@geekmidas/cli 10.0.0-alpha.72 → 10.0.0-alpha.73

package/dist/index.mjs

@@ -2,21 +2,22 @@
 import { n as __require, t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { r as DEFAULT_TIMEOUT_MS, t as CommandFailed } from "./run-BJLIerMM.mjs";
 import { c as getDokployCredentials, f as removeDokployCredentials, i as LocalSandbox, l as getDokployRegistryId, m as storeHostingerToken, p as storeDokployCredentials, s as getCredentialsPath, u as getDokployToken } from "./credentials-pAtB70k3.mjs";
-import { l as withOwningTsconfigJsx, r as discover, u as ConstructGenerator } from "./discover-Buwf1z4P.mjs";
+import { l as withOwningTsconfigJsx, r as discover, u as ConstructGenerator } from "./discover-BPelzeGW.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
 import { A as deployedProblems, D as InvalidStages, O as TEST_STAGE, c as getAppGkmConfig, j as stageProblems, n as allConstructGlobs, s as getAppBuildOrder } from "./workspace-C7NqCsQF.mjs";
 import { ConfigNotFound, NotABackendApp, NotInAnApp, loadAppConfig, loadConfig, loadWorkspaceConfig, loadWorkspaceSettings, parseModuleConfig } from "./config.mjs";
-import { At as findAvailablePort, Dt as primaryPortKey, G as constructGlobs, H as keyFingerprint, I as parseDevServices, It as secretsStoreFor, K as derivedContainers, Mt as loadEnvFiles, Nt as loadSecretsForApp, Ot as createCredentialsPreload, Pt as prepareEntryCredentials, Qt as maskPassword, Rt as FileSecretsStore, Tt as fakeKey, U as FAKE_ENV, Vt as projectKey, W as backendsOf$1, Wt as deployIdentity, X as forgetState, Y as LOCAL_CA_PATH, bt as eventsBackendFor, en as toEmbeddableSecrets, jt as isPortAvailable, kt as createEntryWrapper, ot as pgClient, q as reconcileWorkspace, rt as quoteIdentifier, tn as withCustomSecret, tt as postgresDatabaseNames, wt as describeServices, xt as providerOf, y as dockerCommand, yt as cacheBackendFor, zt as getKeyPath } from "./state-BJFherj1.mjs";
-import { i as telemetryFor, n as EndpointGenerator, r as runtimeFor } from "./OpenApiTsGenerator-Dv0gT2DL.mjs";
-import { g as createStateStore, n as sniffAppEnvironment, o as DokployApi } from "./sniffer-vAXsU_4G.mjs";
+import { $ as constructGlobs, At as eventsBackendFor, Bt as findAvailablePort, Ft as fakeKey, G as keyFingerprint, H as workerUnits, Ht as loadEnvFiles, J as workerEntryDir, Jt as FileSecretsStore, K as WorkerGenerator, Kt as secretsStoreFor, Lt as primaryPortKey, Pt as describeServices, Q as backendsOf$1, R as parseDevServices, Rt as createCredentialsPreload, Ut as loadSecretsForApp, Vt as isPortAvailable, Wt as prepareEntryCredentials, X as CronGenerator, Y as QueueGenerator, Yt as getKeyPath, Z as FAKE_ENV, Zt as projectKey, cn as maskPassword, dn as withCustomSecret, dt as quoteIdentifier, en as deployIdentity, et as derivedContainers, it as forgetState, jt as providerOf, kt as cacheBackendFor, lt as postgresDatabaseNames, mt as pgClient, q as workerBundleName, rt as LOCAL_CA_PATH, tt as reconcileWorkspace, un as toEmbeddableSecrets, y as dockerCommand, zt as createEntryWrapper } from "./state-DtS2HEfi.mjs";
+import { i as telemetryFor, n as runtimeFor, t as EndpointGenerator } from "./EndpointGenerator-DftalLYg.mjs";
+import { g as createStateStore, n as sniffAppEnvironment, o as DokployApi } from "./sniffer-BFmdZpZ2.mjs";
 import { generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi.mjs";
+import { t as SubscriberGenerator } from "./SubscriberGenerator-DZk_pKDh.mjs";
 import { a as describeHolder, i as assignAppPorts, o as holderOf, r as appTag, s as withAppPorts, t as APP_TAG_ENV } from "./appPorts-C9z9Pzn9.mjs";
-import { a as writeTestHarness, c as driversFor, i as TEST_MANIFEST_ENV, l as eventsBackendsIn, n as TEST_READY_FILE, o as SubscriberGenerator, s as cacheBackendsIn, t as TEST_READY_ENV } from "./ready-ULc5BTOb.mjs";
+import { a as writeTestHarness, c as eventsBackendsIn, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, o as cacheBackendsIn, s as driversFor, t as TEST_READY_ENV } from "./ready-C0U0NYfB.mjs";
 import { n as withCompute, r as withRoutes, t as manifestModule } from "./emit-C1e8qD08.mjs";
