crons) logger$7.log(`Loading crons from: ${formatRoutes(config.crons)}`);
-	if (config.subscribers) logger$7.log(`Loading subscribers from: ${formatRoutes(config.subscribers)}`);
-	logger$7.log(`Using envParser: ${config.envParser}`);
-	const { path: envParserPath, importPattern: envParserImportPattern } = parseModuleConfig(config.envParser, "envParser");
-	const { path: loggerPath, importPattern: loggerImportPattern } = parseModuleConfig(config.logger, "logger");
+	logger$7.log(`Loading constructs from: ${formatRoutes(config.constructs)}`);
 	const telescope = production ? void 0 : normalizeTelescopeConfig(config.telescope);
 	if (telescope) logger$7.log(`🔭 Telescope enabled at ${telescope.path}`);
 	const studio = production ? void 0 : normalizeStudioConfig(config.studio);
@@ -2355,7 +2509,18 @@ async function buildCommand(options) {
 	const primary = surfaces.find((d) => d.endpoints.length === 0) ?? surfaces[0];
 	const browsable = Object.entries(declared).find(([, d]) => d.kind === "database");
 	const browsableSource = browsable ? constructSources[browsable[0]] : void 0;
+	const owners = {};
+	for (const [id, declaration] of Object.entries(declared)) {
+		if (declaration.kind !== "rest-api" && declaration.kind !== "worker") continue;
+		const source = constructSources[id];
+		if (!source) continue;
+		owners[id] = {
+			specifier: source.file,
+			exportName: source.exportName
+		};
+	}
 	const buildContext = {
+		owners,
 		...primary ? { surface: {
 			id: primary.id,
 			trustedOriginsKey: provideKey(primary.id, "trustedOrigins"),
@@ -2365,10 +2530,6 @@ async function buildCommand(options) {
 				exportName: constructSources[primary.id].exportName
 			} } : {}
 		} } : {},
-		envParserPath,
-		envParserImportPattern,
-		loggerPath,
-		loggerImportPattern,
 		telescope,
 		studio: studio && browsableSource ? {
 			...studio,
@@ -2395,13 +2556,14 @@ async function buildCommand(options) {
 	const subscriberGenerator = new SubscriberGenerator();
 	const queueGenerator = new QueueGenerator();
 	const topicGenerator = new TopicGenerator();
+	const code = constructGlobs$1;
 	const [allEndpoints, allFunctions, allCrons, allSubscribers, allQueues, allTopics] = await Promise.all([
-		endpointGenerator.load(config.routes),
-		config.functions ? functionGenerator.load(config.functions) : [],
-		config.crons ? cronGenerator.load(config.crons) : [],
-		config.subscribers ? subscriberGenerator.load(config.subscribers) : [],
-		config.queues ? queueGenerator.load(config.queues) : [],
-		config.topics ? topicGenerator.load(config.topics) : []
+		endpointGenerator.load(code),
+		functionGenerator.load(code),
+		cronGenerator.load(code),
+		subscriberGenerator.load(code),
+		queueGenerator.load(code),
+		topicGenerator.load(code)
 	]);
 	logger$7.log(`Found ${allEndpoints.length} endpoints`);
 	logger$7.log(`Found ${allFunctions.length} functions`);
@@ -2410,7 +2572,7 @@ async function buildCommand(options) {
 	logger$7.log(`Found ${allQueues.length} queues`);
 	logger$7.log(`Found ${allTopics.length} topics`);