-import { t as deploy$1 } from "./deploy-ClC53rc6.mjs";
-import { a as stackDir, i as composeProject, o as dockerCompose, r as stackOverrideFile, t as composeTarget } from "./compose-T3hnnjKZ.mjs";
-import { o as loadCredentialSchemas, t as CredentialsInvalid } from "./credentialSchemas-BmYxnEz_.mjs";
-import { t as LocalStateStore } from "./LocalStateStore-DUoG2wA_.mjs";
+import { t as deploy$1 } from "./deploy-nmov4j0B.mjs";
+import { a as stackDir, i as composeProject, o as dockerCompose, r as stackOverrideFile, t as composeTarget } from "./compose-9II-0IsK.mjs";
+import { o as loadCredentialSchemas, t as CredentialsInvalid } from "./credentialSchemas-BJqRJNK4.mjs";
+import { t as LocalStateStore } from "./LocalStateStore-CNjgkRk4.mjs";
 import { a as getExecCommand, c as validateProjectName, i as findWorkspaceRoot, n as detectPackageManager$1, o as getInstallCommand, r as findWorkspacePackages, s as getRunCommand, t as checkDirectoryExists } from "./utils-D_fxUqvU.mjs";
 import { createRequire } from "node:module";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
@@ -42,12 +43,10 @@ import { createServer as createServer$2 } from "http";
 import { Http2ServerRequest } from "http2";
 import { Readable as Readable$1 } from "stream";
 import crypto from "crypto";
-import { Cron } from "@geekmidas/constructs/crons";
 import { Function } from "@geekmidas/constructs/functions";
-import { Queue } from "@geekmidas/constructs/queue";
 import { Topic } from "@geekmidas/constructs/topic";
 //#region package.json
-var version = "10.0.0-alpha.72";
+var version = "10.0.0-alpha.73";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -130,7 +129,7 @@ const logger$8 = console;
 * Validate Dokploy token by making a test API call
 */
 async function validateDokployToken(endpoint, token) {
-	const { DokployApi } = await import("./sniffer-vAXsU_4G.mjs").then((n) => n.c);
+	const { DokployApi } = await import("./sniffer-BFmdZpZ2.mjs").then((n) => n.c);
 	return new DokployApi({
 		baseUrl: endpoint,
 		token
@@ -2036,9 +2035,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$5.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$5.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await import("./migrate-guck0NJK.mjs");
+		const { prepareDevDatabases } = await import("./migrate-CFFC3esE.mjs");
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await import("./migrate-guck0NJK.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await import("./migrate-CFFC3esE.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$5.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -2597,244 +2596,6 @@ var DevServer = class {
 	}
 };
 //#endregion
-//#region src/generators/CronGenerator.ts
-var CronGenerator = class extends ConstructGenerator {
-	async build(context, constructs, outputDir, options) {
-		const target = options?.target ?? "aws";
-		const logger = console;
-		const cronInfos = [];
-		if (target === "server") {
-			await this.generateServerCronsFile(outputDir, constructs);
-			logger.log(`Generated server crons file with ${constructs.length} crons`);
-			return cronInfos;
-		}
-		if (constructs.length === 0) return cronInfos;
-		const cronsDir = join(outputDir, "crons");
-		await mkdir(cronsDir, { recursive: true });
-		for (const { key, construct, path } of constructs) {
-			const handlerFile = await this.generateCronHandler(cronsDir, path.relative, key, context, construct.owner);
-			cronInfos.push({
-				name: key,
-				handler: relative(options?.root ?? process.cwd(), handlerFile).replace(/\.ts$/, ".handler"),
-				schedule: construct.schedule || "rate(1 hour)",
-				timeout: construct.timeout,
-				memorySize: construct.memorySize,
-				environment: await construct.getEnvironment({ markOptional: context.markOptional }),
-				dependencies: construct.constructs
-			});
-			logger.log(`Generated cron handler: ${key}`);
-		}
-		return cronInfos;
-	}
-	isConstruct(value) {
-		return Cron.isCron(value);
-	}
-	/**
-	* The crons file a server entry imports.
-	*
-	* Shaped after `generateServerSubscribersFile`: one module, every cron, a
-	* `setupCrons` the generated entry calls beside `setupSubscribers`.
-	*
-	* It picks its scheduler from what the process can reach. With a Postgres it
-	* uses pg-boss, whose schedules live in the database — so a deployment
-	* running four replicas fires each job once, which is the thing a timer in
-	* every process gets wrong and does not report. With no database it falls
-	* back to timers and says plainly that it is doing so.
-	*/
-	async generateServerCronsFile(outputDir, crons) {
-		await mkdir(outputDir, { recursive: true });
-		const cronsPath = join(outputDir, "crons.ts");
-		if (crons.length === 0) {
-			await writeFile(cronsPath, `/**
- * Generated cron setup — this app declares none.
- */
-import type { EnvironmentParser } from '@geekmidas/envkit';
-import type { Logger } from '@geekmidas/logger';
-
-export async function setupCrons(
-  _envParser: EnvironmentParser<any>,
-  _logger: Logger,
-): Promise<void> {}
-
-export async function stopCrons(): Promise<void> {}
-`);
-			return cronsPath;
-		}
-		const importsByFile = /* @__PURE__ */ new Map();
-		for (const { path, key } of crons) {
-			const importPath = relative(dirname(cronsPath), path.relative).replace(/\.ts$/, ".js");
-			if (!importsByFile.has(importPath)) importsByFile.set(importPath, []);
-			importsByFile.get(importPath)?.push(key);
-		}
-		const content = `/**
- * Generated cron setup.
- *
- * Schedules every cron this app declares, in the process that serves it.
- *
- * The schedule lives in Postgres, through pg-boss, in the database the worker
- * named with \`.database(db)\`. That is what makes running several replicas
- * safe: each job fires once, where a timer in every process fires it once per
- * replica and reports nothing.
- *
- * No connection string appears here. The construct that owns the database is
- * the only thing that knows its key, and it is resolved through service
- * discovery like any other dependency.
- */
-import type { EnvironmentParser } from '@geekmidas/envkit';
-import type { Logger } from '@geekmidas/logger';
-import { runCron, scheduleInProcess, toCronExpression } from '@geekmidas/constructs/crons';
-import { ServiceDiscovery } from '@geekmidas/services';
-${Array.from(importsByFile.entries()).map(([importPath, exports]) => `import { ${exports.join(", ")} } from '${importPath}';`).join("\n")}
-
-const crons = [
-${crons.map(({ key }) => `  { name: '${key}', cron: ${key} }`).join(",\n")}
-];
-
-type Stoppable = { stop: () => Promise<void> | void };
-const running: Stoppable[] = [];
-
-export async function setupCrons(
-  envParser: EnvironmentParser<any>,
-  logger: Logger,
-): Promise<void> {
-  if (crons.length === 0) {
-    return;
-  }
-
-  const serviceDiscovery = ServiceDiscovery.getInstance(envParser);
-
-  // Resolved once per cron rather than per firing: registering services on
-  // every tick would reconnect a database every minute.
-  const prepared = [];
-  for (const { name, cron } of crons) {
-    try {
-      const schedule = toCronExpression(cron.schedule);
-      const services = cron.services.length > 0
-        ? await serviceDiscovery.register(cron.services)
-        : {};
-
-      prepared.push({ name, cron, schedule, services });
-    } catch (error) {
-      // An unrepresentable schedule is a build-time mistake, and failing the
-      // process for it would take the HTTP server down with it.
-      logger.error({ err: error, cron: name }, 'Cron has no runnable schedule, skipping');
-    }
-  }
-
-  const run = async (entry: (typeof prepared)[number]) => {
-    try {
-      // The cron's own function, the way its Lambda would run it — services,
-      // the worker's database as \`db\`, its events. It used to call a
-      // \`handler\` a Cron does not have, so every firing logged a failure.
-      await runCron(entry.cron, serviceDiscovery);
-    } catch (error) {
-      logger.error({ err: error, cron: entry.name }, 'Cron failed');
-    }
-  };
-
-  // The app's one pg-boss: the events broker's, as the broker's role, in the
-  // broker's schema. A server fires its own crons, and a process scheduling in
-  // memory fires each job once per replica — so the schedule lives in
-  // Postgres. It used to be a second pg-boss on the worker's database, as the
-  // runtime role, which can neither create a schema nor use the broker's.
-  const { url, devPid } = envParser
-    .create((get) => ({
-      url: get('EVENT_PUBLISHER_CONNECTION_STRING').string().optional(),
-      // Set by \`gkm dev\` on the server it starts, and by nothing deployed.