 	if (allEndpoints.length === 0 && allFunctions.length === 0 && allCrons.length === 0 && allSubscribers.length === 0 && allQueues.length === 0 && allTopics.length === 0) {
-		const selfServing = Object.entries(declared).find(([id, d]) => d.kind === "rest-api" && d.endpoints.length > 0 && constructSources[id] !== void 0 && resolve(loadedConfig.workspace.root, resolveAppSpec(id, d.app ?? {}, loadedConfig.workspace.root, "rest-api").path) === resolve(process.cwd()));
+		const selfServing = Object.entries(declared).find(([id, d]) => d.kind === "rest-api" && d.endpoints.length > 0 && constructSources[id] !== void 0 && resolve(loadedConfig.workspace.root, resolveAppSpec(id, d.app ?? {}, loadedConfig.workspace.root).path) === resolve(process.cwd()));
 		if (selfServing) {
 			const [id] = selfServing;
 			await writeSurfaceEntry(join(process.cwd(), ".gkm", "server"), constructSources[id]);
@@ -2427,7 +2589,7 @@ async function buildCommand(options) {
 		const providerResult = await buildForProvider(provider, buildContext, rootOutputDir, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, queueGenerator, topicGenerator, allEndpoints, allFunctions, allCrons, allSubscribers, allQueues, allTopics, resolved.enableOpenApi, options.skipBundle ?? false, options.stage);
 		if (providerResult.masterKey) result = providerResult;
 	}
-	await generateOpenApi(config, { bustCache: true });
+	await generateOpenApi(allEndpoints.map(({ construct }) => construct), { openapi: config.openapi });
 	return result;
 }
 async function buildForProvider(provider, context, rootOutputDir, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, queueGenerator, topicGenerator, endpoints, functions, crons, subscribers, queues, topics, enableOpenApi, skipBundle, stage) {
@@ -3051,7 +3213,7 @@ function minioCompose(options) {
 	return [
 		"services:",
 		`  ${service}:`,
-		"    image: quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z",
+		"    image: pgsty/minio:RELEASE.2026-08-04T00-00-00Z",
 		`    command: server /data --console-address ":9001"`,
 		"    environment:",
 		`      MINIO_ROOT_USER: ${user}`,
@@ -3870,7 +4032,7 @@ const DEFAULT_SERVICE_IMAGES = {
 	postgres: "postgres",
 	redis: "redis",
 	rabbitmq: "rabbitmq",
-	minio: "quay.io/minio/minio",
+	minio: "pgsty/minio",
 	mailpit: "axllent/mailpit",
 	localstack: "floci/floci"
 };
@@ -3879,7 +4041,7 @@ const DEFAULT_SERVICE_VERSIONS = {
 	postgres: `${DEFAULT_POSTGRES_VERSION}-alpine`,
 	redis: "7-alpine",
 	rabbitmq: "3-management-alpine",
-	minio: "RELEASE.2025-09-07T16-13-09Z",
+	minio: "RELEASE.2026-08-04T00-00-00Z",
 	mailpit: "latest",
 	localstack: "latest"
 };
@@ -4331,7 +4493,7 @@ function getInfraServiceImage(serviceName$1, pin) {
 	const defaults = {
 		postgres: "postgres:18-alpine",
 		redis: "redis:7-alpine",
-		minio: "quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z"
+		minio: "pgsty/minio:RELEASE.2026-08-04T00-00-00Z"
 	};
 	return pin || defaults[serviceName$1];
 }
@@ -7694,11 +7856,11 @@ Crons, subscribers and functions are declared the same way endpoints are: as
 exported values the build discovers.
 