-      devPid: get('GKM_DEV_PID').string().optional(),
-    }))
-    .parse();
-
-  if (!url?.startsWith('pgboss://')) {
-    // \`gkm dev\` on a target whose crons are infrastructure once deployed —
-    // EventBridge rules on AWS — has no broker to keep a schedule in. It is one
-    // process, so a timer fires each job once, which is all pg-boss is for
-    // here. Only there: a deployed server firing by timer fires once per
-    // replica, so outside dev this stays the error below.
-    if (devPid) {
-      for (const entry of prepared) {
-        running.push(scheduleInProcess(entry.schedule, () => run(entry)));
-        logger.info({ cron: entry.name, schedule: entry.schedule }, 'Cron scheduled in this process');
-      }
-      return;
-    }
-
-    logger.error(
-      { crons: prepared.map(({ name }) => name) },
-      'These crons have nowhere to keep their schedule. On a server they are ' +
-        'scheduled through the pg-boss events broker ' +
-        '(EVENT_PUBLISHER_CONNECTION_STRING), and ' +
-        (url ? 'the broker configured is not pg-boss.' : 'none is configured.'),
-    );
-    return;
-  }
-
-  // Through the registered pg-boss driver, which the entry registers for a
-  // server whose broker is pg-boss. Naming \`@geekmidas/events/pgboss\` here
-  // made every bundle with a cron resolve pg-boss, whatever its broker.
-  const { EventConnectionFactory } = await import('@geekmidas/events');
-  const connection = (await EventConnectionFactory.fromConnectionString(
-    url,
-  )) as import('@geekmidas/events').EventConnection & { instance?: any };
-  const boss = connection.instance!;
-
-  // What this app declares now. Anything else under the prefix belonged to a
-  // cron since renamed or deleted, and would keep firing at a handler that has
-  // gone.
-  //
-  // The prefix is \`cron.\` rather than \`cron:\`: pg-boss accepts
-  // alphanumerics, underscores, hyphens, periods and slashes in a queue name,
-  // and rejects a colon outright.
-  const declared = new Set(prepared.map(({ name }) => \`cron.\${name}\`));
-  for (const existing of await boss.getSchedules()) {
-    if (existing.name.startsWith('cron.') && !declared.has(existing.name)) {
-      await boss.unschedule(existing.name);
-      logger.info({ cron: existing.name }, 'Removed a schedule nothing declares');
-    }
-  }
-
-  for (const entry of prepared) {
-    const queue = \`cron.\${entry.name}\`;
-    await boss.createQueue(queue);
-    // UTC, so this agrees with the schedule a deploy target would have made.
-    await boss.schedule(queue, entry.schedule, undefined, { tz: 'UTC' });
-    await boss.work(queue, () => run(entry));
-
-    logger.info({ cron: entry.name, schedule: entry.schedule }, 'Cron scheduled');
-  }
-
-  running.push({ stop: () => connection.close() });
-  logger.info({ count: prepared.length }, 'Crons scheduled');
-}
-
-export async function stopCrons(): Promise<void> {
-  await Promise.all(running.map((r) => r.stop()));
-  running.length = 0;
-}
-`;
-		await writeFile(cronsPath, content);
-		return cronsPath;
-	}
-	async generateCronHandler(outputDir, sourceFile, exportName, context, owner) {
-		const handlerFileName = `${exportName}.ts`;
-		const handlerPath = join(outputDir, handlerFileName);
-		const importPath = relative(dirname(handlerPath), sourceFile).replace(/\.ts$/, ".js");
-		const runtime = runtimeFor(context, dirname(handlerPath), owner);
-		const content = `import { AWSScheduledFunction } from '@geekmidas/constructs/aws';
-import { ${exportName} } from '${importPath}';
-${runtime.imports}
-${context.storageDrivers?.imports ?? ""}
-${runtime.bindings}
-${context.storageDrivers?.setup ? `\n// The handler registers the drivers its target needs.\n${context.storageDrivers.setup}\n` : ""}
-const adapter = new AWSScheduledFunction(envParser, ${exportName});
-
-export const handler = adapter.handler;
-`;
-		await writeFile(handlerPath, content);
-		return handlerPath;
-	}
-};
-//#endregion
 //#region src/generators/FunctionGenerator.ts
 var FunctionGenerator = class extends ConstructGenerator {
 	isConstruct(value) {
@@ -2881,178 +2642,6 @@ export const handler = adapter.handler;
 	}
 };
 //#endregion
-//#region src/generators/QueueGenerator.ts
-/**
-* Generates the runtime for queue consumers (`worker.queue(…)`).
-*
-* - **server** (`gkm dev`): a single `queues.ts` exposing `setupQueues()` that
-*   polls each queue in-process, alongside the Hono server, through the queue's
-*   own connection string — pg-boss by default, SQS on the AWS emulator.
-* - **aws-lambda**: one handler file per queue wrapping `AWSLambdaQueue`, backed
-*   by an SQS event-source mapping.
-*/
-var QueueGenerator = class extends ConstructGenerator {
-	isConstruct(value) {
-		return Queue.isQueue(value);
-	}
-	async build(context, constructs, outputDir, options) {
-		const target = options?.target ?? "aws";
-		const logger = console;
-		const queueInfos = [];
-		if (target === "server") {
-			await this.generateServerQueuesFile(outputDir, constructs);
-			logger.log(`Generated server queues file with ${constructs.length} queues (polling mode)`);
-			return queueInfos;
-		}
-		if (constructs.length === 0) return queueInfos;
-		const queuesDir = join(outputDir, "queues");
-		await mkdir(queuesDir, { recursive: true });
-		for (const { key, construct, path } of constructs) {
-			const handlerFile = await this.generateQueueHandler(queuesDir, path.relative, key, context, construct.owner);
-			queueInfos.push({
-				name: construct.name,
-				handler: relative(options?.root ?? process.cwd(), handlerFile).replace(/\.ts$/, ".handler"),
-				batchSize: construct.batchSize,
-				fifo: construct.fifo,
-				timeout: construct.timeout,
-				environment: await construct.getEnvironment({ markOptional: context.markOptional }),
-				dependencies: construct.constructs
-			});
-			logger.log(`Generated queue handler: ${key}`);
-		}
-		return queueInfos;
-	}
-	async generateQueueHandler(outputDir, sourceFile, exportName, context, owner) {
-		const handlerPath = join(outputDir, `${exportName}.ts`);
-		const importPath = relative(dirname(handlerPath), sourceFile).replace(/\.ts$/, ".js");
-		const runtime = runtimeFor(context, dirname(handlerPath), owner);
-		const content = `import { AWSLambdaQueue } from '@geekmidas/constructs/aws';
-import { ${exportName} } from '${importPath}';
-${runtime.imports}
-${context.storageDrivers?.imports ?? ""}
-${runtime.bindings}
-${context.storageDrivers?.setup ? `\n// The handler registers the drivers its target needs.\n${context.storageDrivers.setup}\n` : ""}
-const adapter = new AWSLambdaQueue(envParser, ${exportName});
-
-export const handler = adapter.handler;
-`;
-		await writeFile(handlerPath, content);
-		return handlerPath;
-	}
-	async generateServerQueuesFile(outputDir, queues) {
-		await mkdir(outputDir, { recursive: true });
-		const queuesPath = join(outputDir, "queues.ts");
-		if (queues.length === 0) {
-			await writeFile(queuesPath, `/**
- * Generated queues setup — this app declares none.
- */
-import type { EnvironmentParser } from '@geekmidas/envkit';
-import type { Logger } from '@geekmidas/logger';
-
-export async function setupQueues(
-  _envParser: EnvironmentParser<any>,
-  _logger: Logger,
-): Promise<void> {}
-`);
-			return queuesPath;
-		}
-		const importsByFile = /* @__PURE__ */ new Map();
-		for (const { path, key } of queues) {
-			const importPath = relative(dirname(queuesPath), path.relative).replace(/\.ts$/, ".js");
-			if (!importsByFile.has(importPath)) importsByFile.set(importPath, []);
-			importsByFile.get(importPath)?.push(key);
-		}
-		const content = `/**
- * Generated queue consumers setup.
- *
- * Each queue's one consumer polls its own queue, through the queue's own
- * connection string — the one its producers publish on. SQS cannot push, so
- * this is a poller on every transport: pg-boss locally by default, the SQS
- * queue on the AWS emulator.
- *
- * Deployed on Lambda, a queue's consumer is an SQS event source instead.
- */
-import type { EnvironmentParser } from '@geekmidas/envkit';
-import type { Logger } from '@geekmidas/logger';
-import { EventConnectionFactory, Subscriber } from '@geekmidas/events';
-import type { EventConnection } from '@geekmidas/events';
-import { ServiceDiscovery } from '@geekmidas/services';
-${Array.from(importsByFile.entries()).map(([importPath, exports]) => `import { ${exports.join(", ")} } from '${importPath}';`).join("\n")}
-
-const queues = [
-${queues.map(({ key, construct }) => `  { queue: ${key}, connectionKey: '${provideKey(construct.id, "publisherConnectionString")}' },`).join("\n")}
-];
-
-export async function setupQueues(
-  envParser: EnvironmentParser<any>,
-  logger: Logger,
-): Promise<void> {
-  const serviceDiscovery = ServiceDiscovery.getInstance(envParser);
-  const connections = new Map<string, EventConnection>();
-
-  for (const { queue, connectionKey } of queues) {
-    const connectionString = process.env[connectionKey];
-    if (!connectionString) {
-      logger.error({ queue: queue.name, connectionKey }, 'No connection string for this queue');
-      continue;
-    }
-
-    try {
-      let connection = connections.get(connectionString);
-      if (!connection) {
-        connection = await EventConnectionFactory.fromConnectionString(connectionString);
-        connections.set(connectionString, connection);
-      }
-      const eventSubscriber = await Subscriber.fromConnection(connection);
-      const services = queue.services.length > 0
-        ? await serviceDiscovery.register(queue.services)
-        : {};
-      // The queue's database — the worker's, or its own — handed over as \`db\`.