 \`\`\`typescript
-// a scheduled job
-import { c } from '@geekmidas/constructs/crons';
+// a scheduled job, built from the worker that runs it
+import { worker } from '../constructs/worker.ts';
 
-export const cleanup = c
-  .schedule('rate(1 day)')
+export const cleanup = worker
+  .cron('rate(1 day)')
   .handle(async ({ logger }) => {
     logger.info('cleaning up');
   });
@@ -7706,10 +7868,10 @@ export const cleanup = c
 
 \`\`\`typescript
 // a topic subscriber
-import { s } from '@geekmidas/constructs/subscribers';
 import { userEvents } from '../constructs/topics.ts';
+import { worker } from '../constructs/worker.ts';
 
-export const onUserCreated = s
+export const onUserCreated = worker
   .topic(userEvents)
   .subscribe(['user.created'])
   .handle(async ({ events, logger }) => {
@@ -7814,26 +7976,26 @@ const CLI_VERSION = `~${pkg.version}`;
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.3",
-	"@geekmidas/auth": "~10.0.0-alpha.3",
-	"@geekmidas/cache": "~10.0.0-alpha.3",
-	"@geekmidas/client": "~10.0.0-alpha.3",
-	"@geekmidas/cloud": "~10.0.0-alpha.3",
-	"@geekmidas/constructs": "~10.0.0-alpha.3",
-	"@geekmidas/db": "~10.0.0-alpha.3",
-	"@geekmidas/emailkit": "~10.0.0-alpha.3",
-	"@geekmidas/envkit": "~10.0.0-alpha.3",
-	"@geekmidas/errors": "~10.0.0-alpha.3",
-	"@geekmidas/events": "~10.0.0-alpha.3",
-	"@geekmidas/logger": "~10.0.0-alpha.3",
-	"@geekmidas/manifest": "~10.0.0-alpha.3",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.3",
-	"@geekmidas/schema": "~10.0.0-alpha.3",
-	"@geekmidas/services": "~10.0.0-alpha.3",
-	"@geekmidas/storage": "~10.0.0-alpha.3",
-	"@geekmidas/studio": "~10.0.0-alpha.3",
-	"@geekmidas/telescope": "~10.0.0-alpha.3",
-	"@geekmidas/testkit": "~10.0.0-alpha.3",
+	"@geekmidas/audit": "~10.0.0-alpha.5",
+	"@geekmidas/auth": "~10.0.0-alpha.5",
+	"@geekmidas/cache": "~10.0.0-alpha.5",
+	"@geekmidas/client": "~10.0.0-alpha.5",
+	"@geekmidas/cloud": "~10.0.0-alpha.5",
+	"@geekmidas/constructs": "~10.0.0-alpha.5",
+	"@geekmidas/db": "~10.0.0-alpha.5",
+	"@geekmidas/emailkit": "~10.0.0-alpha.5",
+	"@geekmidas/envkit": "~10.0.0-alpha.5",
+	"@geekmidas/errors": "~10.0.0-alpha.5",
+	"@geekmidas/events": "~10.0.0-alpha.5",
+	"@geekmidas/logger": "~10.0.0-alpha.5",
+	"@geekmidas/manifest": "~10.0.0-alpha.5",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.5",
+	"@geekmidas/schema": "~10.0.0-alpha.5",
+	"@geekmidas/services": "~10.0.0-alpha.5",
+	"@geekmidas/storage": "~10.0.0-alpha.5",
+	"@geekmidas/studio": "~10.0.0-alpha.5",
+	"@geekmidas/telescope": "~10.0.0-alpha.5",
+	"@geekmidas/testkit": "~10.0.0-alpha.5",
 	"@geekmidas/cli": CLI_VERSION
 };
 
@@ -8022,7 +8184,9 @@ export default defineConfig({${options.monorepo ? "" : `
 			forceConsistentCasingInFileNames: true,
 			resolveJsonModule: true,
 			noEmit: true,
-			allowImportingTsExtensions: true
+			allowImportingTsExtensions: true,
+			baseUrl: ".",
+			paths: { "~/*": ["./src/*"] }
 		},
 		include: ["src/**/*.ts"],
 		exclude: ["node_modules", "dist"]
@@ -8280,7 +8444,7 @@ function generateDockerFiles(options, template, dbApps) {
       MP_SMTP_AUTH: \${SMTP_USER:-${options.name}}:\${SMTP_PASS:-${options.name}}`);
 	if (options.services?.storage) {
 		services.push(`  minio:
-    image: quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z
+    image: pgsty/minio:RELEASE.2026-08-04T00-00-00Z
     container_name: ${options.name}-minio
     restart: unless-stopped
     entrypoint: sh
@@ -10449,15 +10613,23 @@ export const healthEndpoint = api
 			},
 			{
 				path: "src/functions/hello.ts",
-				content: `import { f } from '@geekmidas/constructs/functions';
-import { z } from 'zod';
+				content: `import { z } from 'zod';
+import { worker } from '~/constructs/worker.ts';
 
-export const helloFunction = f
+export const helloFunction = worker
   .input(z.object({ name: z.string() }))
   .output(z.object({ message: z.string() }))
   .handle(async ({ input }) => ({
     message: \`Hello, \${input.name}!\`,
   }));
+`
+			},
+			{
+				path: "src/constructs/worker.ts",
+				content: `import { Worker } from '@geekmidas/constructs/worker';
+import { logger } from '../config/logger.ts';
+
+export const worker = new Worker('Jobs', { logger });
 `
 			}
 		];
@@ -10480,6 +10652,22 @@ export const telescope = new Telescope({
 
 //#endregion
 //#region src/init/templates/worker.ts
+/**
+* A project that is background work and nothing else.
+*
+* It used to scaffold a `RestApi` with no endpoints on it — an HTTP surface
+* declared by a project whose premise is that nothing calls it over HTTP —
+* because a surface was the only construct that made an app exist and the only
+* way to get a logger into the generated runtime. `Worker` is the construct
+* that was missing: it takes no authorizer, publishes no address, and hands out
+* factories already carrying its logger.
+*
+* It scaffolds a cron when the project has a database, and not otherwise. A
+* server fires its own crons, and the schedule lives in Postgres so that
+* running more than one replica still fires each job once — so a worker names
+* the database it keeps schedules in. Without one there is nowhere to keep
+* them, and an example that could not run is worse than none.
+*/
 const workerTemplate = {
 	name: "worker",
 	description: "Background job processing",
@@ -10489,11 +10677,8 @@ const workerTemplate = {
 		"@geekmidas/envkit": GEEKMIDAS_VERSIONS["@geekmidas/envkit"],
 		"@geekmidas/events": GEEKMIDAS_VERSIONS["@geekmidas/events"],
 		"@geekmidas/logger": GEEKMIDAS_VERSIONS["@geekmidas/logger"],
-		"@geekmidas/rate-limit": GEEKMIDAS_VERSIONS["@geekmidas/rate-limit"],
 		"@geekmidas/schema": GEEKMIDAS_VERSIONS["@geekmidas/schema"],
-		"@hono/node-server": "~1.14.1",
-		hono: "~4.8.2",
-		pino: "~9.6.0"
+		pino: "~10.3.1"
 	},
 	devDependencies: {
 		"@biomejs/biome": "~2.3.0",
@@ -10515,34 +10700,18 @@ const workerTemplate = {
 		"fmt:check": "biome format ."
 	},
 	files: (options) => {
-		const { loggerType, routesStructure, name: name$1 } = options;
+		const { loggerType, name: name$1, database } = options;
 		const loggerContent = `import { createLogger } from '@geekmidas/logger/${loggerType}';
 
 export const logger = createLogger();
 `;
-		const getRoutePath = (file) => {
-			switch (routesStructure) {
-				case "centralized-endpoints": return `src/endpoints/${file}`;
-				case "centralized-routes": return `src/routes/${file}`;
-				case "domain-based": return `src/${file.replace(".ts", "")}/routes/index.ts`;
-			}
-		};
-		const apiImport = routesStructure === "domain-based" ? "../../constructs/api.js" : "../constructs/api.js";
 		const files$1 = [
 			{
-				path: "src/constructs/api.ts",
-				content: `import { RestApi } from '@geekmidas/constructs/rest-api';
-import { logger } from '../config/logger.ts';
+				path: "src/constructs/worker.ts",
+				content: `import { Worker } from '@geekmidas/constructs/worker';
+import { logger } from '../config/logger.ts';${database ? "\nimport { database } from './database.ts';" : ""}
 
-export const api = new RestApi('Api', {
-  // Typed out rather than omitted: an API that ships open because a field was
-  // left off is the one default worth refusing to have.
-  defaultAuthorizer: 'none',
-
-  // The actual logger, not a path to one. Every endpoint built from this
-  // surface runs with it, and so does the generated entry.
-  logger,
-});
+export const worker = new Worker('Jobs', { logger })${database ? ".database(database)" : ""};
 `
 			},
 			{
@@ -10566,23 +10735,6 @@ export const config = envParser
 				path: "src/config/logger.ts",
 				content: loggerContent
 			},
-			{
-				path: getRoutePath("health.ts"),
-				content: `import { z } from 'zod';
-import { api } from '${apiImport}';
-
-export const healthEndpoint = api
-  .get('/health')
-  .output(z.object({
-    status: z.string(),
-    timestamp: z.string(),
-  }))
-  .handle(async () => ({
-    status: 'ok',
-    timestamp: new Date().toISOString(),
-  }));
-`
-			},
 			{
 				path: "src/events/types.ts",
 				content: `import type { PublishableMessage } from '@geekmidas/events';
@@ -10624,45 +10776,46 @@ export const eventsPublisherService = {
 			},
 			{
 				path: "src/subscribers/user-events.ts",
-				content: `import { s } from '@geekmidas/constructs/subscribers';
+				content: `import { worker } from '~/constructs/worker.ts';
 import { eventsPublisherService } from '~/events/publisher.ts';
 