-      const db = queue.databaseService
-        ? (await serviceDiscovery.register([queue.databaseService]))[
-            queue.databaseService.serviceName
-          ]
-        : undefined;
-
-      // A queue's messages carry one type — its own name.
-      await eventSubscriber.subscribe([queue.name], async (message) => {
-        try {
-          const validation = await queue.messageSchema['~standard'].validate(message.payload);
-          if (validation.issues) {
-            logger.error({ issues: validation.issues, queue: queue.name }, 'Queue message failed validation');
-            return;
-          }
-
-          await queue.handler({
-            messages: [validation.value],
-            services: services,
-            logger: queue.logger,
-            db,
-          } as any);
-        } catch (error) {
-          logger.error({ err: error, queue: queue.name }, 'Failed to process queue message');
-          // Rethrown so the transport keeps the message for a retry.
-          throw error;
-        }
-      });
-      logger.info({ queue: queue.name }, 'Queue consumer started polling');
-    } catch (error) {
-      logger.error({ err: error, queue: queue.name }, 'Failed to set up queue consumer');
-    }
-  }
-
-  const shutdown = () => {
-    for (const connection of connections.values()) void connection.close();
-  };
-  process.once('SIGTERM', shutdown);
-  process.once('SIGINT', shutdown);
-}
-`;
-		await writeFile(queuesPath, content);
-		return queuesPath;
-	}
-};
-//#endregion
 //#region src/generators/TopicGenerator.ts
 /**
 * Discovers topics (`new Topic(…)`) into `manifest.topics`. A topic is a
@@ -3384,7 +2973,8 @@ async function buildOneApp(input) {
 		markOptional: options.markOptional ?? false,
 		skipBundle: options.skipBundle ?? false,
 		stage: options.stage,
-		workspaceName: workspace.name
+		workspaceName: workspace.name,
+		workspace
 	});
 }
 /**
@@ -3426,11 +3016,13 @@ async function buildApp(input) {
 	const { config, workspaceRoot, appRoot, target, enableOpenApi, cacheBackend, eventsBackend, production, telescope, databaseApi, hooks, bustCache = false } = input;
 	const constructGlobs = config.constructs;
 	const constructSources = {};
+	const background = {};
 	const declared = constructGlobs ? await discover({
 		patterns: constructGlobs,
 		cwd: appRoot,
 		bustCache,
-		sources: constructSources
+		sources: constructSources,
+		background
 	}) : {};
 	const selfServing = selfServingSurface({
 		declared,
@@ -3444,7 +3036,7 @@ async function buildApp(input) {
 		if (production?.bundle && !input.skipBundle) {
 			const outputDir = join(appRoot, ".gkm", "server");
 			const entryPoint = await writeSurfaceServer(outputDir, production);
-			const { bundleServer } = await import("./bundler-CNTVLCCA.mjs");
+			const { bundleServer } = await import("./bundler-C2LZoLdP.mjs");
 			await bundleServer({
 				entryPoint,
 				outputDir: join(outputDir, "dist"),
@@ -3525,6 +3117,19 @@ async function buildApp(input) {
 		if (left.length > 0) logger$4.log(`Serving ${derived.surface.id} only: leaving out ${left.join(", ")} — they run in a Worker's image`);
 	}
 	const result = await buildForTarget(target, buildContext, appRoot, workspaceRoot, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, queueGenerator, topicGenerator, allEndpoints, allFunctions, allCrons, allSubscribers, allQueues, allTopics, enableOpenApi, input.skipBundle ?? false, input.stage);
+	if (target === "server" && production?.enabled && input.workspace) {
+		const appName = Object.entries(input.workspace.apps).find(([, app]) => resolve(input.workspace.root, app.path) === resolve(appRoot))?.[0];
+		await buildWorkers({
+			context: buildContext,
+			workers: workerUnits(input.workspace, declared, background).filter((unit) => unit.app === appName),
+			serverDir: join(appRoot, ".gkm", "server"),
+			crons: allCrons,
+			queues: allQueues,
+			subscribers: allSubscribers,
+			bundle: Boolean(production.bundle && !input.skipBundle),
+			...input.stage ? { stage: input.stage } : {}
+		});
+	}
 	await generateOpenApi(allEndpoints.map(({ construct }) => construct), {
 		openapi: config.openapi,
 		root: workspaceRoot
@@ -3534,6 +3139,46 @@ async function buildApp(input) {
 		...buildContext.databaseApi ? { databaseApi: buildContext.databaseApi.path } : {}
 	};
 }
+/**
+* Write each worker's entry — and, for an image, bundle it — from the
+* runnables built from that worker, and nothing built from another.
+*/
+async function buildWorkers(input) {
+	const generator = new WorkerGenerator();
+	for (const worker of input.workers) {
+		const owned = (list) => list.filter(({ construct }) => construct.owner === worker.id);
+		const crons = owned(input.crons);
+		const queues = owned(input.queues);
+		const subscribers = owned(input.subscribers);
+		const entryPoint = await generator.build({
+			context: input.context,
+			workerId: worker.id,
+			outputDir: workerEntryDir(input.serverDir, worker.id),
+			crons,
+			queues,
+			subscribers
+		});
+		logger$4.log(`Generated worker ${worker.id}: ${crons.length} crons, ${queues.length} queues, ${subscribers.length} subscribers`);
+		if (!input.bundle) continue;
+		const { bundleServer } = await import("./bundler-C2LZoLdP.mjs");
+		const outfile = workerBundleName(worker.id);
+		await bundleServer({
+			entryPoint,
+			outputDir: join(input.serverDir, "dist"),
+			outfile,
+			minify: input.context.production?.minify ?? false,
+			sourcemap: false,
+			external: input.context.production?.external ?? [],
+			...input.stage ? { stage: input.stage } : {},
+			constructs: [
+				...crons,
+				...queues,
+				...subscribers
+			].map((c) => c.construct)
+		});
+		logger$4.log(`✅ Bundle complete: .gkm/server/dist/${outfile}`);
+	}
+}
 async function buildForTarget(target, context, appRoot, workspaceRoot, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, queueGenerator, topicGenerator, endpoints, functions, crons, subscribers, queues, topics, enableOpenApi, skipBundle, stage) {
 	const outputDir = join(appRoot, ".gkm", target);
 	await Promise.all([...SUPERSEDED_OUTPUT.map((dir) => join(appRoot, ".gkm", dir)), ...appRoot === workspaceRoot ? [] : [join(appRoot, ".gkm", "manifest")]].map((dir) => rm(dir, {
@@ -3585,7 +3230,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$4.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await import("./bundler-CNTVLCCA.mjs");
+			const { bundleServer } = await import("./bundler-C2LZoLdP.mjs");
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -5284,25 +4929,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.72",
-	"@geekmidas/auth": "~10.0.0-alpha.72",
-	"@geekmidas/cache": "~10.0.0-alpha.72",
-	"@geekmidas/client": "~10.0.0-alpha.72",
-	"@geekmidas/cloud": "~10.0.0-alpha.72",
-	"@geekmidas/constructs": "~10.0.0-alpha.72",
-	"@geekmidas/db": "~10.0.0-alpha.72",
-	"@geekmidas/emailkit": "~10.0.0-alpha.72",
-	"@geekmidas/envkit": "~10.0.0-alpha.72",
-	"@geekmidas/errors": "~10.0.0-alpha.72",
-	"@geekmidas/events": "~10.0.0-alpha.72",
-	"@geekmidas/logger": "~10.0.0-alpha.72",
-	"@geekmidas/manifest": "~10.0.0-alpha.72",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.72",
-	"@geekmidas/schema": "~10.0.0-alpha.72",
-	"@geekmidas/services": "~10.0.0-alpha.72",
-	"@geekmidas/storage": "~10.0.0-alpha.72",
-	"@geekmidas/telescope": "~10.0.0-alpha.72",
-	"@geekmidas/testkit": "~10.0.0-alpha.72",
+	"@geekmidas/audit": "~10.0.0-alpha.73",
+	"@geekmidas/auth": "~10.0.0-alpha.73",
+	"@geekmidas/cache": "~10.0.0-alpha.73",
+	"@geekmidas/client": "~10.0.0-alpha.73",
+	"@geekmidas/cloud": "~10.0.0-alpha.73",
+	"@geekmidas/constructs": "~10.0.0-alpha.73",
+	"@geekmidas/db": "~10.0.0-alpha.73",
+	"@geekmidas/emailkit": "~10.0.0-alpha.73",
+	"@geekmidas/envkit": "~10.0.0-alpha.73",
+	"@geekmidas/errors": "~10.0.0-alpha.73",
+	"@geekmidas/events": "~10.0.0-alpha.73",
+	"@geekmidas/logger": "~10.0.0-alpha.73",
+	"@geekmidas/manifest": "~10.0.0-alpha.73",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.73",
+	"@geekmidas/schema": "~10.0.0-alpha.73",
+	"@geekmidas/services": "~10.0.0-alpha.73",
+	"@geekmidas/storage": "~10.0.0-alpha.73",
+	"@geekmidas/telescope": "~10.0.0-alpha.73",
+	"@geekmidas/testkit": "~10.0.0-alpha.73",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -11093,8 +10738,8 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await import("./migrate-guck0NJK.mjs");
-	const { discover } = await import("./discover-Buwf1z4P.mjs").then((n) => n.i);
+	const { migrateAndSeed } = await import("./migrate-CFFC3esE.mjs");