-export const userEventsSubscriber = s
+export const userEventsSubscriber = worker
   .publisher(eventsPublisherService)
   .subscribe(['user.created', 'user.updated'])
-  .handle(async ({ event, logger }) => {
-    logger.info({ type: event.type, payload: event.payload }, 'Processing user event');
-
-    switch (event.type) {
-      case 'user.created':
-        // Handle user creation
-        logger.info({ userId: event.payload.userId }, 'New user created');
-        break;
-      case 'user.updated':
-        // Handle user update
-        logger.info({ userId: event.payload.userId }, 'User updated');
-        break;
+  .handle(async ({ events, logger }) => {
+    // A batch, not a single event. Both transports deliver in batches, so
+    // handling them one at a time is a round trip per event for no reason.
+    logger.info({ count: events.length }, 'Processing user events');
+
+    for (const event of events) {
+      switch (event.type) {
+        case 'user.created':
+          logger.info({ userId: event.payload.userId }, 'New user created');
+          break;
+        case 'user.updated':
+          logger.info({ userId: event.payload.userId }, 'User updated');
+          break;
+      }
     }
   });
 `
-			},
-			{
-				path: "src/crons/cleanup.ts",
-				content: `import { cron } from '@geekmidas/constructs/crons';
+			}
+		];
+		if (database) files$1.push({
+			path: "src/crons/cleanup.ts",
+			content: `import { worker } from '~/constructs/worker.ts';
 
-// Run every day at midnight
-export const cleanupCron = cron('0 0 * * *')
+export const cleanup = worker
+  .cron('rate(1 day)')
   .handle(async ({ logger }) => {
-    logger.info('Running cleanup job');
+    logger.info('Running cleanup');
 
-    // Add your cleanup logic here
-    // e.g., delete old sessions, clean up temp files, etc.
+    // Delete old sessions, clear temp files, whatever falls out of date.
 
-    logger.info('Cleanup job completed');
+    logger.info('Cleanup complete');
   });
 `
-			}
-		];
+		});
 		if (options.database) files$1.push(...databaseFiles(name$1));
 		if (options.telescope) files$1.push({
 			path: "src/config/telescope.ts",
@@ -13908,7 +14061,7 @@ async function testCommand(options = {}) {
 	console.log(`\n🧪 Running tests with ${stage} environment...\n`);
 	const autoSetup = options.autoSetup || Boolean(process.env.GKM_AUTO_SETUP);
 	if (autoSetup) {
-		const { ensureStageSecrets } = await import("./setup-ZijS4qeC.mjs");
+		const { ensureStageSecrets } = await import("./setup-DGIPd2fh.mjs");
 		const generated = await ensureStageSecrets(stage, cwd);
 		if (generated) console.log(`  🔐 Generated fresh ${stage} secrets (auto-setup)`);
 	}
@@ -14383,7 +14536,7 @@ program.command("secrets:push").description("Push secrets to remote provider (SS
 		const { workspace } = await loadWorkspaceConfig$1();
 		const secrets = await readStageSecrets$1(options.stage, workspace.root);
 		if (secrets) {
-			const { derivedContainers: derivedContainers$1 } = await import("./workspace-k4l3rsFh.mjs");
+			const { derivedContainers: derivedContainers$1 } = await import("./workspace-CnTqIlB3.mjs");
 			const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers$1(workspace, options.stage));
 			if (result) {
 				await writeStageSecrets$1(result.secrets, workspace.root);
@@ -14412,7 +14565,7 @@ program.command("secrets:pull").description("Pull secrets from remote provider (
 			console.error(`No remote secrets found for stage "${options.stage}".`);
 			process.exit(1);
 		}
-		const { derivedContainers: derivedContainers$1 } = await import("./workspace-k4l3rsFh.mjs");
+		const { derivedContainers: derivedContainers$1 } = await import("./workspace-CnTqIlB3.mjs");
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers$1(workspace, options.stage));
 		if (result) {
 			secrets = result.secrets;
@@ -14439,7 +14592,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${options.stage}". Run "gkm secrets:init --stage ${options.stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers: derivedContainers$1 } = await import("./workspace-k4l3rsFh.mjs");
+		const { derivedContainers: derivedContainers$1 } = await import("./workspace-CnTqIlB3.mjs");
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers$1(workspace, options.stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${options.stage}" are up-to-date`);