+	const { discover } = await import("./discover-BPelzeGW.mjs").then((n) => n.i);
 	const sources = {};
 	const manifest = await discover({
 		patterns: constructGlobs(workspace),
@@ -11524,7 +11169,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await import("./migrate-guck0NJK.mjs");
+		const { migrateCommand } = await import("./migrate-CFFC3esE.mjs");
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11538,7 +11183,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await import("./migrate-guck0NJK.mjs");
+		const { seedCommand } = await import("./migrate-CFFC3esE.mjs");
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11552,7 +11197,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await import("./migrate-guck0NJK.mjs");
+		const { migrationCommand } = await import("./migrate-CFFC3esE.mjs");
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -11646,7 +11291,7 @@ program.command("secrets:add").description("Build the keys a stage must be given
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsAddCommand } = await import("./add-XTLU19_E.mjs");
+		const { secretsAddCommand } = await import("./add-BiPlBUq3.mjs");
 		await secretsAddCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11657,7 +11302,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await import("./encryption-DcrxWl1s.mjs");
+		const { encryptionRotateCommand } = await import("./encryption-CmfPICSN.mjs");
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11668,7 +11313,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await import("./encryption-DcrxWl1s.mjs");
+		const { encryptionRetireCommand } = await import("./encryption-CmfPICSN.mjs");
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11711,7 +11356,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
 		const { reconcileMissingSecrets } = await import("./reconcile--I7V4Klj.mjs");
-		const { secretsStoreFor } = await import("./state-BJFherj1.mjs").then((n) => n.Lt);
+		const { secretsStoreFor } = await import("./state-DtS2HEfi.mjs").then((n) => n.qt);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const store = await secretsStoreFor(workspace, stage);
@@ -11720,7 +11365,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./state-BJFherj1.mjs").then((n) => n.J);
+		const { derivedContainers } = await import("./state-DtS2HEfi.mjs").then((n) => n.nt);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -11735,7 +11380,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 	}
 });
 program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services <list>", "Server targets: run MinIO and/or Mailpit (minio,mailpit) for mail and buckets the stage's secrets don't configure. Not production-grade").action(async (options) => {
-	const { deployCli } = await import("./cli-D1arS0p1.mjs");
+	const { deployCli } = await import("./cli-BfdfyTF6.mjs");
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: resolve(globalOptions.cwd ?? process.cwd()),
@@ -11752,8 +11397,8 @@ program.command("deploy").description("Deploy a stage through its target").optio
 });
 program.command("deploy:rollback").description("Put a stage's app back on its previous release (Dokploy): one app with --app, every app with --atomic").requiredOption("--stage <stage>", "A deployed stage").option("--app <app>", "The app to roll back").option("--atomic", "Roll back every app that has an earlier release").action(async (options) => {
 	try {
-		const { rollbackStage } = await import("./rollback-Bk91csFg.mjs").then((n) => n.a);
-		const { terminalCredentials } = await import("./terminal-C6TBo_SA.mjs");
+		const { rollbackStage } = await import("./rollback-C-V-Rf4a.mjs").then((n) => n.a);
+		const { terminalCredentials } = await import("./terminal-BdvrmkaC.mjs");
 		const globalOptions = program.opts();
 		await rollbackStage({
 			cwd: resolve(globalOptions.cwd ?? process.cwd()),
@@ -11788,7 +11433,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await import("./github-CqYOP8cI.mjs");
+		const { deployGithubCommand } = await import("./github-hjHHm7jM.mjs");
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));